popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 19, 2024, 1:03 p.m. July 19, 2024, 1:06 p.m.
Size 171.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4b0e023d1ddfc2a8166c652300375b1a
SHA256 408e6e127e24828a7fd237ffa2e6bdf031847ff3a28bf4c6ed89a6c1fd7cfc7c
CRC32 A843A3FF
ssdeep 3072:T1USLrbu37RHjNwNPFmCsI7/4pPcgE5MM5jWiZJBXETBS:5L/87R8MYUp3cKiBGS
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .wiyeviw
section .wanafex
resource name XISAGETIXUROLUSEXI
name XISAGETIXUROLUSEXI language LANG_TURKISH filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x000b3e48 size 0x000003fa
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x000b3968 size 0x00000468
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x000b3dd0 size 0x00000076
section {u'size_of_data': u'0x00018c00', u'virtual_address': u'0x00001000', u'entropy': 7.419514686989324, u'name': u'.text', u'virtual_size': u'0x00018a32'} entropy 7.41951468699 description A section with a high entropy has been found
entropy 0.582352941176 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.ch
Cylance Unsafe
Sangfor Trojan.Win32.Agent.Vv7r
K7AntiVirus Trojan ( 0056b39a1 )
K7GW Trojan ( 0056b39a1 )
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Avast BotX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
DrWeb Trojan.DownLoader47.9899
BitDefenderTheta Gen:NN.ZexaF.36808.ky0@am95GvbG
McAfeeD Real Protect-LS!4B0E023D1DDF
Trapmine malicious.high.ml.score
FireEye Generic.mg.4b0e023d1ddfc2a8
Sophos Mal/Generic-S
Kingsoft malware.kb.a.1000
ZoneAlarm UDS:DangerousObject.Multi.Generic
McAfee Artemis!4B0E023D1DDF
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Agent
Malwarebytes Generic.Malware/Suspicious
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HEDU!tr
AVG BotX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)