popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

66ef2dea4d06c_rrr01.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 22, 2024, 5:23 p.m. Sept. 22, 2024, 5:58 p.m.
Size 421.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 59f2f7f0cf8faf41dbb0a7878b5d66bb
SHA256 683391c9e997f8e960c52edb11106157fb4bf122d21a0a72fe6a9a14ebacf584
CRC32 9EE1D303
ssdeep 12288:MSasngwHpPE9JyzE7Q1Hlt/a7CLfznto3ZUsVB:gsngwHpPvgqFRaGLfDtMZUOB
PDB Path c:\omtnkdoj\bnwv\yogisfk\cqf.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
62.210.113.223 Active Moloch
45.33.6.223 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path c:\omtnkdoj\bnwv\yogisfk\cqf.pdb
description 66ef2dea4d06c_rrr01.exe tried to sleep 600 seconds, actually delayed analysis time by 0 seconds
Time & API Arguments Status Return Repeated

DeviceIoControl

 input_buffer:
control_code: 475228 (IOCTL_DISK_GET_LENGTH_INFO)
device_handle: 0x000000d4
output_buffer: 
1 1 0

DeviceIoControl

 input_buffer:
control_code: 475228 (IOCTL_DISK_GET_LENGTH_INFO)
device_handle: 0x000000d4
output_buffer: 
1 1 0

DeviceIoControl

 input_buffer:
control_code: 475228 (IOCTL_DISK_GET_LENGTH_INFO)
device_handle: 0x000000d4
output_buffer: 
1 1 0

DeviceIoControl

 input_buffer:
control_code: 475228 (IOCTL_DISK_GET_LENGTH_INFO)
device_handle: 0x000000d4
output_buffer: 
1 1 0
section {u'size_of_data': u'0x00059400', u'virtual_address': u'0x00013000', u'entropy': 7.936624426689054, u'name': u'.data', u'virtual_size': u'0x0005a420'} entropy 7.93662442669 description A section with a high entropy has been found
entropy 0.85 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeShutdownPrivilege
1 1 0
host 62.210.113.223
host 45.33.6.223
Time & API Arguments Status Return Repeated

NtShutdownSystem

 action: 1 (ShutdownReboot)
0 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Pitou.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.PitouRI.S28786866
Skyhigh BehavesLike.Win32.Generic.gc
ALYac Gen:Variant.Lazy.214906
Cylance Unsafe
VIPRE Gen:Variant.Lazy.214906
Sangfor Trojan.Win32.Pitou.Vqf1
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Lazy.214906
K7GW Trojan ( 0051ac071 )
K7AntiVirus Trojan ( 0051ac071 )
Arcabit Trojan.Lazy.D3477A
VirIT Trojan.Win32.Genus.UWM
Symantec ML.Attribute.HighConfidence
Elastic Windows.Generic.Threat
ESET-NOD32 a variant of Win32/Pitou.K
APEX Malicious
Avast Win32:Pitou-A [Rtk]
Kaspersky HEUR:Trojan.Win32.Generic
Alibaba Trojan:Win32/Pitou.b6c68248
NANO-Antivirus Trojan.Win32.Pitou.jpbcqi
SUPERAntiSpyware Trojan.Agent/Gen-Crypt
MicroWorld-eScan Gen:Variant.Lazy.214906
Rising Backdoor.Pitou!1.D9BF (CLASSIC)
Emsisoft Gen:Variant.Lazy.214906 (B)
F-Secure Trojan.TR/Crypt.XPACK.Gen
DrWeb Trojan.Pitou.17
Zillya Trojan.Pitou.Win32.1735
TrendMicro TROJ_GEN.R002C0DIE24
McAfeeD ti!683391C9E997
Trapmine malicious.high.ml.score
CTX exe.trojan.pitou
Sophos Mal/Generic-S
Ikarus Trojan.Win32.SmokeLoader
FireEye Generic.mg.59f2f7f0cf8faf41
Jiangmin Trojan.Generic.heead
Google Detected
Avira TR/Crypt.XPACK.Gen
Antiy-AVL Trojan/Win32.Pitou
Kingsoft Win32.Trojan.Generic.a
Xcitium TrojWare.Win32.TrojanDownloader.Onkods.Q@52urg7
Microsoft Trojan:Win32/Pitou.AC!MTB
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Lazy.214906
Varist W32/Pitou.B.gen!Eldorado
AhnLab-V3 Trojan/Win32.Tepfer.R96475
McAfee GenericRXHQ-SA!59F2F7F0CF8F
DeepInstinct MALICIOUS