popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

univ.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 6, 2024, 6:19 p.m. July 6, 2024, 6:22 p.m.
Size 234.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 217b817f890ef7fc49dc9207d55d2a01
SHA256 4952bdcedd7e1b79a220f6aa4e60e8161e5b18a6dc587c14f98052be633df538
CRC32 9CDBE2BC
ssdeep 6144:L+O9JN4U5IrZpH5zmKaHVkq8xC2Y+POeMSzeQC81SxSAthE+BHgtTjEbDiLca6y9:L+O9JNaZpH5zmKaHVkq8xC2Y+POeMSzL
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.172.128.90 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 185.172.128.90:80 -> 192.168.56.101:49163 2400032 ET DROP Spamhaus DROP Listed Traffic Inbound group 33 Misc Attack

Suricata TLS

No Suricata TLS

suspicious_features Connection to IP address suspicious_request GET http://185.172.128.90/cpa/name.php
request GET http://185.172.128.90/cpa/name.php
description univ.exe tried to sleep 120 seconds, actually delayed analysis time by 120 seconds
host 185.172.128.90
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Tepfer.i!c
Elastic Windows.Generic.Threat
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.dh
ALYac Gen:Variant.Zusy.539704
Cylance Unsafe
VIPRE Gen:Variant.Zusy.539704
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Variant.Zusy.539704
K7GW Trojan-Downloader ( 005483441 )
Cybereason malicious.f890ef
Arcabit Trojan.Zusy.D83C38
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Agent.ELB
APEX Malicious
McAfee Artemis!217B817F890E
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Malware.Zusy-10031670-0
Kaspersky HEUR:Trojan-PSW.Win32.Tepfer.gen
Alibaba TrojanDownloader:Win32/ICLoader.e921c16d
MicroWorld-eScan Gen:Variant.Zusy.539704
Rising Downloader.Agent!8.B23 (TFE:5:vHLMrzfmgST)
Emsisoft Gen:Variant.Zusy.539704 (B)
F-Secure Heuristic.HEUR/AGEN.1317762
TrendMicro TROJ_GEN.R002C0DG524
McAfeeD Real Protect-LS!217B817F890E
FireEye Generic.mg.217b817f890ef7fc
Sophos Mal/Generic-S
Ikarus Win32.Outbreak
Jiangmin Trojan.PSW.Tepfer.nlz
Webroot W32.Malware.Gen
Google Detected
Avira HEUR/AGEN.1317762
MAX malware (ai score=83)
Antiy-AVL Trojan[PSW]/Win32.Tepfer
Kingsoft malware.kb.a.915
Gridinsoft Malware.Win32.Gen.tr
Microsoft Trojan:Win32/ICLoader.JL!MTB
ViRobot Trojan.Win.Z.Zusy.240128.J
ZoneAlarm HEUR:Trojan-PSW.Win32.Tepfer.gen
GData Gen:Variant.Zusy.539704
Varist W32/Agent.EPA.gen!Eldorado
AhnLab-V3 Malware/Gen.Generic.C5120832
BitDefenderTheta AI:Packer.C6937BBA1F
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Downloader
Malwarebytes Trojan.Downloader
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_GEN.R002C0DG524