popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

univ.exe

Malicious Library Admin Tool (Sysinternals etc ...) UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 19, 2024, 9:35 a.m. Sept. 19, 2024, 10:08 a.m.
Size 325.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 85737d1c7426259423c84f96719e82ea
SHA256 5aba703ae3636bbd23110d80621643e39f4b924a664f85bd6542f9f10c6b983b
CRC32 599C5A29
ssdeep 6144:SfH1EM1595tnpAFQoUQzxh/vtuknuIiF/Q:mHh1595VpAWkT1uCuF/
Yara
  • Malicious_Library_Zero - Malicious_Library
  • Admin_Tool_IN_Zero - Admin Tool Sysinternals
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

resource name WETISEC
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 143360
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0052d000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1552
region_size: 241664
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
name WETISEC language LANG_TURKISH filetype ASCII text, with very long lines, with no line terminators sublanguage SUBLANG_DEFAULT offset 0x000524a0 size 0x00000bf7
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_ICON language LANG_TURKISH filetype GLS_BINARY_LSB_FIRST sublanguage SUBLANG_DEFAULT offset 0x00051fc0 size 0x00000468
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0004bc00 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0004bc00 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0004bc00 size 0x00000068
name RT_GROUP_ICON language LANG_TURKISH filetype data sublanguage SUBLANG_DEFAULT offset 0x0004bc00 size 0x00000068
section {u'size_of_data': u'0x0002f400', u'virtual_address': u'0x00001000', u'entropy': 7.770009368228294, u'name': u'.text', u'virtual_size': u'0x0002f26f'} entropy 7.77000936823 description A section with a high entropy has been found
entropy 0.583333333333 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

NtQuerySystemInformation

 information_class: 8 (SystemProcessorPerformanceInformation)
1 0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.StopCrypt.i!c
Cynet Malicious (score: 100)
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Generic.fh
ALYac Trojan.GenericKD.74059204
Cylance Unsafe
VIPRE Trojan.GenericKD.74059204
Sangfor Infostealer.Win32.Kryptik.Vzt4
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Trojan.GenericKD.74059204
K7GW Trojan ( 005ba3641 )
K7AntiVirus Trojan ( 005ba3641 )
Arcabit Trojan.Generic.D46A0DC4
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HXVG
APEX Malicious
Avast Win32:BotX-gen [Trj]
ClamAV Win.Packed.Pwsx-10035984-0
Kaspersky HEUR:Trojan-PSW.Win32.Tepfer.gen
Alibaba Ransom:Win32/StopCrypt.a072ee3e
MicroWorld-eScan Trojan.GenericKD.74059204
Rising Stealer.Stealerc!8.17BE0 (TFE:5:62qlktkfLgH)
Emsisoft Trojan.GenericKD.74059204 (B)
F-Secure Trojan.TR/AVI.AceCrypter.jjadj
DrWeb Trojan.DownLoader47.36187
TrendMicro Ransom_HPGANDCRAB.SMONT2
McAfeeD Real Protect-LS!85737D1C7426
Trapmine malicious.high.ml.score
CTX exe.trojan.generic
Sophos Troj/Krypt-AIN
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.85737d1c74262594
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AVI.AceCrypter.jjadj
Antiy-AVL Trojan[PSW]/Win32.Convagent
Kingsoft Win32.Trojan-PSW.Tepfer.gen
Gridinsoft Malware.Win32.Gen.tr
Xcitium Malware@#1m3gagiro55h9
Microsoft Ransom:Win32/StopCrypt.SL
ViRobot Trojan.Win.Z.Agent.332800.A
ZoneAlarm HEUR:Trojan-PSW.Win32.Tepfer.gen
GData Win32.Trojan.PSE.MREZZ9
Varist W32/Kryptik.MSV.gen!Eldorado
AhnLab-V3 Trojan/Win.Generic.R658943
McAfee Artemis!85737D1C7426
DeepInstinct MALICIOUS
VBA32 BScope.Backdoor.Tofsee