Summary | ZeroBOX

ord.exe

Malicious Library PE32 PE File
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 19, 2024, 9:36 a.m. Sept. 19, 2024, 9:43 a.m.
Size 281.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c9de515a559b9423bf8bcc7e4449afb5
SHA256 f8281ab4854afae09b60e2a66953587e0c5459d079bb1b307ef29a28e5f1be0c
CRC32 FF73E9E4
ssdeep 6144:aM56QjzI4OxLD7dJBg/hQYtg8KHJyaAaoqsOmlLNWpTX63tFDLF:aM/3CxLD/u/hQ0CM7aoq/6NWJQtFDR
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 278528
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e3000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 12288
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002e1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

process_identifier: 2648
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00900000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00045400', u'virtual_address': u'0x00001000', u'entropy': 7.995708843444293, u'name': u'.text', u'virtual_size': u'0x00045384'} entropy 7.99570884344 description A section with a high entropy has been found
entropy 1.0 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Formbook.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojanspy.Noon
Skyhigh BehavesLike.Win32.Generic.dc
ALYac Gen:Variant.Mikey.148734
Cylance Unsafe
VIPRE Gen:Variant.Mikey.148734
Sangfor Spyware.Win32.Formbook.Vd5g
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Gen:Variant.Mikey.148734
K7GW Trojan ( 00536d121 )
K7AntiVirus Trojan ( 00536d121 )
Arcabit Trojan.Mikey.D244FE
VirIT Trojan.Win32.Formbook.GEN
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Formbook.AA
APEX Malicious
Avast Win32:PWSX-gen [Trj]
Kaspersky Trojan-Spy.Win32.Noon.bibw
Alibaba TrojanSpy:Win32/FormBook.55d14793
MicroWorld-eScan Gen:Variant.Mikey.148734
Rising Spyware.Agent!1.F5F4 (CLASSIC)
Emsisoft Gen:Variant.Mikey.148734 (B)
F-Secure Trojan.TR/Crypt.ZPACK.Gen
DrWeb Trojan.Packed2.47885
Zillya Trojan.Noon.Win32.32878
McAfeeD Real Protect-LS!C9DE515A559B
Trapmine suspicious.low.ml.score
CTX exe.trojan.formbook
Sophos Troj/Formbook-A
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.c9de515a559b9423
Webroot W32.Noon.bibw
Google Detected
Avira TR/Crypt.ZPACK.Gen
Antiy-AVL Trojan/Win32.Formbook.x
Kingsoft Win32.Trojan-Spy.Noon.bibw
Gridinsoft Spy.Win32.Keylogger.sa
Microsoft Trojan:Win32/FormBook.NF!MTB
ZoneAlarm Trojan-Spy.Win32.Noon.bibw
GData Gen:Variant.Mikey.148734
Varist W32/ABTrojan.WLRJ-8546
AhnLab-V3 Infostealer/Win.Formbook.R647393
McAfee Artemis!C9DE515A559B
DeepInstinct MALICIOUS
VBA32 Malware-Cryptor.General.3
Malwarebytes Spyware.FormBook
Ikarus Trojan.Win32.Formbook