popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

gen.exe

Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 11, 2024, 1:15 p.m. July 11, 2024, 1:41 p.m.
Size 1.8MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 2ece8e2b24bfaf4825acc4888bbd31ac
SHA256 97a8be603cade59060b3adb885ad6dcc91de036589b99e1d1970c24b7b5ce47a
CRC32 DB005F77
ssdeep 49152:usoFVUax3Tgrb/TBvO90d7HjmAFd4A64nsfJeEkGXJCIgsaZM4jID1:m39kGXyN
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .symtab
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
Bkav W64.AIDetectMalware
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win64.Ctsinf.th
Cylance Unsafe
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
McAfeeD ti!97A8BE603CAD
Ikarus PUA.Generic
ZoneAlarm UDS:DangerousObject.Multi.Generic
DeepInstinct MALICIOUS
SentinelOne Static AI - Suspicious PE
MaxSecure Trojan.Malware.300983.susgen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_70% (D)
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000007fefd6b7a50
function_name: wine_get_version
module: ntdll
module_address: 0x0000000076d30000
-1073741511 0