popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ScreenUpdateSync.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 19, 2024, 9:35 a.m. Sept. 19, 2024, 9:46 a.m.
Size 273.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 95c4cd6903e8db5123f6941486a2af23
SHA256 5f4cc4675e728402c318c544ddfdcde87629be935157d731127fed4ce36efa1b
CRC32 4D4EF6D7
ssdeep 3072:3kCLNdMje+6SQTmVVpfcUKjjVtMpMIdgUZjYpkibLK57N65X7FUMwVnfyN03xH61:ZLNd2HQm9PKvVtMeKvYph5X7zwVy03R
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name AFX_DIALOG_LAYOUT
resource name PABUXILUXOHIPOZIDEWIFIM
resource name XUNOHOBOYURAMATOCABEZUZUBOHAWA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 496
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 102400
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 496
region_size: 196608
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name PABUXILUXOHIPOZIDEWIFIM language LANG_TURKISH filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x00139550 size 0x00000bf7
name XUNOHOBOYURAMATOCABEZUZUBOHAWA language LANG_TURKISH filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x0013a148 size 0x000003fa
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00139070 size 0x00000468
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x00132cb0 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x00132cb0 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x00132cb0 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x00132cb0 size 0x00000068
section {u'size_of_data': u'0x00022800', u'virtual_address': u'0x00001000', u'entropy': 7.728446969031286, u'name': u'.text', u'virtual_size': u'0x0002278f'} entropy 7.72844696903 description A section with a high entropy has been found
entropy 0.506422018349 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Stealc.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Generic.dh
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
K7GW Trojan ( 005a23a61 )
K7AntiVirus Trojan ( 005a23a61 )
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HXWX
APEX Malicious
Avast Win32:CrypterX-gen [Trj]
Rising Trojan.Kryptik@AI.100 (RDML:6403Q2EIQ8yU/CkX18ziqQ)
F-Secure Trojan.TR/AD.Stealc.jccce
TrendMicro TrojanSpy.Win32.STEALC.YXEIRZ
McAfeeD Real Protect-LS!95C4CD6903E8
Trapmine malicious.high.ml.score
CTX exe.trojan.kryptik
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.95c4cd6903e8db51
Webroot W32.Trojan.Stealer
Google Detected
Avira TR/AD.Stealc.jccce
Kingsoft Win32.Trojan-Banker.Danabot.gen
Gridinsoft Ransom.Win32.Sabsik.sa
Microsoft Trojan:Win32/StealC.RZ!MTB
ViRobot Trojan.Win.Z.Sabsik.280064
GData Win32.Packed.Kryptik.LGR7RP
Varist W32/Kryptik.MTM.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R658943
McAfee Artemis!95C4CD6903E8
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.1964971925
Ikarus Trojan.Win32.Crypt
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win32.STEALC.YXEIRZ
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/GenKryptik.HBTI!tr
AVG Win32:CrypterX-gen [Trj]
Paloalto generic.ml