popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

gefox.exe

Emotet Gen1 Malicious Library UPX PE64 MZP Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 19, 2024, 9:33 a.m. Sept. 19, 2024, 9:35 a.m.
Size 3.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ee42c29675d7fc861464f7265f55e42f
SHA256 8bc5aab9c43dafa763ecf0c4f4502980183b1a1560e8919397ac6ff32e144229
CRC32 9ED52310
ssdeep 98304:M/Pl/Bgyf6ZHRkgBlLF1vVCXVC2Vmsq4K:U++YHRkYlLvolgsg
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • mzp_file_format - MZP(Delphi) file format

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1372
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2108
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00350000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000064f0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-GTF5R.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-GTF5R.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-A16C2.tmp\gefox.tmp
file C:\Users\test22\AppData\Local\Temp\is-GTF5R.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-GTF5R.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-A16C2.tmp\gefox.tmp
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.ObfuscatedPoly.wc
Cylance Unsafe
VIPRE Gen:Heur.Munp.1
Sangfor Dropper.Win32.Agent.V6v3
CrowdStrike win/grayware_confidence_70% (D)
BitDefender Trojan.GenericKD.74154503
Arcabit Trojan.Generic.D46B8207
VirIT Adware.Win32.Genus.HHD
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.SLC
Avast FileRepMalware [Adw]
MicroWorld-eScan Trojan.GenericKD.74154503
Emsisoft Trojan.GenericKD.74154503 (B)
F-Secure Heuristic.HEUR/AGEN.1375784
TrendMicro Trojan.Win32.PRIVATELOADER.YXEIRZ
McAfeeD ti!8BC5AAB9C43D
Trapmine malicious.moderate.ml.score
CTX exe.trojan.generic
Sophos Mal/Generic-S
Ikarus Trojan.Win32.Crypt
FireEye Trojan.GenericKD.74154503
Avira HEUR/AGEN.1375784
Kingsoft Win32.Trojan.Ekstak.a
Gridinsoft Malware.Win32.Gen.tr
Microsoft Trojan:Win32/Wacatac.B!ml
GData Win32.Trojan.Kryptik.IQ4MQK
AhnLab-V3 Malware/Win.Generic.C5671270
McAfee Artemis!EE42C29675D7
DeepInstinct MALICIOUS
Malwarebytes Adware.DownloadAssistant
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.PRIVATELOADER.YXEIRZ
Tencent Win32.Trojan.Ekstak.Udkl
huorong HEUR:TrojanDropper/Agent.t
Fortinet Riskware/Agent
AVG FileRepMalware [Adw]
Paloalto generic.ml