Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 24, 2024, 7:35 a.m.	July 24, 2024, 7:38 a.m.

Size	684.5KB
Type	PE32 executable (console) Intel 80386, for MS Windows
MD5	`b42e6e906c622c0785c93e615ed2cc2b`
SHA256	`48f0e9cca3590c3205e01a5e290e21b342f2848cc914d34a34efca1d3b7ddc87`
CRC32	`D7370C47`
ssdeep	`12288:abwDcvRLciGt3VjKyq54mdyrbVc6x4A8L0hQda0yNVf8lRHBsPZOGi:hgZQtorXgr/xe0huOVO8Z`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

201.exe "C:\Users\test22\AppData\Local\Temp\201.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.bsS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 24, 2024, 7:35 a.m.	stacktrace: exception.instruction_r: 81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75 exception.instruction: cmp dword ptr [esi], 0x64616f4c exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x3001cb registers.esp: 36371548 registers.edi: 1973072088 registers.eax: 1972830208 registers.ebp: 632 registers.edx: 1973069536 registers.ebx: 0 registers.esi: 1973551114 registers.ecx: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 24, 2024, 7:35 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00300000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0007f400', u'virtual_address': u'0x0002b000', u'entropy': 7.9953044811994705, u'name': u'.data', u'virtual_size': u'0x00080404'}

entropy

7.9953044812

description

A section with a high entropy has been found

entropy

0.744696415508

description

Overall entropy of this PE file is high

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.jc
ALYac	Gen:Variant.Fragtor.589903
Cylance	Unsafe
VIPRE	Gen:Variant.Fragtor.589903
Sangfor	Trojan.Win32.Save.a
BitDefender	Gen:Variant.Fragtor.589903
Cybereason	malicious.06c622
Arcabit	Trojan.Fragtor.D9004F
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HXIV
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
ClamAV	Win.Keylogger.Lazy-10031941-0
Kaspersky	HEUR:Trojan.Win32.Stelpak.gen
MicroWorld-eScan	Gen:Variant.Fragtor.589903
Rising	Trojan.Stealerc!8.1840A (TFE:1:rCSQJn51qSS)
Emsisoft	Gen:Variant.Fragtor.589903 (B)
McAfeeD	ti!48F0E9CCA359
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.b42e6e906c622c07
Sophos	Generic ML PUA (PUA)
Ikarus	Trojan-Spy.LummaStealer
Google	Detected
MAX	malware (ai score=83)
Kingsoft	malware.kb.a.974
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	VHO:Trojan-PSW.MSIL.Convagent.gen
GData	Gen:Variant.Fragtor.589903
BitDefenderTheta	Gen:NN.ZexaF.36810.QuW@aa6vITn
VBA32	BScope.TrojanPSW.Vidar
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)

201.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All