popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Identification.exe

Emotet Malicious Library UPX PE64 PE File OS Processor Check MZP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Aug. 21, 2024, 1:24 p.m. Aug. 21, 2024, 1:26 p.m.
Size 8.0MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 2ecb08bc874649148c0b23e832f522f7
SHA256 17f256015c257cd0b73d14d0d908ccbc317b7e1d8f5ceab2f855c277d7f97e6d
CRC32 D8F75239
ssdeep 49152:sExHcWioiCm3XEyP3605RYCXXLwsSXLJK3quO6xVzsoeoe17qRhm6PpdTTCWZ4ib:cNtfmToeoeKSWew5OkKX3Q
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .didata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000002460000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 2060288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003ce0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 2060288
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000003ee0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 2056192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000040e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 2498560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000042e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 2498560
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
process_handle: 0xffffffffffffffff
-1073741800 0

NtAllocateVirtualMemory

 process_identifier: 2644
region_size: 2498560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 417792
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000001401f7000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000140000000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2644
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 417792
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000001401f7000
process_handle: 0xffffffffffffffff
1 0 0
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_ICON language LANG_CATALAN filetype PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced sublanguage SUBLANG_ARABIC_LIBYA offset 0x005afd30 size 0x00003694
name RT_GROUP_ICON language LANG_CATALAN filetype data sublanguage SUBLANG_ARABIC_LIBYA offset 0x008089f4 size 0x00000084
Bkav W64.AIDetectMalware
Avast DropperX-gen [Drp]
Kaspersky UDS:Trojan.Win64.SleepObf.gi
ZoneAlarm UDS:Trojan.Win64.SleepObf.gi
Malwarebytes Malware.AI.1968565275
AVG DropperX-gen [Drp]
section {u'size_of_data': u'0x00283e00', u'virtual_address': u'0x00585000', u'entropy': 7.402904419132454, u'name': u'.rsrc', u'virtual_size': u'0x00283e00'} entropy 7.40290441913 description A section with a high entropy has been found
entropy 0.315857247976 description Overall entropy of this PE file is high