popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

build16666.exe

Generic Malware Malicious Library PE64 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 14, 2024, 5:44 p.m. July 14, 2024, 5:47 p.m.
Size 1.7MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 4640faeafa95ce219c649e9f5cbffd75
SHA256 5e2839553458547a92fff7348862063b30510e805a550e02d94a89bd8fd0768d
CRC32 4FFD4BFE
ssdeep 49152:ROG8g1q+0zLvddLpmLM1vkRG6PDaChedUaq4UL:Mzdg
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1932
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000077711000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 1900544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000001cc0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000001e10000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1932
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000001e12000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Amadey.4!c
Elastic malicious (high confidence)
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Multi
Skyhigh BehavesLike.Win64.Generic.th
Cylance Unsafe
VIPRE Trojan.GenericKD.73423390
Sangfor Trojan.Win64.Amadey.Vbt6
K7AntiVirus Trojan ( 005b7e201 )
BitDefender Trojan.GenericKD.73423390
K7GW Trojan ( 005b7e201 )
Arcabit Trojan.Generic.D4605A1E
VirIT Trojan.Win64.Genus.GZD
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win64/Rozena.ABN
APEX Malicious
Avast Win64:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win64/Amadey.60f7cad4
MicroWorld-eScan Trojan.GenericKD.73423390
Rising Trojan.Amadey!8.11DFB (C64:YzY0OkQ/ehWfu750)
Emsisoft Trojan.GenericKD.73423390 (B)
F-Secure Trojan.TR/AVI.Agent.ttgsc
TrendMicro TROJ_GEN.R002C0DGC24
McAfeeD ti!5E2839553458
Trapmine suspicious.low.ml.score
FireEye Generic.mg.4640faeafa95ce21
Sophos Mal/Generic-S
Ikarus Trojan.Win64.Rozena
Webroot W32.Trojan.GenKD
Google Detected
Avira TR/AVI.Agent.ttgsc
MAX malware (ai score=83)
Antiy-AVL Trojan/Win64.DBadur
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Susp.U.XOREncoded.sd!yf
Microsoft Trojan:Win64/Amadey!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.GenericKD.73423390
Varist W64/ABTrojan.JQVR-0712
AhnLab-V3 Trojan/Win.Generic.C5648814
DeepInstinct MALICIOUS
Malwarebytes Trojan.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0DGC24
Tencent Win32.Trojan.Malware.Szfl
MaxSecure Trojan.Malware.1728101.susgen
Fortinet W32/PossibleThreat
AVG Win64:MalwareX-gen [Trj]