Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Sept. 4, 2024, 10:05 a.m.	Sept. 4, 2024, 10:09 a.m.

Size	1.2MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`67407557dfbdd3d71436f89d6d47897a`
SHA256	`a243e961a6855e3f81b913151a7bf96c82c4789b115c945d9f4cfb67cd704cfc`
CRC32	`416245B9`
ssdeep	`12288:DC6OEfK2z1NfW+hvTYbMfd+sjjhtLpjES2XmemukxIz4mcpe2xt+:rOyK2z1NO+lYIfd+CjhtLpjgWnukI`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) UPX_Zero - UPX packed file

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
121.41.54.103	Active	Moloch

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 4, 2024, 9:58 a.m.	process_identifier: 932 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 266240 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00000000005e0000 process_handle: 0xffffffffffffffff	1	0	0

section

{u'size_of_data': u'0x00043e00', u'virtual_address': u'0x000b1000', u'entropy': 7.893051443667275, u'name': u'.data', u'virtual_size': u'0x00043de0'}

entropy

7.89305144367

description

A section with a high entropy has been found

entropy

0.223273026316

description

Overall entropy of this PE file is high

host

121.41.54.103

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Cobalt.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.72941972
Cylance	Unsafe
VIPRE	Trojan.GenericKD.72941972
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 005afd6f1 )
BitDefender	Trojan.GenericKD.72941972
K7GW	Trojan ( 005afd6f1 )
Cybereason	malicious.7dfbdd
Arcabit	Trojan.Generic.D4590194
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win64/Injector.OY
APEX	Malicious
McAfee	Artemis!67407557DFBD
Avast	Win64:InjectorX-gen [Trj]
Kaspersky	Trojan.Win32.Cobalt.tvq
Alibaba	Trojan:Win32/Cobalt.27f57389
MicroWorld-eScan	Trojan.GenericKD.72941972
Rising	Backdoor.Havoc!8.970A (TFE:5:FmKscZQWeQD)
Emsisoft	Trojan.GenericKD.72941972 (B)
F-Secure	Trojan.TR/AD.CobaltSC.cjfbz
Zillya	Trojan.Injector.Win64.6408
McAfeeD	ti!A243E961A685
FireEye	Generic.mg.67407557dfbdd3d7
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
Google	Detected
Avira	TR/AD.CobaltSC.cjfbz
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Win32.Cobalt
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win64.Downloader.sa
Microsoft	VirTool:Win64/CobaltStrike.I
ViRobot	Trojan.Win.Z.Agent.1247560
ZoneAlarm	Trojan.Win32.Cobalt.tvq
GData	Trojan.GenericKD.72941972
Varist	W64/ABTrojan.SQOE-9077
AhnLab-V3	Trojan/Win.Generic.R633197
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.4236864457
Ikarus	Trojan.Win64.Shellcoderunner
Panda	Trj/Chgt.AD
Tencent	Malware.Win32.Gencirc.10bff9d3
Yandex	Trojan.Cobalt!YL/LauVnyVY
huorong	HVM:Trojan/Injector.cp
MaxSecure	Trojan.Malware.252913218.susgen

chrome.exe