popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mft.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 11, 2024, 1:22 p.m. July 11, 2024, 1:46 p.m.
Size 4.5MB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
MD5 387d5dde1f4a235218315898b93df6c1
SHA256 ce2c82582a12dac08c75bd58252ec27e6a2bbdfa7f96391ac2364f56d4da40f7
CRC32 FA88116D
ssdeep 49152:Zxan6HUBwtqTIG31ULlDZ2QqNvp6ukKtbV7VzU9mKjo21fijZrL1R0Aa+LaQCof3:/a6nkIEULlDZuVzJ2p6X7fw9
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .symtab
Bkav W32.AIDetectMalware
Elastic malicious (moderate confidence)
Cylance Unsafe
McAfeeD ti!CE2C82582A12
Ikarus Trojan.Crypt
Google Detected
DeepInstinct MALICIOUS
SentinelOne Static AI - Suspicious PE
file C:\Users\test22\AppData\Local\Temp\.p.lock
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x0018fe29
function_name: wine_get_version
module: ntdll
module_address: 0x76f10000
3221225785 0