popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

rocket.exe

Generic Malware Malicious Library Antivirus UPX OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 19, 2024, 2:19 p.m. Aug. 19, 2024, 2:42 p.m.
Size 3.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2b5a2c2d70c3c5ac3a5804ca1345a694
SHA256 1a1ae17babe936b6ebf1d7d8dbd886071e41ac60f5eb537edce937ba74404689
CRC32 44F28BD5
ssdeep 98304:/kDB/ze8eGUui9RVuKhrZ0NopI0SSgxHQx2bw1Kja8MruCHrH:cDFMG46AZ0NczDkbw42XrVH
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
section .gfids
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72d62000
process_handle: 0xffffffff
1 0 0
name PNG language LANG_CHINESE filetype PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006318c size 0x000015a9
name PNG language LANG_CHINESE filetype PNG image data, 186 x 604, 8-bit/color RGB, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006318c size 0x000015a9
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_ICON language LANG_CHINESE filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00069ea8 size 0x00003d71
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006e288 size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006e288 size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006e288 size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006e288 size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006e288 size 0x000001ce
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006e288 size 0x000001ce
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006eb9c size 0x0000006a
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006ec08 size 0x00000068
name RT_MANIFEST language LANG_CHINESE filetype XML 1.0 document, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006ec70 size 0x00000640
section {u'size_of_data': u'0x0000d400', u'virtual_address': u'0x00062000', u'entropy': 6.853338758940625, u'name': u'.rsrc', u'virtual_size': u'0x0000d2b0'} entropy 6.85333875894 description A section with a high entropy has been found
Bkav W32.AIDetectMalware
Elastic malicious (moderate confidence)
Cynet Malicious (score: 100)
Skyhigh BehavesLike.Win32.Generic.wc
APEX Malicious
Kaspersky Trojan.Win32.Agentb.mfhu
MicroWorld-eScan Trojan.GenericKD.73864058
McAfeeD ti!1A1AE17BABE9
FireEye Generic.mg.2b5a2c2d70c3c5ac
MAX malware (ai score=85)
Kingsoft Win32.Trojan.Agentb.a
ZoneAlarm Trojan.Win32.Agentb.mfhu
GData Trojan.GenericKD.73864058
Malwarebytes Malware.AI.49453
MaxSecure Trojan.Malware.121218.susgen
CrowdStrike win/grayware_confidence_60% (D)