popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

8.11.9-Windows.exe

Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 17, 2024, 1:29 p.m. Sept. 17, 2024, 2:17 p.m.
Size 16.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1c6b522d985b2e60890a098e3d5e78b8
SHA256 35005932465ca51b1bffcd168dd6c9386dbdecb78efacfbe4877b9b1e65da8b4
CRC32 79B21672
ssdeep 98304:D5MCdYwJ/6LV6oJBgsJDVUN81bIe3Ev9kaxS0i8J2LAAvbW54jSEUb5HwXQiUacn:uqm6ABmN81bH0VSpO2sGb905QX5ccC
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .symtab
section {u'size_of_data': u'0x00093e00', u'virtual_address': u'0x00ca9000', u'entropy': 7.99698983624631, u'name': u'/19', u'virtual_size': u'0x00093c6b'} entropy 7.99698983625 description A section with a high entropy has been found
section {u'size_of_data': u'0x0001ac00', u'virtual_address': u'0x00d3d000', u'entropy': 7.980773060165261, u'name': u'/32', u'virtual_size': u'0x0001aac2'} entropy 7.98077306017 description A section with a high entropy has been found
section {u'size_of_data': u'0x00118c00', u'virtual_address': u'0x00d59000', u'entropy': 7.9978687118070795, u'name': u'/65', u'virtual_size': u'0x00118ac2'} entropy 7.99786871181 description A section with a high entropy has been found
section {u'size_of_data': u'0x000bee00', u'virtual_address': u'0x00e72000', u'entropy': 7.995194165369884, u'name': u'/78', u'virtual_size': u'0x000becaa'} entropy 7.99519416537 description A section with a high entropy has been found
section {u'size_of_data': u'0x00035c00', u'virtual_address': u'0x00f31000', u'entropy': 7.938512432689286, u'name': u'/90', u'virtual_size': u'0x00035ab3'} entropy 7.93851243269 description A section with a high entropy has been found
Bkav W32.Common.C5338E52
Lionic Trojan.Win32.Generic.4!c
CTX exe.trojan.generic
CAT-QuickHeal Trojan.Agent
Skyhigh Artemis
Cylance Unsafe
Sangfor Infostealer.Win32.Agent.V3q2
CrowdStrike win/malicious_confidence_60% (D)
Alibaba TrojanPSW:Win32/Generic.c67f9407
K7GW Trojan ( 005b9ebb1 )
K7AntiVirus Trojan ( 005b9ebb1 )
VirIT Trojan.Win32.Genus.WKG
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of WinGo/PSW.Agent.HE
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 99)
F-Secure Trojan.TR/AVI.Agent.ytrwh
TrendMicro Trojan.Win32.AMADEY.YXEH1Z
McAfeeD ti!35005932465C
Trapmine malicious.moderate.ml.score
Sophos Mal/Generic-S
Ikarus Trojan.WinGo.Agent
Jiangmin Trojan.PE.gm
Google Detected
Avira TR/AVI.Agent.ytrwh
Antiy-AVL Trojan[PSW]/Win32.Agent
Microsoft Trojan:Win32/Phonzy.A!ml
GData Win32.Trojan.Agent.OAH2Q1
Varist W32/ABTrojan.KIRA-1858
AhnLab-V3 Malware/Win.Generic.C5663783
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.1015433274
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXEH1Z
Tencent Win32.Trojan.Avi.Ddhl
Fortinet W32/Agent.HE!tr.pws
Panda Trj/Chgt.AD
alibabacloud RiskWare:Multi/AVI.Akgpp