popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

CFPPF.exe

Generic Malware Malicious Library Downloader UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2:02 p.m. Aug. 19, 2024, 3:17 p.m.
Size 556.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 54c38790a4b6310fdc018d6ed97eed0f
SHA256 138c6c219e86a0c1624d6af00a65390e2acc670148f8930f831a175da7d24ef0
CRC32 2E0E1085
ssdeep 12288:vpxRp186rtRhqdh88J70Y1jnDHpGK1aSfo0p:hxJ8Xj8wjDHwif
PDB Path D:\ProjectStub\ConsoleApplication6\x64\Release\ConsoleApplication6.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Network_Downloader - File Downloader
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
bitbucket.org
A 104.192.140.24
A 104.192.140.25
A 104.192.140.26
104.192.140.26
IP Address Status Action
104.192.140.25 Active Moloch
164.124.101.2 Active Moloch

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path D:\ProjectStub\ConsoleApplication6\x64\Release\ConsoleApplication6.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section _RDATA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2628
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\file1.exe
Bkav W64.AIDetectMalware
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
ALYac Gen:Variant.Mikey.168729
Cylance Unsafe
VIPRE Gen:Variant.Mikey.168729
BitDefender Gen:Variant.Mikey.168729
Symantec ML.Attribute.HighConfidence
APEX Malicious
Avast Win64:DropperX-gen [Drp]
Kaspersky VHO:Trojan-Banker.Win32.ClipBanker.gen
MicroWorld-eScan Gen:Variant.Mikey.168729
Emsisoft Gen:Variant.Mikey.168729 (B)
McAfeeD ti!138C6C219E86
Trapmine suspicious.low.ml.score
FireEye Generic.mg.54c38790a4b6310f
MAX malware (ai score=85)
ZoneAlarm VHO:Trojan-Banker.Win32.ClipBanker.gen
GData Gen:Variant.Mikey.168729
DeepInstinct MALICIOUS
AVG Win64:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_90% (D)