Summary | ZeroBOX

pclient.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 9, 2024, 10:08 a.m. Sept. 9, 2024, 10:12 a.m.
Size 1.8MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 54d967f9eb61177beabd0c5c826fd4c6
SHA256 5b9481d9022b0efcaed04513d338048de4aa3e1328bacc0966486ef322c0d086
CRC32 335847B5
ssdeep 24576:OUcMeKNytFmNmR/j9mPRVTdIwGptlLjBfmnAtOeiy:OUxeKAtMNIEVEnF98y
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

stacktrace:
pclient+0x1752e3 @ 0x13fa352e3
pclient+0x1b039a @ 0x13fa7039a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: f3 aa 48 8b 84 24 58 f3 00 00 0f bf 00 0f bf 8c
exception.symbol: pclient+0x1752e3
exception.instruction: stosb byte ptr [rdi], al
exception.module: pclient.exe
exception.exception_code: 0xc0000005
exception.offset: 1528547
exception.address: 0x13fa352e3
registers.r14: 0
registers.r15: 0
registers.rcx: 331878
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 2686096
registers.r11: 514
registers.r8: 2565096
registers.r9: 0
registers.rdx: 0
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 0
registers.r13: 0
1 0 0
Bkav W64.AIDetectMalware
Elastic malicious (high confidence)
Cylance Unsafe
APEX Malicious
FireEye Generic.mg.54d967f9eb61177b
Ikarus Trojan.Win64.Agent
Google Detected
Kingsoft malware.kb.a.708
Microsoft Program:Win32/Wacapew.C!ml
DeepInstinct MALICIOUS
Paloalto generic.ml
CrowdStrike win/malicious_confidence_70% (D)