popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Crack.exe

UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 4, 2024, 1:28 p.m. Aug. 4, 2024, 2:07 p.m.
Size 4.9MB
Type PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5 7dad2c4407957ac063b27b5dbbe8e596
SHA256 eefe4186b76670dd5d2a0e69ff14d4833333cd4b047a3f2260a736fd69da4a79
CRC32 AC3DABCB
ssdeep 98304:cHq30uZ1rpxCcHiU7g/iftzaGS107AJ121Ghl8LcFRrgDn7LgckWofmgC/g:czuFxCSx7gKJS10UT2Cl8APsTV4fmPY
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
124.222.5.128 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49161
124.222.5.128:3232 		None None None

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: 2024/08/04 13:28:44 Forking
console_handle: 0x0000000b
1 1 0
packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
section {u'size_of_data': u'0x004f1200', u'virtual_address': u'0x00a1b000', u'entropy': 7.895047808873489, u'name': u'UPX1', u'virtual_size': u'0x004f2000'} entropy 7.89504780887 description A section with a high entropy has been found
entropy 0.999901205295 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
section UPX2 description Section name indicates UPX
cmdline whoami
host 124.222.5.128
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x002bfce9
function_name: wine_get_version
module: ntdll
module_address: 0x76f10000
3221225785 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Supershell.m!c
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.rc
ALYac Gen:Variant.Zusy.555509
Cylance Unsafe
VIPRE Gen:Variant.Zusy.555509
Sangfor Trojan.Win32.Zusy.Vqrr
BitDefender Gen:Variant.Zusy.555509
Cybereason malicious.407957
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of WinGo/Agent.ACE.gen
APEX Malicious
McAfee Artemis!7DAD2C440795
Avast Win32:Evo-gen [Trj]
Kaspersky Backdoor.Win64.Supershell.em
Alibaba Trojan:Win32/Generic.9b9fd4fb
MicroWorld-eScan Gen:Variant.Zusy.555509
Rising Trojan.Agent!8.B1E (CLOUD)
Emsisoft Gen:Variant.Zusy.555509 (B)
F-Secure Trojan.TR/Redcap.ybxqr
McAfeeD ti!EEFE4186B766
FireEye Gen:Variant.Zusy.555509
Sophos Mal/Generic-S
Ikarus Trojan.Crypt
Avira TR/Redcap.ybxqr
Antiy-AVL GrayWare/Win32.Kryptik.ffp
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Trojan.Win32.Downloader.sa
Arcabit Trojan.Zusy.D879F5
ZoneAlarm Backdoor.Win64.Supershell.em
GData Gen:Variant.Zusy.555509
Varist W32/ABApplication.SITX-7037
BitDefenderTheta Gen:NN.ZexaF.36810.@pGfamP72bb
DeepInstinct MALICIOUS
VBA32 Backdoor.Win64.Supershell
Malwarebytes Trojan.Injector.UPX
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R014H07H324
MAX malware (ai score=88)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Agent.ACE!tr
AVG Win32:Evo-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (W)
alibabacloud Trojan:Multi/Zusy.Gen