popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

track523.exe

Generic Malware Malicious Library Downloader UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2 p.m. Aug. 19, 2024, 2:02 p.m.
Size 234.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 126d07c834b159e2057a4e431073f948
SHA256 c1e856c165b29b0f49a55dfd451a817a0a5ee005faf812e818cc258a8a4013da
CRC32 0F07EF2E
ssdeep 3072:x/uExbUYX5Ey0QJvQv3wTn58bb2kE9x+O5S+LX51eLl7I+eXf/:xtdEy0QVQv3wD58bA9x+O5S+Vb+Sf/
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
bitbucket.org
A 104.192.140.24
A 104.192.140.25
A 104.192.140.26
104.192.140.24
IP Address Status Action
104.192.140.26 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\file1.exe
Bkav W64.AIDetectMalware
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
Cylance Unsafe
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
McAfeeD ti!C1E856C165B2
FireEye Generic.mg.126d07c834b159e2
SentinelOne Static AI - Suspicious PE
Kingsoft Win32.Troj.Unknown.a
ZoneAlarm UDS:DangerousObject.Multi.Generic
DeepInstinct MALICIOUS
Paloalto generic.ml
CrowdStrike win/malicious_confidence_70% (W)