popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

MicrosoftWordUpdater.log.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Aug. 9, 2024, 4:15 p.m. Aug. 9, 2024, 4:17 p.m.
Size 327.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 0d1dca5eaad49c2dbd979e1bf0b5f8d0
SHA256 a250740948aba579462397ac95ff10e6b0ee952c2af7d9d726cbfde9da1eaaff
CRC32 FF96C440
ssdeep 6144:3g2iqrzOgpZKUb+xLn/8loIZTbSgM8nzMQfdu24T5WL8gPIAO1Goo:31iqbDKUbw/QtbtM8ZF4dQ8gPIkoo
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section _RDATA
section {u'size_of_data': u'0x00032000', u'virtual_address': u'0x00016000', u'entropy': 7.700520334812183, u'name': u'.rdata', u'virtual_size': u'0x00031fb8'} entropy 7.70052033481 description A section with a high entropy has been found
section {u'size_of_data': u'0x00008800', u'virtual_address': u'0x0004d000', u'entropy': 7.962451466581888, u'name': u'.rsrc', u'virtual_size': u'0x00008738'} entropy 7.96245146658 description A section with a high entropy has been found
entropy 0.717791411043 description Overall entropy of this PE file is high
Bkav W64.AIDetectMalware
Elastic malicious (moderate confidence)
Skyhigh BehavesLike.Win64.Backdoor.fc
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
ESET-NOD32 a variant of Win64/Agent.DZF
Rising Trojan.Agent!8.B1E (CLOUD)
Trapmine suspicious.low.ml.score
FireEye Generic.mg.0d1dca5eaad49c2d
Google Detected
AhnLab-V3 Trojan/Win.Agent.R660345
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.1893956484
Ikarus Win32.Outbreak
Tencent Win64.Trojan.Agent.Eflw
MaxSecure Trojan.Malware.300983.susgen
Paloalto generic.ml
CrowdStrike win/malicious_confidence_100% (W)