Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Aug. 11, 2024, 2:24 p.m.	Aug. 11, 2024, 3:03 p.m.

Size	14.4MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`2f208b17f8bda673f6b4f0dacf43d1bf`
SHA256	`1fc3e92f7f30f4f68861d3ceb8284853ae30c11cbd0ed3e46ea9eb698b3ec348`
CRC32	`23752528`
ssdeep	`98304:IdEOTQvv8toqK+tO985QWRDXpFviNkYDdQI:GEOFtoqK+898jRDZ8kY`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

66af9bdbf0f60_Team.exe "C:\Users\test22\AppData\Local\Temp\66af9bdbf0f60_Team.exe"
108

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didata

Allocates read-write-execute memory (usually to unpack itself) (11 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002d20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 region_size: 2101248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003f50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 region_size: 2101248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 region_size: 2076672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004370000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 region_size: 2519040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004570000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2519040 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 region_size: 2519040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000001401fc000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 11, 2024, 2:17 p.m.	process_identifier: 108 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000001401fc000 process_handle: 0xffffffffffffffff	1	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x002ca400', u'virtual_address': u'0x00bbb000', u'entropy': 7.3974336421343185, u'name': u'.rsrc', u'virtual_size': u'0x002ca400'}

entropy

7.39743364213

description

A section with a high entropy has been found

File has been identified by 43 AntiVirus engines on VirusTotal as malicious (43 events)

Bkav	W32.Common.D5EE8A00
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (moderate confidence)
CAT-QuickHeal	Trojan.Sabsik
ALYac	Gen:Variant.Tedy.623430
Cylance	Unsafe
VIPRE	Gen:Variant.Tedy.623430
K7AntiVirus	Trojan ( 005b8eb01 )
BitDefender	Gen:Variant.Tedy.623430
K7GW	Trojan ( 005b8eb01 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.CTGSZCQ
McAfee	Artemis!2F208B17F8BD
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	Trojan.Win64.SleepObf.eg
Alibaba	Trojan:Win64/SleepObf.1523ae25
MicroWorld-eScan	Gen:Variant.Tedy.623430
Rising	Trojan.Undefined!8.1327C (C64:YzY0OrvjlDybVevM)
Emsisoft	Gen:Variant.Tedy.623430 (B)
F-Secure	Trojan.TR/Redcap.ozssa
TrendMicro	Trojan.Win64.PRIVATELOADER.YXEHEZ
McAfeeD	ti!1FC3E92F7F30
FireEye	Gen:Variant.Tedy.623430
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Win64.PRIVATELOADER.
Google	Detected
Avira	TR/Redcap.ozssa
MAX	malware (ai score=80)
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Malware.Win64.Wacapew.cl
Microsoft	Trojan:Win64/Tedy!MTB
ZoneAlarm	Trojan.Win64.SleepObf.eg
GData	Gen:Variant.Tedy.623430
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.Downloader
Ikarus	Trojan.SuspectCRC
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	Trojan.Win64.PRIVATELOADER.YXEHEZ
Tencent	Win64.Trojan.Sleepobf.Anhl
huorong	HEUR:TrojanSpy/Stealer.am
MaxSecure	Trojan.Malware.274021135.susgen
Fortinet	W32/PossibleThreat
AVG	Win64:MalwareX-gen [Trj]

66af9bdbf0f60_Team.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All