popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

joom.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 July 26, 2024, 10:23 a.m. July 26, 2024, 10:25 a.m.
Size 250.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 278d770f363da10c7f7eb1a9c653ccf0
SHA256 e188132c1d115a2f78c5da36d56f178f1a6586106b62341c4f942993512abeec
CRC32 510BD894
ssdeep 3072:GHXfJmQUzlOCTqUG6n3EK37jiknZyKmvThlv8PU6PR4+LhAm+P3cQuT2:UPJmQUzlxaKrPyKZ/KrsQuT
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name SELUNIBI
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2596
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x028de000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2596
region_size: 196608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00330000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00021800', u'virtual_address': u'0x00001000', u'entropy': 7.823971504288994, u'name': u'.text', u'virtual_size': u'0x00021800'} entropy 7.82397150429 description A section with a high entropy has been found
entropy 0.537074148297 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
tehtris Generic.Malware
Cynet Malicious (score: 100)
McAfee Trojan-FWPJ!278D770F363D
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 005649fd1 )
K7GW Trojan ( 005649fd1 )
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
ClamAV Win.Packer.pkr_ce1a-9980177-0
Kaspersky VHO:Trojan.Win32.DiskWriter.gen
Rising Trojan.SmokeLoader!1.FF9D (CLASSIC)
McAfeeD Real Protect-LS!278D770F363D
Trapmine malicious.high.ml.score
FireEye Generic.mg.278d770f363da10c
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
Google Detected
Kingsoft malware.kb.a.1000
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm VHO:Trojan.Win32.DiskWriter.gen
BitDefenderTheta Gen:NN.ZexaF.36810.pq0@amf!cAbG
DeepInstinct MALICIOUS
Malwarebytes Trojan.MalPack.GS
Panda Trj/Genetic.gen
Tencent Trojan.Win32.Obfuscated.gen
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.EWCW!tr