popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66ae97ac4c30d_crypted.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 11, 2024, 2:19 p.m. Aug. 11, 2024, 2:58 p.m.
Size 1007.5KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 dbfb97dfac2ebd1c0c891897dee558a3
SHA256 af7560ea85884942b24ba8f222da1c2cf0a06d715efd932d8c55e87d6ae6b381
CRC32 697900A9
ssdeep 24576:+ndQC5orxcfVCTyY13XXpAvgj6o2/Jf4VLjQCNiQGqUB1C/ut:+RorxcfVCL1Agj6PJf4VznyIO
PDB Path C:\5vbyqrt7\output.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\5vbyqrt7\output.pdb
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        81 3e 4c 6f 61 64 75 f2 81 7e 08 61 72 79 41 75
        

      
        exception.instruction:
        cmp dword ptr [esi], 0x64616f4c
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.symbol:
        
        

      
        exception.address:
        0x3a01cb
        

      
    
  
    
      
        registers.esp:
        8976312
        

      
        registers.edi:
        1969008856
        

      
        registers.eax:
        1968766976
        

      
        registers.ebp:
        629
        

      
        registers.edx:
        1969006304
        

      
        registers.ebx:
        0
        

      
        registers.esi:
        1969094660
        

      
        registers.ecx:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          776
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x003a0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00060c00', u'virtual_address': u'0x00096000', u'entropy': 7.992092761715424, u'name': u'.data', u'virtual_size': u'0x00062520'}
                                        
                                    
                                        
                                            entropy
                                            7.99209276172
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.38816449348
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Agent.Y!c
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    CAT-QuickHeal
                                    Trojan.MSIL
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Trojan.Generic.36669864
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Trojan.Generic.36669864
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Infostealer.Win32.Kryptik.V0d1
                                    
                                


                            

                        

                            

                                

                                    K7AntiVirus
                                    Riskware ( 00584baa1 )
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Trojan.Generic.36669864
                                    
                                


                            

                        

                            

                                

                                    K7GW
                                    Riskware ( 00584baa1 )
                                    
                                


                            

                        

                            

                                

                                    Cybereason
                                    malicious.fac2eb
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Babar.D36170
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/Kryptik.HXQN
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!DBFB97DFAC2E
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:PWSX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    ClamAV
                                    Win.Keylogger.Lazy-10031941-0
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    HEUR:Trojan.Win32.Agent.gen
                                    
                                


                            

                        

                            

                                

                                    Alibaba
                                    Trojan:Win32/LummaC.26030cae
                                    
                                


                            

                        

                            

                                

                                    NANO-Antivirus
                                    Trojan.Win32.RedLineNET.kqpedi
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Trojan.Generic.36669864
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.LummaStealer!8.17CC6 (TFE:5:y6B47Ry0smK)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Trojan.Generic.36669864 (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/AVI.Agent.rywza
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Trojan.PWS.RedLineNET.9
                                    
                                


                            

                        

                            

                                

                                    Zillya
                                    Trojan.Agent.Win32.3991331
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    Trojan.Win32.PRIVATELOADER.YXEHDZ
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    ti!AF7560EA8588
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.dbfb97dfac2ebd1c
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Troj/Krypt-AHS
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Trojan-Spy.LummaStealer
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/AVI.Agent.rywza
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=80)
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    Trojan/MSIL.Convagent
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Ransom.Win32.Wacatac.sa
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/LummaC.ASGW!MTB
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    HEUR:Trojan.Win32.Agent.gen
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Win32.Trojan.PSE.1BIMQPF
                                    
                                


                            

                        

                            

                                

                                    Varist
                                    W32/ABTrojan.BGGU-6613
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Trojan/Win.Generic.R660197
                                    
                                


                            

                        

                            

                                

                                    BitDefenderTheta
                                    Gen:NN.ZexaF.36810.!uY@aWRpf5bi
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    BScope.TrojanPSW.Stealerc
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Malware.AI.1891644233
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/Chgt.AD