popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Mailer.exe

UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 12, 2024, 9:19 a.m. Aug. 12, 2024, 9:40 a.m.
Size 47.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 07924a75dd7d92d04c18063bea0d0b61
SHA256 c5bd778d6cb31d3e6970e4df3d5d058bd9f95db7faae9fa55c5854d53b78898b
CRC32 83808475
ssdeep 768:Iwe8hnGkbDwaqsMyzzbrHWRAYzuxUbcaUM5lgVl0oAkDB4j8PkKIhSGLPUq3:Iwe8hGEq1y3HWRAOucWf0oF9P3GLsq3
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
193.117.208.148 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1372
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0000ae00', u'virtual_address': u'0x0000d000', u'entropy': 7.8975165191974295, u'name': u'UPX1', u'virtual_size': u'0x0000b000'} entropy 7.8975165192 description A section with a high entropy has been found
entropy 0.945652173913 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
host 193.117.208.148
dead_host 193.117.208.148:7800
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Jorik.lrUS
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Swrort.A
Skyhigh Swrort.d
ALYac Generic.ShellCode.Marte.3.C4C51720
Cylance Unsafe
VIPRE Generic.ShellCode.Marte.3.C4C51720
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 001172b51 )
BitDefender Generic.ShellCode.Marte.3.C4C51720
K7GW Trojan ( 001172b51 )
Cybereason malicious.5dd7d9
Arcabit Generic.ShellCode.Marte.3.C4C51720
Symantec Packed.Generic.347
ESET-NOD32 a variant of Win32/Rozena.AA
McAfee GenericRXAA-AA!07924A75DD7D
Avast Win32:Evo-gen [Trj]
ClamAV Win.Trojan.Swrort-5710536-0
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Trojan:Win32/CobaltStrike.5c89
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan Generic.ShellCode.Marte.3.C4C51720
Rising Trojan.Crypto!8.364 (CLOUD)
Emsisoft Generic.ShellCode.Marte.3.C4C51720 (B)
F-Secure Trojan.TR/Crypt.ZPACK.Gen
Zillya Trojan.Rozena.Win32.196798
TrendMicro Backdoor.Win32.SWRORT.SMAL01
McAfeeD Real Protect-LS!07924A75DD7D
Trapmine malicious.high.ml.score
FireEye Generic.mg.07924a75dd7d92d0
Sophos Mal/Generic-S
Ikarus Trojan.Agent
Webroot W32.Trojan.Swrort.Gen
Google Detected
Avira TR/Crypt.ZPACK.Gen
MAX malware (ai score=83)
Antiy-AVL Trojan/Win32.Rozena
Kingsoft malware.kb.b.936
Xcitium TrojWare.Win32.Rozena.A@4jwdqr
Microsoft Trojan:Win32/Meterpreter!pz
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Win32.Trojan.PSE.12DT0MV
Varist W32/Swrort.B.gen!Eldorado
AhnLab-V3 Backdoor/Win32.Bifrose.R12476
BitDefenderTheta Gen:NN.ZexaF.36810.cmKfa4g8Bcgi
DeepInstinct MALICIOUS
VBA32 Trojan.Swrort
Malwarebytes Generic.Malware.AI.DDS