popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

George.exe

UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 24, 2024, 11:33 a.m. June 24, 2024, 11:35 a.m.
Size 4.8MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5bb3677a298d7977d73c2d47b805b9c3
SHA256 85eb3f6ba52fe0fd232f8c3371d87f7d363f821953c344936ab87728ba6a627f
CRC32 0A4AC740
ssdeep 98304:/U1ygjPf+YEwNhQ9li49Zv85P95RPwAaj249R5EkDAUR:M0iPG4hQzi49ZgP/Rmj2gwkDA
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .vmp-~\x11&
resource name GOOGLEUPDATEAPPLICATIONCOMMANDS
resource name PATCHERTYPE
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2420
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x004bb200', u'virtual_address': u'0x002e3000', u'entropy': 7.990316045328515, u'name': u'.vmp-~\\x11&', u'virtual_size': u'0x004bb130'} entropy 7.99031604533 description A section with a high entropy has been found
entropy 0.985054900366 description Overall entropy of this PE file is high
section .vmp-~\x11& description Section name indicates VMProtect
section .vmp-~\x11& description Section name indicates VMProtect
section .vmp-~\x11& description Section name indicates VMProtect
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.LummaStealer.4!c
Elastic malicious (high confidence)
Skyhigh BehavesLike.Win32.Generic.rc
Cylance Unsafe
Sangfor Spyware.Win32.Lummastealer.Vn5p
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Spy.LummaStealer.B
APEX Malicious
McAfee Artemis!5BB3677A298D
Rising Spyware.Agent!8.C6 (TFE:5:hItpm0rPheO)
TrendMicro TrojanSpy.Win32.LUMMASTEALER.YXEFWZ
McAfeeD ti!85EB3F6BA52F
Trapmine malicious.high.ml.score
FireEye Generic.mg.5bb3677a298d7977
Sophos Mal/Generic-S
Gridinsoft Spy.Win32.Gen.tr
Microsoft Trojan:Win32/LummaStealer.CCIH!MTB
BitDefenderTheta AI:Packer.EF55B3D120
DeepInstinct MALICIOUS
TrendMicro-HouseCall TrojanSpy.Win32.LUMMASTEALER.YXEFWZ
SentinelOne Static AI - Malicious PE
MaxSecure Win.MxResIcn.Heur.Gen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_90% (W)