popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

go.exe

Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 11, 2024, 1:20 p.m. July 11, 2024, 1:33 p.m.
Size 4.7MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 6b7ca7aa20d0a9225f1b297bbf4c7f14
SHA256 725e8c3b8988d0bb4398a91afdd9d255d8f6f479397248629d21f250542d2859
CRC32 FA86C00A
ssdeep 49152:1AWNrHTA0hJnSnjWL/J8RWCEmBPdgwjG5Eubir1CG6bMQAZCO:1DFHthVSzRWjYdgvEqVQQkCO
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .symtab
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.symbol:
        
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.address:
        0x0
        

      
    
  
    
      
        registers.r14:
        9049984
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        -1
        

      
        registers.rsi:
        2292481
        

      
        registers.r10:
        3221225480
        

      
        registers.rbx:
        -10000
        

      
        registers.rsp:
        2292760
        

      
        registers.r11:
        514
        

      
        registers.r8:
        2292800
        

      
        registers.r9:
        350
        

      
        registers.rdx:
        0
        

      
        registers.r12:
        2293320
        

      
        registers.rbp:
        2292816
        

      
        registers.rdi:
        4436960
        

      
        registers.rax:
        0
        

      
        registers.r13:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W64.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (moderate confidence)
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win64.Backdoor.rh
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!6B7CA7AA20D0
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    UDS:DangerousObject.Multi.Generic
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan.WinGo.Rozena
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    Trojan/Win32.Agent
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    Win32.Troj.Unknown.a
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    UDS:DangerousObject.Multi.Generic
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Malware/Win.Generic.C5612105
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Malware.AI.4279104977
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Suspicious PE
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    Malicious_Behavior.SB
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_70% (D)