popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

e0cbefcb1af40c7d4aff4aca26621a98.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 25, 2024, 7:46 a.m. June 25, 2024, 7:48 a.m.
Size 4.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 78a9e69486fa214a1af7dc245ab3ec06
SHA256 502e18361730ced7e40e00a36d11de51a07a05f29d5b5c9ea54c662260a5d47c
CRC32 4FDDF05F
ssdeep 98304:dwYpq65PX7G0lKZQA6S/odjsKFGzL17vqhAWe1eQ3I:FpH7GDt6t5E17vTWeY7
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4161536
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03ce0000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 9351168
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x040e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00404a00', u'virtual_address': u'0x00001000', u'entropy': 7.999138804420965, u'name': u'.text', u'virtual_size': u'0x00404858'} entropy 7.99913880442 description A section with a high entropy has been found
entropy 0.987164107486 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Smokeloader.l!c
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Lockbit.rc
ALYac Gen:Variant.Zusy.539385
Cylance Unsafe
VIPRE Gen:Variant.Zusy.539385
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 0058221e1 )
BitDefender Gen:Variant.Zusy.539385
K7GW Trojan ( 0058221e1 )
Cybereason malicious.486fa2
Arcabit Trojan.Zusy.D83AF9
VirIT Trojan.Win32.Genus.VGZ
Symantec ML.Attribute.HighConfidence
tehtris Generic.Malware
ESET-NOD32 a variant of Win32/Kryptik.HWLJ
APEX Malicious
McAfee Artemis!78A9E69486FA
Avast Win32:PWSX-gen [Trj]
ClamAV Win.Dropper.Tofsee-10022554-0
Kaspersky HEUR:Trojan-Spy.Win32.Windigo.pef
Alibaba Trojan:Win32/Smokeloader.1e7daa1f
NANO-Antivirus Riskware.Win32.CloudGenRKIT.kkdvwg
MicroWorld-eScan Gen:Variant.Zusy.539385
Rising Trojan.SmokeLoader!1.F6AD (CLASSIC)
Emsisoft Adware.Generic (A)
F-Secure Trojan.TR/AD.CloudGenRKIT.dneew
DrWeb Trojan.Inject4.11025
Zillya Trojan.Kryptik.Win32.4618886
TrendMicro TROJ_GEN.R03BC0DC724
McAfeeD ti!502E18361730
Trapmine malicious.moderate.ml.score
FireEye Generic.mg.78a9e69486fa214a
Sophos Troj/Krypt-AEE
Ikarus Trojan.Win32.Krypt
Jiangmin TrojanSpy.Windigo.apt
Webroot W32.Rogue.Gen
Google Detected
Avira TR/AD.CloudGenRKIT.dneew
MAX malware (ai score=89)
Antiy-AVL Trojan/Win32.Kryptik.hwle
Gridinsoft Ransom.Win32.STOP.mz!c
Xcitium Malware@#1yyq9157jcm7d
Microsoft Trojan:Win32/StealC.SPXC!MTB
ZoneAlarm HEUR:Trojan-Spy.Win32.Windigo.pef
GData Gen:Variant.Zusy.539385
Varist W32/Kryptik.LSY.gen!Eldorado
AhnLab-V3 Trojan/Win.Amadey.R578960