popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

nubmerts.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Aug. 19, 2024, 2:06 p.m. Aug. 19, 2024, 2:39 p.m.
Size 295.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 bdc79de40c6138163814e9a0c2f46c8b
SHA256 ca514478a7516f7aff8343ca74c82bebc0480cbb590f27cb02ca559d2d4e8d90
CRC32 E112FC14
ssdeep 6144:+nHQiNdOF7f3N+SDXmQPCxqcDVGUK59FEkg:+HQvN+SCRqcxaEk
PDB Path C:\Users\удача\Desktop\tesf\Release\BigProject.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
bitbucket.org
A 104.192.140.24
A 104.192.140.25
A 104.192.140.26
104.192.140.24
IP Address Status Action
104.192.140.24 Active Moloch
164.124.101.2 Active Moloch

pdb_path C:\Users\удача\Desktop\tesf\Release\BigProject.pdb
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
nubmerts+0x298f8 @ 0xad98f8
nubmerts+0x337c6 @ 0xae37c6
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 03 42 3c 89 45 bc c7 85 38 fe ff ff 01 00 00 00
exception.symbol: nubmerts+0x7d16
exception.instruction: add eax, dword ptr [edx + 0x3c]
exception.module: nubmerts.exe
exception.exception_code: 0xc0000005
exception.offset: 32022
exception.address: 0xab7d16
registers.esp: 3654184
registers.edi: 0
registers.eax: 0
registers.ebp: 3661952
registers.edx: 0
registers.ebx: 3661960
registers.esi: 1
registers.ecx: 0
1 0 0
Bkav W32.AIDetectMalware
Cynet Malicious (score: 100)
ALYac Gen:Variant.Zusy.555781
Cylance Unsafe
VIPRE Gen:Variant.Zusy.555781
BitDefender Gen:Variant.Zusy.555781
Arcabit Trojan.Zusy.D87B05
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Agent_AGen.DSR
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Kaspersky HEUR:Trojan.Win32.Injuke.gen
MicroWorld-eScan Gen:Variant.Zusy.555781
Rising Stealer.Convagent!8.1326D (TFE:5:v7KZnnwmzgD)
Emsisoft Gen:Variant.Zusy.555781 (B)
McAfeeD Real Protect-LS!BDC79DE40C61
FireEye Generic.mg.bdc79de40c613816
SentinelOne Static AI - Suspicious PE
MAX malware (ai score=80)
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm HEUR:Trojan.Win32.Injuke.gen
GData Gen:Variant.Zusy.555781
BitDefenderTheta Gen:NN.ZexaF.36812.sqW@aa9pLqh
DeepInstinct MALICIOUS
VBA32 suspected of Trojan.Downloader.gen
Malwarebytes Trojan.Injector
AVG Win32:DropperX-gen [Drp]
CrowdStrike win/malicious_confidence_90% (D)