popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

a.exe

Generic Malware Malicious Library Admin Tool (Sysinternals etc ...) UPX Malicious Packer MZP Format PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 10, 2024, 12:25 p.m. Aug. 10, 2024, 1:08 p.m.
Size 2.3MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2e171efa60b0cae4b318b199be88a351
SHA256 ce5891692b7d5ae283572219ab913cf2c0ea38fc92f890ca43642d58dfdf05f4
CRC32 7E2F5AB9
ssdeep 24576:j2dY5pahuIUhPVE/uQPgI/QWJGYofBgS4p1tMHYgC1J5j2Rme6ll6nwKJJFTntnf:q6Yu+H5of+Sw1pgC17ll6wKJzTtn6
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .itext
section .didata
packer BobSoft Mini Delphi -> BoB / BobSoft
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x734c2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x021e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Symantec ML.Attribute.HighConfidence
McAfee Artemis!2E171EFA60B0
Kaspersky UDS:DangerousObject.Multi.Generic
Jiangmin TrojanSpy.KeyLogger.qkf
Antiy-AVL Trojan/Win32.Agent
Kingsoft Win32.Troj.Unknown.a
ZoneAlarm UDS:DangerousObject.Multi.Generic
DeepInstinct MALICIOUS
VBA32 TScope.Trojan.Delf
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x003b1204
function_name: wine_get_version
module: ntdll
module_address: 0x76f10000
3221225785 0