Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 2, 2024, 10:12 a.m.	Sept. 2, 2024, 10:29 a.m.

Size	12.7MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`084e0e9053875ee1c7eb25799b4f2a55`
SHA256	`e242523ba15340f0001135ef832d6c5a90e1349b0bbfa09f92737832dec60836`
CRC32	`A012188A`
ssdeep	`98304:2m1T2tvZagS9dAk4wAtqU/J1vD3NSPUv3KWQSy+Bk5dQI:2+T2txadAkBAtFRlfKkhBk`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format OS_Processor_Check_Zero - OS Processor Check

66d1b41544279_build.exe "C:\Users\test22\AppData\Local\Temp\66d1b41544279_build.exe"
2548

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.didata

Allocates read-write-execute memory (usually to unpack itself) (12 events)

Time & API	Arguments	Status	Return
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001230000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 region_size: 2211840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000043d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 region_size: 2211840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000045f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 region_size: 2142208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004810000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 region_size: 2588672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004a20000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2588672 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 region_size: 2588672 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014020d000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000140000000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory Sept. 2, 2024, 10:12 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 417792 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000014020d000 process_handle: 0xffffffffffffffff	1	0

Foreign language identified in PE resource (2 events)

name

RT_ICON

language

LANG_CATALAN

filetype

dBase III DBT, version number 0, next free block index 40

sublanguage

SUBLANG_ARABIC_LIBYA

offset

0x00a09460

size

0x00010828

name

RT_GROUP_ICON

language

LANG_CATALAN

filetype

data

sublanguage

SUBLANG_ARABIC_LIBYA

offset

0x00ce56ac

size

0x00000014

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x002dda00', u'virtual_address': u'0x00a08000', u'entropy': 7.412685152333803, u'name': u'.rsrc', u'virtual_size': u'0x002dda00'}

entropy

7.41268515233

description

A section with a high entropy has been found

entropy

0.224926225424

description

Overall entropy of this PE file is high

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W64.AIDetectMalware
Elastic	malicious (high confidence)
BitDefender	Trojan.GenericKD.73972630
Symantec	ML.Attribute.HighConfidence
Avast	Win64:MalwareX-gen [Trj]
Kaspersky	Trojan.Win64.SleepObf.jb
MicroWorld-eScan	Trojan.GenericKD.73972630
Rising	Trojan.Kryptik@AI.90 (RDML:yKNjfil47gNo23RUsF4vmQ)
Emsisoft	Trojan.GenericKD.73972630 (B)
TrendMicro	Trojan.Win64.PRIVATELOADER.YXEH5Z
McAfeeD	ti!E242523BA153
FireEye	Trojan.GenericKD.73972630
Sophos	Mal/Generic-S
Google	Detected
MAX	malware (ai score=83)
Kingsoft	Win64.Trojan.SleepObf.jb
Microsoft	Trojan:Win32/Casdet!rfn
ZoneAlarm	Trojan.Win64.SleepObf.jb
GData	Trojan.GenericKD.73972630
AhnLab-V3	Malware/Win.Generic.C5664340
Ikarus	Trojan.Win64.Injector
TrendMicro-HouseCall	Trojan.Win64.PRIVATELOADER.YXEH5Z
AVG	Win64:MalwareX-gen [Trj]

66d1b41544279_build.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All