popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66ec71a8dd7f7_setup33.exe#lyla

UPX Malicious Library OS Processor Check PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 20, 2024, 10:33 a.m. Sept. 20, 2024, 10:40 a.m.
Size 282.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 56e3db9291d886a337ba3d4a12828bca
SHA256 dc06fd3eb04a603543131d5e55cf24eecd08ff6eded42a9cc12370dd7ef27c69
CRC32 9C175F3F
ssdeep 6144:JF6xjwQaVe02c6drGhPby5TVnm+pzpj3Iin:2lwQaIJVIy5hnppzOi
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .mixe
section .sulehi
section .dul
section .jir
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 800
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 180224
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02612000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 800
region_size: 45056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02580000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00037a00', u'virtual_address': u'0x00001000', u'entropy': 7.859527442934812, u'name': u'.text', u'virtual_size': u'0x0003799c'} entropy 7.85952744293 description A section with a high entropy has been found
entropy 0.791814946619 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
tehtris Generic.Malware
Cynet Malicious (score: 100)
CAT-QuickHeal Ransom.Stop.P5
Skyhigh BehavesLike.Win32.Lockbit.dc
Cylance Unsafe
Sangfor Ransom.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (D)
K7GW Trojan ( 005579741 )
K7AntiVirus Trojan ( 00516fdf1 )
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
APEX Malicious
Avast PWSX-gen [Trj]
ClamAV Win.Packer.pkr_ce1a-9980177-0
Rising Trojan.Kryptik@AI.90 (RDML:GO3mS49Z6v2eFnoayh8e1w)
McAfeeD Real Protect-LS!56E3DB9291D8
Trapmine malicious.moderate.ml.score
Sophos ML/PE-A
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.56e3db9291d886a3
Google Detected
Kingsoft malware.kb.a.1000
Microsoft Trojan:Win32/Sabsik.FL.A!ml
Varist W32/Kryptik.MIZ.gen!Eldorado
DeepInstinct MALICIOUS
VBA32 Trojan.Buzus
Ikarus Trojan.Win32.Crypt
Tencent Trojan.Win32.Obfuscated.gen
MaxSecure Trojan.Malware.300983.susgen
AVG PWSX-gen [Trj]