popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

smartscreen.exe

Gen1 Generic Malware Malicious Library UPX Malicious Packer ftp PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 3, 2024, 8:52 a.m. Sept. 3, 2024, 8:54 a.m.
Size 3.5MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 7e1fa0f93773dc8861a92279b7db03c6
SHA256 59f55834d9aec7059e957c376af57f71a8028d057b194a5567d1d95b4d7d4f6e
CRC32 77547D28
ssdeep 49152:WM+vPLK5GDSaaec3RfBhmvPX4y3VLuxuMvAKrTZrNyAk2dEzkhT8pPDzVVod8ItK:O/NjVqxdAGTZ10t
PDB Path C:\Users\guada\Desktop\Saytus Source\x64\Release\smartscreen.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • ftp_command - ftp command
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path C:\Users\guada\Desktop\Saytus Source\x64\Release\smartscreen.pdb
section _RDATA
section {u'size_of_data': u'0x0022c000', u'virtual_address': u'0x00117000', u'entropy': 6.978269505946809, u'name': u'.rdata', u'virtual_size': u'0x0022becc'} entropy 6.97826950595 description A section with a high entropy has been found
section {u'size_of_data': u'0x00039800', u'virtual_address': u'0x00343000', u'entropy': 6.8981535587016625, u'name': u'.data', u'virtual_size': u'0x0003bd70'} entropy 6.8981535587 description A section with a high entropy has been found
entropy 0.67733922164 description Overall entropy of this PE file is high