popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

winws.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 11, 2024, 1:16 p.m. July 11, 2024, 1:19 p.m.
Size 4.5MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 1625c2e651375de754d82329b5e8b924
SHA256 e5e0d3b2bd3f58d9322a3a39ad3f54bffe1499fde18c3f84b261a5f53a15c94b
CRC32 182B62BF
ssdeep 98304:bGGtyqBP0cNb25/vutPQWtKzO8yf4QYHn2VgPQ91o:6wyUP0cNbq/vBWtX8yf4QW2SX
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.symbol:
        
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.address:
        0x0
        

      
    
  
    
      
        registers.r14:
        13584352
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        -1
        

      
        registers.rsi:
        2422488
        

      
        registers.r10:
        3221225485
        

      
        registers.rbx:
        -10000
        

      
        registers.rsp:
        2422152
        

      
        registers.r11:
        2
        

      
        registers.r8:
        2422192
        

      
        registers.r9:
        360
        

      
        registers.rdx:
        0
        

      
        registers.r12:
        2422712
        

      
        registers.rbp:
        2422216
        

      
        registers.rdi:
        9055296
        

      
        registers.rax:
        0
        

      
        registers.r13:
        8
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00345600', u'virtual_address': u'0x00094000', u'entropy': 7.985961261932411, u'name': u'.data', u'virtual_size': u'0x003455a0'}
                                        
                                    
                                        
                                            entropy
                                            7.98596126193
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.723512258343
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W64.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win64.Generic.rc
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Trojan.Win32.Save.a
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/Packed.GoLang_AGen.G suspicious
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    ti!E5E0D3B2BD3F
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.1625c2e651375de7
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    CXrep/MalGo-B
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan.WinGo.Shellcoderunner
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Program:Win32/Wacapew.C!ml
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Generic.Malware.AI.DDS
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_90% (D)