popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

data64_6.exe

Generic Malware Malicious Library Downloader UPX AntiDebug MZP Format PE File DLL OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 5, 2024, 3:26 p.m. Sept. 5, 2024, 3:27 p.m.
Size 1.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 87953bdf18ba88061cf28ad17116b56f
SHA256 9ad06b0e000800a33d381949658dbd0bfd7c7f1025aa5c81621b55f2f69a7a3f
CRC32 11C6E517
ssdeep 49152:q2B3FBfJXAEYFutJhzl6NNd5b6tvkn0dqw6CK24/L6W:q2B3FBfKEWocx+40+bTj
PDB Path D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\setup\build\sfxrar32\Release\sfxrar.pdb
section .didat
resource name PNG
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73332000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2700
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75511000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2700
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x726c1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 913408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x2cde0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 913408
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x2dc40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 753664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x2dd80000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 765952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x2de40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2700
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00840000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2700
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00061000
process_handle: 0xffffffff
1 0 0
cmdline regsvr32 /U /S V8NgH.K
cmdline "C:\Windows\System32\regsvr32.exe" /U /S V8NgH.K
file C:\Users\test22\AppData\Local\Temp\v8NgH.K
section {u'size_of_data': u'0x00027000', u'virtual_address': u'0x00066000', u'entropy': 7.763971067089891, u'name': u'.rsrc', u'virtual_size': u'0x00026eb8'} entropy 7.76397106709 description A section with a high entropy has been found
entropy 0.375 description Overall entropy of this PE file is high
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Process injection Process 2552 resumed a thread in remote process 2700
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000002c4
suspend_count: 1
process_identifier: 2700
1 0 0
Elastic malicious (high confidence)
Cynet Malicious (score: 100)
FireEye Trojan.GenericKD.49061858
CAT-QuickHeal Trojan.Qshell
ALYac Trojan.GenericKD.49061858
Cylance Unsafe
Paloalto generic.ml
Sangfor Trojan.Win32.Agent.aa
K7AntiVirus Riskware ( 0040eff71 )
BitDefender Trojan.GenericKD.49061858
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.Generic.D2EC9FE2
Cyren W32/ABTrojan.KBGH-3290
ESET-NOD32 a variant of Win32/Injector.ERRT
Avast Win32:Malware-gen
ClamAV Win.Malware.Uztuby-9951918-0
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/Qakbot.ae228048
MicroWorld-eScan Trojan.GenericKD.49061858
Ad-Aware Trojan.GenericKD.49061858
Emsisoft Trojan.GenericKD.49061858 (B)
Comodo Malware@#38nu78dxwzs3d
TrendMicro TROJ_GEN.R01FC0DET22
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Injector
Avira HEUR/AGEN.1249137
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.AI.cl
Microsoft Trojan:Win32/Qakbot.PMH!MTB
GData Trojan.GenericKD.49061858
AhnLab-V3 Malware/Win.Runner.C4814559
McAfee Artemis!87953BDF18BA
VBA32 Trojan.Qakbot
Malwarebytes Malware.AI.2104200805
TrendMicro-HouseCall TROJ_GEN.R01FC0DET22
Tencent Win32.Trojan.Qshell.Ebqr
MAX malware (ai score=80)
MaxSecure Trojan.Malware.1728101.susgen
AVG Win32:Malware-gen
Panda Trj/Genetic.gen
CrowdStrike win/malicious_confidence_100% (W)