popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

C.jpg.exe

UPX PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 2, 2024, 3:45 p.m. July 2, 2024, 3:45 p.m.
Size 29.8KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 b3623c2ff1b7635712d8ff50d58560d2
SHA256 7c4e83e6e93350cfb52527742e890c6653074cdcef86a759fe489e2f8738d071
CRC32 D89060B0
ssdeep 768:ZrXIbh16iM92S+xfq4H2mV3rnbcuyD7UsdVMqn/u3p:ZrXIbhlMofo4Wm1rnouy8sX2
Yara
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.symbol:
exception.exception_code: 0xc0000005
exception.address: 0x0
registers.esp: 12057688
registers.edi: 0
registers.eax: 1968976824
registers.ebp: 12057696
registers.edx: 0
registers.ebx: 0
registers.esi: 0
registers.ecx: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73660000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73571000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734a4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73572000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bf1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4294967295
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
3221225495 0
section {u'size_of_data': u'0x00005000', u'virtual_address': u'0x0000a000', u'entropy': 7.89877446968245, u'name': u'UPX1', u'virtual_size': u'0x00005000'} entropy 7.89877446968 description A section with a high entropy has been found
entropy 0.975609756098 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
section UPX2 description Section name indicates UPX
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.ShellcodeRunner.4!c
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Agent
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Midie.150472
Cylance Unsafe
VIPRE Gen:Variant.Midie.150472
K7AntiVirus Trojan ( 005b71741 )
BitDefender Gen:Variant.Midie.150472
K7GW Trojan ( 005b71741 )
Arcabit Trojan.Midie.D24BC8
Symantec Trojan.Gen.MBT
ESET-NOD32 Win32/ShellcodeRunner.KP
APEX Malicious
McAfee Artemis!B3623C2FF1B7
Avast Win32:MalwareX-gen [Trj]
Alibaba Trojan:Win32/ShellcodeRunner.95b09d7a
NANO-Antivirus Trojan.Win32.Redcap.koswrj
MicroWorld-eScan Gen:Variant.Midie.150472
Rising Trojan.ShellcodeRunner!8.6166 (CLOUD)
Emsisoft Gen:Variant.Midie.150472 (B)
F-Secure Trojan.TR/Redcap.rseke
McAfeeD ti!7C4E83E6E933
FireEye Gen:Variant.Midie.150472
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Shellcoderunner
Google Detected
Avira TR/Redcap.rseke
Antiy-AVL Trojan/Win32.ShellcodeRunner
Kingsoft Win32.Troj.ShellcodeRun.KP
Gridinsoft Trojan.Win32.Gen.sa
Microsoft Trojan:Win32/Casdet!rfn
GData Gen:Variant.Midie.150472
BitDefenderTheta Gen:NN.ZedlaF.36808.bmQfa8SHlrm
DeepInstinct MALICIOUS
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H09FO24
MAX malware (ai score=80)
AVG Win32:MalwareX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_70% (W)
alibabacloud Trojan:Win/ShellcodeRunner.KX