popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

off.exe

Emotet Gen1 Generic Malware Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 11, 2024, 9:54 a.m. Sept. 11, 2024, 9:59 a.m.
Size 2.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8584c1ffa2cdeed2d4f4c3ae4d3661ca
SHA256 8de7b187adc0998018ded36fd12f8bf51c1bc77c0b1b8c66347ece6f2d66cb6a
CRC32 9954032E
ssdeep 49152:C96FiaL0POUfY+Ka5gBisXETgv4OkL3hAUDXtYw/VNOgO7dqYW:MYiIUAcmBr08v4OkDVaw/VNO7dK
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
off+0x413ae @ 0x4413ae
off+0x431f3 @ 0x4431f3
off+0x488bc @ 0x4488bc
off+0x3e7c1 @ 0x43e7c1
off+0x3d6f7 @ 0x43d6f7
off+0x94e16 @ 0x494e16
off+0x80ca3 @ 0x480ca3
off+0x98cdb @ 0x498cdb
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00
exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea
exception.instruction: mov eax, dword ptr [esi]
exception.module: mpr.dll
exception.exception_code: 0xc0000005
exception.offset: 11754
exception.address: 0x74422dea
registers.esp: 1637604
registers.edi: 5087348
registers.eax: 1637632
registers.ebp: 1637648
registers.edx: 910
registers.ebx: 0
registers.esi: 910
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
off+0x413ae @ 0x4413ae
off+0x431f3 @ 0x4431f3
off+0x488bc @ 0x4488bc
off+0x3e7c1 @ 0x43e7c1
off+0x3d6f7 @ 0x43d6f7
off+0x94e16 @ 0x494e16
off+0x80ca3 @ 0x480ca3
off+0x98cdb @ 0x498cdb
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8b 06 c7 45 fc fe ff ff ff 85 db 0f 85 97 34 00
exception.symbol: WNetCloseEnum+0x14 WNetOpenEnumW-0x11c mpr+0x2dea
exception.instruction: mov eax, dword ptr [esi]
exception.module: mpr.dll
exception.exception_code: 0xc0000005
exception.offset: 11754
exception.address: 0x74422dea
registers.esp: 1637604
registers.edi: 5087648
registers.eax: 1637632
registers.ebp: 1637648
registers.edx: 44
registers.ebx: 0
registers.esi: 44
registers.ecx: 0
1 0 0

__exception__

 stacktrace: 
off+0x3e2e6 @ 0x43e2e6
off+0x3d6f7 @ 0x43d6f7
off+0x94e16 @ 0x494e16
off+0x80ca3 @ 0x480ca3
off+0x98cdb @ 0x498cdb
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b
exception.symbol: off+0x3b5db
exception.instruction: div dword ptr [edi]
exception.module: off.tmp
exception.exception_code: 0xc0000094
exception.offset: 243163
exception.address: 0x43b5db
registers.esp: 1637776
registers.edi: 5083324
registers.eax: 2504154
registers.ebp: 1637856
registers.edx: 0
registers.ebx: 1
registers.esi: 5083316
registers.ecx: 5083324
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2004
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1720
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000049c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\JackPot Cam\jackpotcam32_64.exe
file C:\Users\test22\AppData\Local\Temp\is-9CC7J.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-9CC7J.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-G2RP7.tmp\off.tmp
file C:\Users\test22\AppData\Local\Temp\is-9CC7J.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-9CC7J.tmp\_isetup\_iscrypt.dll
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\JPC_is1
2 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Cynet Malicious (score: 99)
VIPRE Gen:Heur.Munp.1
Sangfor Dropper.Win32.Agent.Vhxc
BitDefender Gen:Heur.Munp.1
Cybereason malicious.fa2cde
Arcabit Trojan.Munp.1
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.SLC
Avast FileRepMalware [Adw]
Kaspersky UDS:Trojan.Win32.Ekstak.ayjfs
MicroWorld-eScan Gen:Heur.Munp.1
Emsisoft Gen:Heur.Munp.1 (B)
F-Secure Heuristic.HEUR/AGEN.1375784
DrWeb Trojan.MulDrop26.51718
McAfeeD ti!8DE7B187ADC0
Trapmine malicious.high.ml.score
FireEye Gen:Heur.Munp.1
Sophos Mal/Generic-S
Avira HEUR/AGEN.1375784
MAX malware (ai score=80)
Kingsoft malware.kb.a.883
Gridinsoft Malware.Win32.Gen.tr
Microsoft Trojan:Win32/Wacatac.B!ml
ZoneAlarm UDS:Trojan.Win32.Ekstak.ayjfs
GData Gen:Heur.Munp.1
McAfee Artemis!8584C1FFA2CD
DeepInstinct MALICIOUS
Ikarus Trojan.Win32.Crypt
Tencent Win32.Trojan.Agen.Wdkl
huorong HEUR:TrojanDropper/Agent.t
AVG FileRepMalware [Adw]
Paloalto generic.ml