popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1221.exe

Emotet Generic Malware Malicious Library ASPack UPX Malicious Packer PE File dll OS Processor Check PE32 DLL DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Sept. 27, 2024, 1:34 p.m. Sept. 27, 2024, 1:43 p.m.
Size 3.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b2d997ae878ab9eb95c015548367b746
SHA256 ec6d1df52cb3cd17cb8d638eb9f5ada51fb2a4997d7f0953fac35f101ff1822a
CRC32 726550B1
ssdeep 49152:Z/aimhYljuri/ieiCes4fYn2o4Bpo3aVfm2pT+s8KuqGaX0ToIBAUZLY/:A7hYMreJes4fJobqVRoJBAUZLI
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • ASPack_Zero - ASPack packed file
  • DllRegisterServer_Zero - execute regsvr32.exe
  • Win32_Trojan_Emotet_1_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

packer Armadillo v1.71
resource name TEXTINCLUDE
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73442000
process_handle: 0xffffffff
1 0 0
name TEXTINCLUDE language LANG_CHINESE filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00356c78 size 0x00000151
name TEXTINCLUDE language LANG_CHINESE filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00356c78 size 0x00000151
name TEXTINCLUDE language LANG_CHINESE filetype C source, ASCII text, with CRLF line terminators sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00356c78 size 0x00000151
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00357168 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00357168 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00357168 size 0x000000b4
name RT_CURSOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00357168 size 0x000000b4
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003589dc size 0x00000144
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003599b4 size 0x00000284
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x003599b4 size 0x00000284
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035abfc size 0x0000018c
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b644 size 0x00000024
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x2 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b690 size 0x00000022
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x2 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b690 size 0x00000022
name RT_GROUP_CURSOR language LANG_CHINESE filetype Lotus unknown worksheet or configuration, revision 0x2 sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b690 size 0x00000022
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b6f8 size 0x00000014
name RT_GROUP_ICON language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0035b6f8 size 0x00000014
file C:\Users\test22\AppData\Local\Temp\libeay32.dll
file C:\Users\test22\AppData\Local\Temp\libeay32.dll
section {u'size_of_data': u'0x00213000', u'virtual_address': u'0x000de000', u'entropy': 7.1086806601525945, u'name': u'.rdata', u'virtual_size': u'0x002120d6'} entropy 7.10868066015 description A section with a high entropy has been found
entropy 0.677295918367 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Generic.4!c
tehtris Generic.Malware
Cynet Malicious (score: 100)
ALYac Gen:Variant.Fragtor.348385
Cylance Unsafe
Sangfor Virus.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (W)
BitDefender Gen:Variant.Fragtor.348385
K7GW Trojan ( 005246d51 )
K7AntiVirus Trojan ( 005246d51 )
Arcabit Trojan.Fragtor.D550E1
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX Malicious
MicroWorld-eScan Gen:Variant.Fragtor.348385
Emsisoft Gen:Variant.Fragtor.348385 (B)
VIPRE Gen:Variant.Fragtor.348385
McAfeeD Real Protect-LS!B2D997AE878A
Trapmine malicious.moderate.ml.score
CTX exe.unknown.fragtor
Sophos Generic Reputation PUA (PUA)
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.b2d997ae878ab9eb
Google Detected
Antiy-AVL RiskWare/Win32.FlyStudio.a
Gridinsoft Trojan.Win32.Gen.bot!i
Xcitium Worm.Win32.Dropper.RA@1qraug
Microsoft Trojan:Win32/Wacatac.B!ml
GData Win32.Trojan.PSE.15CL508
Varist W32/FlyAgent.D.gen!Eldorado
AhnLab-V3 Malware/Win32.Generic.C365559
McAfee Artemis!B2D997AE878A
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Dynamer
Malwarebytes Generic.Malware.AI.DDS
Ikarus Trojan.Win32.Agent
Fortinet W32/CoinMiner.PHP!tr
Paloalto generic.ml