popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Trial.exe

UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 12, 2024, 9:18 a.m. Aug. 12, 2024, 9:27 a.m.
Size 47.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 8c85fdc958d3299c7cb1fc0a82be0a28
SHA256 5276b39a55cb85f30195a5150dbb2b6407a596adbd3482cb0dc099049bba4224
CRC32 D68DB839
ssdeep 768:IB93PtkMdRPAowZUEkhwasYseaiqAiwEo03RnD/OjG9o7uQXq3:IH3FpRPAooUuleaiqVwEo0xD/LAuaq3
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
193.117.208.148 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00310000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0000ae00', u'virtual_address': u'0x0000d000', u'entropy': 7.904071801193432, u'name': u'UPX1', u'virtual_size': u'0x0000b000'} entropy 7.90407180119 description A section with a high entropy has been found
entropy 0.945652173913 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
host 193.117.208.148
dead_host 193.117.208.148:7800
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Jorik.lrUS
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Swrort.A
McAfee GenericRXAA-AA!8C85FDC958D3
ALYac Dump:Generic.ShellCode.Marte.3.A65A0C4B
Cylance Unsafe
VIPRE Dump:Generic.ShellCode.Marte.3.A65A0C4B
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 001172b51 )
BitDefender Dump:Generic.ShellCode.Marte.3.A65A0C4B
K7GW Trojan ( 001172b51 )
Cybereason malicious.958d32
Arcabit Dump:Generic.ShellCode.Marte.3.A65A0C4B
Symantec Packed.Generic.347
ESET-NOD32 a variant of Win32/Rozena.AA
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Trojan.MSShellcode-6360728-0
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Trojan:Win32/CobaltStrike.5c89
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan Dump:Generic.ShellCode.Marte.3.A65A0C4B
Rising Trojan.Crypto!8.364 (CLOUD)
Emsisoft Dump:Generic.ShellCode.Marte.3.A65A0C4B (B)
F-Secure Trojan.TR/Crypt.ZPACK.Gen
Zillya Trojan.RozenaGen.Win32.2
McAfeeD Real Protect-LS!8C85FDC958D3
Trapmine malicious.high.ml.score
FireEye Generic.mg.8c85fdc958d3299c
Sophos Mal/Generic-S
Ikarus Trojan.Agent
Webroot W32.Trojan.Swrort.Gen
Google Detected
Avira TR/Crypt.ZPACK.Gen
MAX malware (ai score=83)
Antiy-AVL Trojan/Win32.Rozena
Kingsoft malware.kb.b.947
Xcitium TrojWare.Win32.Rozena.A@4jwdqr
Microsoft Trojan:Win32/Meterpreter!pz
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Dump:Generic.ShellCode.Marte.3.A65A0C4B
Varist W32/Swrort.B.gen!Eldorado
AhnLab-V3 Backdoor/Win32.Bifrose.R12476
BitDefenderTheta Gen:NN.ZexaF.36810.cmKfaOsCTfli
DeepInstinct MALICIOUS
VBA32 Trojan.Swrort
Malwarebytes Generic.Malware.AI.DDS
Panda Trj/Genetic.gen