popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Pafool.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2:05 p.m. Aug. 19, 2024, 2:31 p.m.
Size 295.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 34c0ec62ad1ee616d73fcc2fa7ac2c05
SHA256 1af8e759ae0dbd5866bfae7676a67b3ff71f1d54ccbafc9bbaa493f512697cfa
CRC32 48F0DFD8
ssdeep 6144:olB1QaTezATxHySDVBJyQhsqcXVGXK+mEkg:oL1hHyS/cqciSEk
PDB Path C:\Users\удача\Desktop\tesf\Release\BigProject.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
bitbucket.org
A 104.192.140.24
A 104.192.140.25
A 104.192.140.26
104.192.140.26
IP Address Status Action
104.192.140.24 Active Moloch
164.124.101.2 Active Moloch

pdb_path C:\Users\удача\Desktop\tesf\Release\BigProject.pdb
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
pafool+0x298f8 @ 0x3198f8
pafool+0x33836 @ 0x323836
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 03 42 3c 89 45 bc c7 85 38 fe ff ff 01 00 00 00
exception.symbol: pafool+0x7d16
exception.instruction: add eax, dword ptr [edx + 0x3c]
exception.module: Pafool.exe
exception.exception_code: 0xc0000005
exception.offset: 32022
exception.address: 0x2f7d16
registers.esp: 3064840
registers.edi: 0
registers.eax: 0
registers.ebp: 3072608
registers.edx: 0
registers.ebx: 3072616
registers.esi: 1
registers.ecx: 0
1 0 0
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
ALYac Gen:Variant.Zusy.555781
Cylance Unsafe
VIPRE Gen:Variant.Zusy.555781
BitDefender Gen:Variant.Zusy.555781
Arcabit Trojan.Zusy.D87B05
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent_AGen.DSR
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Kaspersky VHO:Trojan.Win32.Convagent.gen
MicroWorld-eScan Gen:Variant.Zusy.555781
Rising Stealer.Convagent!8.1326D (TFE:5:v7KZnnwmzgD)
Emsisoft Gen:Variant.Zusy.555781 (B)
McAfeeD Real Protect-LS!34C0EC62AD1E
FireEye Gen:Variant.Zusy.555781
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=81)
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm VHO:Trojan.Win32.Convagent.gen
GData Gen:Variant.Zusy.555781
BitDefenderTheta Gen:NN.ZexaF.36812.sqW@amWO36i
DeepInstinct MALICIOUS
VBA32 suspected of Trojan.Downloader.gen
Malwarebytes Trojan.Injector
AVG Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_90% (D)