Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 26, 2024, 9:48 a.m.	Aug. 26, 2024, 9:56 a.m.

Size	10.0MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`74416a1d6fdb926a2f9ee076f6285580`
SHA256	`a40842ee06623be01b26837a4c6821cddcce4c27b9d64f32ceedb0cd14b0432d`
CRC32	`B4B8FB27`
ssdeep	`98304:Hk8Moeo9VZ4odf8Bn8U/J1vD3NSPUv3KWQSy+Bk:E8Moeo9VZLf8dvRlfKkhBk`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

66ca490c039f9_BitcoinCore.exe "C:\Users\test22\AppData\Local\Temp\66ca490c039f9_BitcoinCore.exe"
2544

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didata

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 region_size: 2211840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000003ec0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 region_size: 2211840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000040e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 region_size: 2142208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004300000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 region_size: 2588672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004510000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2588672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 region_size: 2588672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014020d000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Aug. 26, 2024, 9:41 a.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014020d000 process_handle: 0xffffffffffffffff	1	0

Foreign language identified in PE resource (2 events)

name

RT_ICON

language

LANG_CATALAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_LIBYA

offset

0x0071c550

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CATALAN

filetype

data

sublanguage

SUBLANG_ARABIC_LIBYA

offset

0x00a11d6c

size

0x00000014

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x002ff200', u'virtual_address': u'0x00713000', u'entropy': 7.439947078118852, u'name': u'.rsrc', u'virtual_size': u'0x002ff200'}

entropy

7.43994707812

description

A section with a high entropy has been found

entropy

0.299819238849

description

Overall entropy of this PE file is high

File has been identified by 12 AntiVirus engines on VirusTotal as malicious (12 events)

Bkav	W64.AIDetectMalware
Sangfor	Trojan.Win32.Agent.V4sc
Symantec	ML.Attribute.HighConfidence
Avast	DropperX-gen [Drp]
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Trojan.Convagent!8.12323 (CLOUD)
McAfeeD	ti!A40842EE0662
Sophos	Generic Reputation PUA (PUA)
Antiy-AVL	Trojan/Win32.Casdet
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
AVG	DropperX-gen [Drp]

66ca490c039f9_BitcoinCore.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All