popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66990947b9f24_crypted.exe#1

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 19, 2024, 12:50 p.m. July 19, 2024, 12:52 p.m.
Size 507.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 ae74c6d6ed392c35afafedfc9316d163
SHA256 f408c8ba5781966f6ce1da805de79deb4a5e3c9dfbe097493123257e6112bf71
CRC32 F4A6BF89
ssdeep 12288:m6LAu5tBQFA2pAmR+IhIiI82uJhktKFB22Ce:m6H5oFRVIohrpZ
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75
        

      
        exception.instruction:
        cmp dword ptr [esi], 0x64616f4c
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.symbol:
        
        

      
        exception.address:
        0x2d01cb
        

      
    
  
    
      
        registers.esp:
        35192504
        

      
        registers.edi:
        1969008856
        

      
        registers.eax:
        1968766976
        

      
        registers.ebp:
        637
        

      
        registers.edx:
        1969006304
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        1970143252
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          316
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x002d0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0004c800', u'virtual_address': u'0x00031000', u'entropy': 7.986893395859821, u'name': u'.data', u'virtual_size': u'0x0004d6bc'}
                                        
                                    
                                        
                                            entropy
                                            7.98689339586
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.604743083004
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Generic.4!c
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win32.Generic.hc
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Worm.Win32.Save.a
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/GenKryptik.GZLE
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!AE74C6D6ED39
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    PWSX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    ClamAV
                                    Win.Keylogger.Lazy-10031941-0
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    HEUR:Trojan-PSW.Win32.Reline.gen
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Stealer.Convagent!8.1326D (CLOUD)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/AVI.PWS.Agent.kvrxb
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Trojan.PWS.RedLineNET.9
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    TrojanSpy.Win32.METASTEALER.YXEGRZ
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    ti!F408C8BA5781
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.ae74c6d6ed392c35
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/Generic-S
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan-Spy.LummaStealer
                                    
                                


                            

                        

                            

                                

                                    Webroot
                                    W32.Trojan.Agent.Gen
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/AVI.PWS.Agent.kvrxb
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    Trojan[PSW]/MSIL.Convagent
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    malware.kb.a.895
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Malware.Win32.RedLine.tr
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Redline.MAE!MTB
                                    
                                


                            

                        

                            

                                

                                    ViRobot
                                    Trojan.Win.Z.Genkryptik.519168.A
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    HEUR:Trojan-PSW.Win32.Reline.gen
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Win32.Trojan.PSE.NV36C4
                                    
                                


                            

                        

                            

                                

                                    Varist
                                    W32/Kryptik.MJE.gen!Eldorado
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Trojan/Win.Generic.C5650912
                                    
                                


                            

                        

                            

                                

                                    BitDefenderTheta
                                    Gen:NN.ZexaF.36808.FqW@aqXOtOl
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    BScope.TrojanPSW.Vidar
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Trojan.Downloader
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/Chgt.AD
                                    
                                


                            

                        

                            

                                

                                    TrendMicro-HouseCall
                                    TrojanSpy.Win32.METASTEALER.YXEGRZ
                                    
                                


                            

                        

                            

                                

                                    Fortinet
                                    W32/GenKryptik.GZGT!tr
                                    
                                


                            

                        

                            

                                

                                    AVG
                                    PWSX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Paloalto
                                    generic.ml
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_100% (W)
                                    
                                


                            

                        

                            

                                

                                    alibabacloud
                                    Trojan:Win/GenKryptik.GOAZ