popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Z5.dll

Generic Malware Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 12, 2024, 8:47 a.m. Aug. 12, 2024, 9:05 a.m.
Size 104.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 5574fe2122cbe31e6dbef1f0cf2888f8
SHA256 11c9ebce482e2db0639123e3750dd97a8803442accd9e51bb2bcc87d173b5151
CRC32 F559118F
ssdeep 1536:JNYgj9qG3W5jXp8m6TIzX2INMq55u/b//xHU4HMtmN:YGWjVFnYhU4HMtmN
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
packer Armadillo v1.xx - v2.xx
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10012000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744b0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74481000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 76 (SystemFirmwareTableInformation)
3221225474 0
Bkav W32.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
Sangfor Trojan.Win32.Save.BlackMoon
ESET-NOD32 a variant of Win32/Packed.BlackMoon.A suspicious
ClamAV Win.Dropper.Tiggre-9845940-0
TrendMicro TrojanSpy.Win32.BLACKMOON.YXEHKZ
McAfeeD ti!11C9EBCE482E
Google Detected
Antiy-AVL Trojan/Win32.Blamon.a
Gridinsoft Trojan.Win32.BlackMoon.tr
Xcitium TrojWare.Win32.Zegost.D@6vpf1l
Microsoft Program:Win32/Wacapew.C!ml
GData Win32.Trojan-Stealer.BlackMoon.D
Varist W32/Blackmoon.BA.gen!Eldorado
DeepInstinct MALICIOUS
Ikarus AdWare.Win32.BlackMoon
Tencent Backdoor.Win32.Runshell_l.16001193
Fortinet W32/Blackmoon.D!tr
Paloalto generic.ml
alibabacloud VirTool:Win/Wacatac.B9nj