Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 4, 2024, 1:21 p.m.	Aug. 4, 2024, 1:41 p.m.

Size	7.9MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5	`288f1d023c0446d190a28e5f1899667c`
SHA256	`0cccce4d35835aacf4606fc95ffd41e1aaf89f7821135df2b65236b2bc131a53`
CRC32	`8E64C66A`
ssdeep	`196608:pNeGPdFHpX40uqQuk0H5d9cU4+NhcolRUvNLFRD:pAGVFhJQuk0HZR4XF5RD`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file EnigmaProtector_IN - EnigmaProtector

JX2goame.exe "C:\Users\test22\AppData\Local\Temp\JX2goame.exe"
2556

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Aug. 4, 2024, 1:21 p.m.	computer_name: TEST22-PC	1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

One or more processes crashed (34 events)

Time & API	Arguments	Status
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabca78 @ 0xebca78 jx2goame+0xac6039 @ 0xec6039 jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686684 registers.edi: 16429296 registers.eax: 0 registers.ebp: 2686712 registers.edx: 2 registers.ebx: 3532071202 registers.esi: 13836288 registers.ecx: 49036048	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabca78 @ 0xebca78 jx2goame+0xac6039 @ 0xec6039 jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686720	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabca78 @ 0xebca78 jx2goame+0xac6039 @ 0xec6039 jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686720	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabca78 @ 0xebca78 jx2goame+0xac6039 @ 0xec6039 jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686720	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabca78 @ 0xebca78 jx2goame+0xac6039 @ 0xec6039 jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686684 registers.edi: 2686684 registers.eax: 0 registers.ebp: 2686712 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686720	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe23f @ 0xebe23f jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 15223460 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 9641984 registers.esi: 13836288 registers.ecx: 13836288	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe23f @ 0xebe23f jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe23f @ 0xebe23f jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe50c @ 0xebe50c jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 15223460 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 9641984 registers.esi: 13836288 registers.ecx: 0	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe50c @ 0xebe50c jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe50c @ 0xebe50c jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe50c @ 0xebe50c jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe50c @ 0xebe50c jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe50c @ 0xebe50c jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe532 @ 0xebe532 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: cc 68 ed ac 97 69 e9 d0 f6 fe ff bf 3b 37 ff 6e exception.symbol: jx2goame+0xac6d0d exception.instruction: int3 exception.module: JX2goame.exe exception.exception_code: 0x80000003 exception.offset: 11300109 exception.address: 0xec6d0d registers.esp: 2686620 registers.edi: 15223373 registers.eax: 2324 registers.ebp: 2686648 registers.edx: 2686656 registers.ebx: 9641984 registers.esi: 13846087 registers.ecx: 0	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: exception.instruction_r: cc 68 18 cc 97 69 e9 49 4a ff ff bf d1 1b ab c8 exception.symbol: jx2goame+0xac1994 exception.instruction: int3 exception.module: JX2goame.exe exception.exception_code: 0x80000003 exception.offset: 11278740 exception.address: 0xec1994 registers.esp: 2686620 registers.edi: 15223460 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 0 registers.ebx: 9641984 registers.esi: 13836288 registers.ecx: 1676345344	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe6ab @ 0xebe6ab jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 15223460 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 9641984 registers.esi: 13836288 registers.ecx: 0	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe6ab @ 0xebe6ab jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe6ab @ 0xebe6ab jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe6ab @ 0xebe6ab jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe884 @ 0xebe884 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 15223460 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 9641984 registers.esi: 13836288 registers.ecx: 0	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe884 @ 0xebe884 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe884 @ 0xebe884 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe884 @ 0xebe884 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe982 @ 0xebe982 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 15223460 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 9641984 registers.esi: 13836288 registers.ecx: 0	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe982 @ 0xebe982 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe982 @ 0xebe982 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: 0f 0b e8 19 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa12700 exception.instruction: ud2 exception.module: JX2goame.exe exception.exception_code: 0xc000001d exception.offset: 10561280 exception.address: 0xe12700 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 2 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe982 @ 0xebe982 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755606 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe982 @ 0xebe982 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: jx2goame+0xabe982 @ 0xebe982 jx2goame+0xac604b @ 0xec604b jx2goame+0xbaace0 @ 0xfaace0 exception.instruction_r: f7 f0 e8 44 37 01 00 33 c0 5a 59 59 64 89 10 eb exception.symbol: jx2goame+0xa126d5 exception.instruction: div eax exception.module: JX2goame.exe exception.exception_code: 0xc0000094 exception.offset: 10561237 exception.address: 0xe126d5 registers.esp: 2686620 registers.edi: 2686620 registers.eax: 0 registers.ebp: 2686648 registers.edx: 0 registers.ebx: 14755563 registers.esi: 0 registers.ecx: 2686656	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: exception.instruction_r: cc 68 18 cc 97 69 e9 49 4a ff ff bf d1 1b ab c8 exception.symbol: jx2goame+0xac1994 exception.instruction: int3 exception.module: JX2goame.exe exception.exception_code: 0x80000003 exception.offset: 11278740 exception.address: 0xec1994 registers.esp: 62717716 registers.edi: 49144732 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 0 registers.ebx: 48826556 registers.esi: 12 registers.ecx: 1676345344	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: exception.instruction_r: cc 68 18 cc 97 69 e9 49 4a ff ff bf d1 1b ab c8 exception.symbol: jx2goame+0xac1994 exception.instruction: int3 exception.module: JX2goame.exe exception.exception_code: 0x80000003 exception.offset: 11278740 exception.address: 0xec1994 registers.esp: 62717716 registers.edi: 49144732 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 0 registers.ebx: 48826558 registers.esi: 12 registers.ecx: 1676345344	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: exception.instruction_r: cc 68 18 cc 97 69 e9 49 4a ff ff bf d1 1b ab c8 exception.symbol: jx2goame+0xac1994 exception.instruction: int3 exception.module: JX2goame.exe exception.exception_code: 0x80000003 exception.offset: 11278740 exception.address: 0xec1994 registers.esp: 62717716 registers.edi: 49144732 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 0 registers.ebx: 48826560 registers.esi: 10 registers.ecx: 1676345344	1
__exception__ Aug. 4, 2024, 1:21 p.m.	stacktrace: exception.instruction_r: cc 68 18 cc 97 69 e9 49 4a ff ff bf d1 1b ab c8 exception.symbol: jx2goame+0xac1994 exception.instruction: int3 exception.module: JX2goame.exe exception.exception_code: 0x80000003 exception.offset: 11278740 exception.address: 0xec1994 registers.esp: 62717716 registers.edi: 49144732 registers.eax: 4 registers.ebp: 1111705675 registers.edx: 0 registers.ebx: 48826562 registers.esi: 10 registers.ecx: 1676345344	1

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02c30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01190000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x011a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02e94000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ea4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 147456 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ea4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ec4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 81920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 1753088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x039d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 region_size: 49152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02ed8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 7610368 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 1826816 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b43000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 4, 2024, 1:21 p.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 20480 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00d0a000 process_handle: 0xffffffff	1

Foreign language identified in PE resource (14 events)

name

RT_BITMAP

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00809388

size

0x000ea62a

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0092f200

size

0x000025a8

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x009317a8

size

0x000000ae

The binary likely contains encrypted or compressed data indicative of a packer (9 events)

section

{u'size_of_data': u'0x001aaa00', u'virtual_address': u'0x00743000', u'entropy': 7.99988927504111, u'name': u'', u'virtual_size': u'0x001be000'}

entropy

7.99988927504

description