popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Extension2.exe

Malicious Packer UPX Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Sept. 23, 2024, 10:49 a.m. Sept. 23, 2024, 10:55 a.m.
Size 72.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 d1ba5271cc1825702119cfd7e0232f81
SHA256 9b4013e7e8decdbe58db125765084aaaff774701c363ffbbd4f8dd24eda4fc3c
CRC32 CDBB4498
ssdeep 1536:INi3NGdsLzuXz0jF+dhHEgCoK99KLxpMb+KR0Nc8QsJq39:OMviXmF+7HEgfKK7e0Nc8QsC9
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch
89.197.154.116 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49161 -> 89.197.154.116:7810 2260000 SURICATA Applayer Mismatch protocol both directions Generic Protocol Command Decode

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
        

      
        exception.instruction:
        add byte ptr [eax], al
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.symbol:
        
        

      
        exception.address:
        0x2b10007
        

      
    
  
    
      
        registers.esp:
        1638256
        

      
        registers.edi:
        1638248
        

      
        registers.eax:
        33555203
        

      
        registers.ebp:
        3670022
        

      
        registers.edx:
        2130566132
        

      
        registers.ebx:
        45154311
        

      
        registers.esi:
        13369356
        

      
        registers.ecx:
        792330240
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        fa 18 00 80 ff 18 00 0c fb 18 00 40 f9 18 00 19
        

      
        exception.instruction:
        cli
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.symbol:
        
        

      
        exception.address:
        0x18f8ad
        

      
    
  
    
      
        registers.esp:
        1636472
        

      
        registers.edi:
        0
        

      
        registers.eax:
        1636516
        

      
        registers.ebp:
        149649294
        

      
        registers.edx:
        2005822157
        

      
        registers.ebx:
        170532320
        

      
        registers.esi:
        0
        

      
        registers.ecx:
        4230937
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1200
        
      
      
      

    
  
    
      region_size:
      
        
          4096
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00380000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          1200
        
      
      
      

    
  
    
      region_size:
      
        
          4194304
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x02b10000
        
      
      
      

    
  
    
      allocation_type:
      
        
          4096
        
      
      
        (MEM_COMMIT)
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x0000b000', u'virtual_address': u'0x00001000', u'entropy': 7.027481156339436, u'name': u'.text', u'virtual_size': u'0x0000a966'}
                                        
                                    
                                        
                                            entropy
                                            7.02748115634
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.647058823529
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            host
                                            89.197.154.116
                                        
                                    
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.FamVT.RorenNHc.Trojan
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Swrort.4!c
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    CAT-QuickHeal
                                    Trojan.Swrort.A
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win32.Swrort.lh
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Trojan.CryptZ.Marte.1.Gen
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Trojan.CryptZ.Marte.1.Gen
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Trojan.Win32.Save.a
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_100% (D)
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Trojan.CryptZ.Marte.1.Gen
                                    
                                


                            

                        

                            

                                

                                    K7GW
                                    Trojan ( 001172b51 )
                                    
                                


                            

                        

                            

                                

                                    K7AntiVirus
                                    Trojan ( 001172b51 )
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.CryptZ.Marte.1.Gen
                                    
                                


                            

                        

                            

                                

                                    VirIT
                                    Trojan.Win32.Rozena.AA
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    Trojan Horse
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    Windows.Trojan.Metasploit
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win32/Rozena.ZL
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:Meterpreter-B [Expl]
                                    
                                


                            

                        

                            

                                

                                    ClamAV
                                    Win.Trojan.Swrort-5710536-0
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    HEUR:Trojan.Win32.Generic
                                    
                                


                            

                        

                            

                                

                                    Alibaba
                                    Trojan:Win32/CobaltStrike.5c89
                                    
                                


                            

                        

                            

                                

                                    NANO-Antivirus
                                    Virus.Win32.Gen-Crypt.ccnc
                                    
                                


                            

                        

                            

                                

                                    SUPERAntiSpyware
                                    Trojan.Backdoor-Shell
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Trojan.CryptZ.Marte.1.Gen
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    HackTool.Swrort!1.6477 (CLASSIC)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Trojan.CryptZ.Marte.1.Gen (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/Patched.Gen2
                                    
                                


                            

                        

                            

                                

                                    Zillya
                                    Trojan.RozenaGen.Win32.2
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    Backdoor.Win32.SWRORT.SMAL01
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    Real Protect-LS!D1BA5271CC18
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    CTX
                                    exe.trojan.swrort
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/EncPk-ACE
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Malicious PE
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.d1ba5271cc182570
                                    
                                


                            

                        

                            

                                

                                    Jiangmin
                                    Trojan.Generic.hszqm
                                    
                                


                            

                        

                            

                                

                                    Webroot
                                    W32.Malware.Gen
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/Patched.Gen2
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    GrayWare/Win32.Tampering.a
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    malware.kb.a.1000
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Trojan.Win32.Gen.tr
                                    
                                


                            

                        

                            

                                

                                    Xcitium
                                    TrojWare.Win32.Rozena.A@4jwdqr
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Meterpreter.RPZ!MTB
                                    
                                


                            

                        

                            

                                

                                    ViRobot
                                    Trojan.Win32.Elzob.Gen
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    HEUR:Trojan.Win32.Generic
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Win32.Trojan.PSE.19A8VV2
                                    
                                


                            

                        

                            

                                

                                    Varist
                                    W32/Swrort.A.gen!Eldorado