popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Z1.dll

Generic Malware Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 12, 2024, 8:47 a.m. Aug. 12, 2024, 9:22 a.m.
Size 104.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 d4b705f2ca76f3326822e2b9d6c0e5cb
SHA256 0cbd44f95442fcb0ca16b933121dd6705d8263fed36e5eb02ae25bcc9c0bf5d0
CRC32 9EA186A7
ssdeep 1536:i1WPTFr0hYF5jXp8m6TIzX2INMq55u/b//xHU4HMt3i:sh8jVFnYhU4HMt3i
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
packer Armadillo v1.xx - v2.xx
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10012000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744a0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 652
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74471000
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware
Sangfor Trojan.Win32.Save.BlackMoon
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.BlackMoon.A suspicious
Cynet Malicious (score: 100)
Google Detected
Antiy-AVL Trojan/Win32.Blamon.a
Xcitium TrojWare.Win32.Zegost.D@6vpf1l
Varist W32/Blackmoon.BA.gen!Eldorado
Ikarus AdWare.Win32.BlackMoon
Tencent Backdoor.Win32.Runshell_l.16001193
Fortinet W32/Blackmoon.D!tr
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 76 (SystemFirmwareTableInformation)
3221225474 0