popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

2.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 20, 2024, 7:59 p.m. July 20, 2024, 8:14 p.m.
Size 243.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cd385c52e6ad2dd6a304839159534b7e
SHA256 b1680f17257af3c77a220fcf29ade51d0f02e9b429f687cc2d8a66f5a07e272b
CRC32 BF5415AF
ssdeep 3072:X0tRmAsRYfI174Ofi0Q2SAMvDVNronnE+kQBwbCvhb9zWbqs5uxVCW:ERlfIXvQ2IDrktzB1Jb0qWkC
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .zus
section .ciho
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 508
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 86016
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0031c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 508
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02130000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00025200', u'virtual_address': u'0x00001000', u'entropy': 7.638881127882935, u'name': u'.text', u'virtual_size': u'0x000251df'} entropy 7.63888112788 description A section with a high entropy has been found
entropy 0.613636363636 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
tehtris Generic.Malware
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.dh
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005772c51 )
K7GW Trojan ( 005772c51 )
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky VHO:Trojan.Win32.Convagent.gen
BitDefenderTheta Gen:NN.ZexaF.36810.py0@auXIMWpG
McAfeeD Real Protect-LS!CD385C52E6AD
Trapmine malicious.high.ml.score
FireEye Generic.mg.cd385c52e6ad2dd6
Sophos Troj/Krypt-VK
Ikarus Trojan-Dropper.Win32.Danabot
Google Detected
Kingsoft malware.kb.a.1000
Gridinsoft Ransom.Win32.STOP.tr!n
ZoneAlarm VHO:Trojan.Win32.Convagent.gen
AhnLab-V3 Infostealer/Win.RedLine.R658443
Acronis suspicious
DeepInstinct MALICIOUS
Tencent Trojan.Win32.Obfuscated.gen
SentinelOne Static AI - Malicious PE
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Kryptik.HFSR!tr
CrowdStrike win/malicious_confidence_100% (D)