Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 18, 2024, 11:10 a.m.	July 18, 2024, 11:15 a.m.

Size	507.0KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`b511a938c3da1d394dadd5c5c67bb48b`
SHA256	`7010eb737bc8cbc8598ae5de392f485406f7fd1e821f0d7e6649f3022fcf8ac8`
CRC32	`505B7E49`
ssdeep	`12288:LK7gu5x1LpK8b/A92swJTUGrbbREsS4odrGCRXJe:LKH5w8bWGrxEFxICRE`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

6697dafdd90a3_crypted.exe#1 "C:\Users\test22\AppData\Local\Temp\6697dafdd90a3_crypted.exe#1"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
__exception__ July 18, 2024, 11:10 a.m.	stacktrace: exception.instruction_r: 81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75 exception.instruction: cmp dword ptr [esi], 0x64616f4c exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3d01cb registers.esp: 36634072 registers.edi: 1973072088 registers.eax: 1972830208 registers.ebp: 632 registers.edx: 1973069536 registers.ebx: 0 registers.esi: 1973551114 registers.ecx: 0	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 18, 2024, 11:10 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

section

{u'size_of_data': u'0x0004c800', u'virtual_address': u'0x00031000', u'entropy': 7.986657585372758, u'name': u'.data', u'virtual_size': u'0x0004d6bc'}

entropy

7.98665758537

description

A section with a high entropy has been found

entropy

0.604743083004

description

Overall entropy of this PE file is high

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Convagent.i!c
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.hc
Cylance	Unsafe
Sangfor	Worm.Win32.Save.a
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.GZLE
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Keylogger.Lazy-10031941-0
Kaspersky	HEUR:Trojan-PSW.Win32.Reline.gen
Rising	Malware.Undefined!8.C (TFE:5:LJYb8B5HnVJ)
DrWeb	Trojan.PWS.RedLineNET.9
TrendMicro	TrojanSpy.Win32.REDLINE.YXEGQZ
McAfeeD	ti!7010EB737BC8
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.b511a938c3da1d39
Sophos	Mal/Generic-S
Ikarus	Win32.Outbreak
Webroot	W32.Trojan.Agent.Gen
Google	Detected
Avira	TR/Kryptik.vagwy
Kingsoft	malware.kb.a.812
Gridinsoft	Malware.Win32.RedLine.tr
Microsoft	TrojanDownloader:Win32/Upatre!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Win32.Trojan.Kryptik.7YXJK4
Varist	W32/Kryptik.MJE.gen!Eldorado
BitDefenderTheta	Gen:NN.ZexaF.36808.FqW@ampxNNh
DeepInstinct	MALICIOUS
VBA32	BScope.TrojanPSW.RedLine
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TrojanSpy.Win32.REDLINE.YXEGQZ
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenKryptik.GZGT!tr
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan:Win/GenKryptik.GOAZ

6697dafdd90a3_crypted.exe#1