popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66d98aa7bea3e_newPrime.exe#real

Malicious Library UPX PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 6, 2024, 2:13 p.m. Sept. 6, 2024, 2:20 p.m.
Size 3.4MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 c4d092354c3f964ee1d9671f2517a6c9
SHA256 1814f8b1c1223b93e9b6ae699f7f8f25fb543ad511e349f39219a4ec222f4f05
CRC32 41EC4C40
ssdeep 49152:MYCkaqfKkUSztx7CU7XP6YINjwNxMgakj6TqZJbbbW6PJcF:MYCkatWveeX5IAxEkjw1F
PDB Path newPrime_cloud.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path newPrime_cloud.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .sdata
resource name None
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f61000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f62000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02240000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02370000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024dd000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008e6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008e7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024de000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02300000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02301000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008de000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02302000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02303000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02304000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02305000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02306000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1476
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02307000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_CURSOR language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x0026d7b4 size 0x00000134
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
name RT_BITMAP language LANG_JAPANESE filetype data sublanguage SUBLANG_DEFAULT offset 0x002f2750 size 0x00000144
section {u'size_of_data': u'0x00265c00', u'virtual_address': u'0x00002000', u'entropy': 7.43398273422239, u'name': u'.text', u'virtual_size': u'0x00265a34'} entropy 7.43398273422 description A section with a high entropy has been found
entropy 0.706779904995 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Crypt.4!c
Elastic malicious (high confidence)
Skyhigh Artemis!Trojan
Sangfor Trojan.Msil.Kryptik.Vzra
BitDefender Trojan.GenericKD.74037693
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of MSIL/Kryptik.ALRR
McAfee Artemis!C4D092354C3F
Avast Win32:MalwareX-gen [Trj]
ClamAV Win.Packed.Malwarex-10033462-0
Kaspersky HEUR:Trojan.MSIL.Crypt.gen
Alibaba Trojan:MSIL/Kryptik.70f8604a
MicroWorld-eScan Trojan.GenericKD.74037693
Rising Malware.Obfus/MSIL@AI.90 (RDM.MSIL2:Z/WbNjdt1hI/UZTfttwmYA)
Emsisoft Trojan.GenericKD.74037693 (B)
F-Secure Trojan.TR/AD.Stealc.ytttq
TrendMicro Trojan.Win32.PRIVATELOADER.YXEIEZ
McAfeeD ti!1814F8B1C122
FireEye Generic.mg.c4d092354c3f964e
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
Webroot W32.Malware.Gen
Google Detected
Avira TR/AD.Stealc.ytttq
MAX malware (ai score=84)
Gridinsoft Spy.Win32.Vidar.tr
Microsoft Trojan:Win32/Sabsik.TE.B!ml
ZoneAlarm HEUR:Trojan.MSIL.Crypt.gen
GData Win32.Malware.Injector.R30QKE
Varist W32/ABRisk.WDBW-3143
AhnLab-V3 Suspicious/Win.MalPe.X2197
BitDefenderTheta Gen:NN.ZemsilF.36812.CtZ@aiPVg7aO
DeepInstinct MALICIOUS
Ikarus Trojan.MSIL.Crypt
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXEIEZ
Tencent Win32.Trojan.FalseSign.Ojgl
MaxSecure Trojan.Malware.300983.susgen
Fortinet MSIL/Kryptik.ALTN!tr
AVG Win32:MalwareX-gen [Trj]
Paloalto generic.ml
CrowdStrike win/malicious_confidence_60% (D)
alibabacloud Trojan:MSIL/Wacapew.C9nj