popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

afhksefkrhar.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 6, 2024, 6:15 p.m. Oct. 6, 2024, 6:17 p.m.
Size 423.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 844b868dabe70a2748c5f86c327e9391
SHA256 c339bc88c7ecc7c7d099e8457e16a7094fc2243e68ec30041d048b4f97b224c1
CRC32 7854B219
ssdeep 6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JS/3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbausViRUF9
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
135.181.4.162 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.2
192.168.56.101:49162
135.181.4.162:2423 		C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate 04:5c:d0:02:3c:b1:04:da:f2:83:95:d8:45:a5:92:84:ae:b0:25:47
TLS 1.2
192.168.56.101:49164
135.181.4.162:2423 		C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate 04:5c:d0:02:3c:b1:04:da:f2:83:95:d8:45:a5:92:84:ae:b0:25:47
TLS 1.2
192.168.56.101:49167
135.181.4.162:2423 		C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate 04:5c:d0:02:3c:b1:04:da:f2:83:95:d8:45:a5:92:84:ae:b0:25:47
TLS 1.2
192.168.56.101:49169
135.181.4.162:443 		C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate cc:83:d3:82:32:9c:b6:ba:58:af:69:13:0d:ce:04:7c:bf:23:12:54
TLS 1.2
192.168.56.101:49168
135.181.4.162:2423 		C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate C=XX, ST=N/A, L=N/A, O=Self-signed certificate, CN=135.181.4.162: Self-signed certificate 04:5c:d0:02:3c:b1:04:da:f2:83:95:d8:45:a5:92:84:ae:b0:25:47

section .textbss
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 61440
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009f0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f56000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4132864
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009ff000
process_handle: 0xffffffff
1 0 0
host 135.181.4.162
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Strab.4!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.Generic.gm
ALYac Gen:Variant.Lazy.553425
Cylance Unsafe
VIPRE Gen:Variant.Lazy.553425
BitDefender Gen:Variant.Lazy.553425
K7GW Trojan ( 005b7aa71 )
K7AntiVirus Trojan ( 005b7aa71 )
Arcabit Trojan.Lazy.D871D1
VirIT Trojan.Win32.GenusT.DYEZ
Symantec Trojan.Gen.MBT
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Kryptik.HXJW
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Trojan.Generic-10036401-0
Kaspersky HEUR:Trojan.Win32.Strab.gen
Alibaba Trojan:Win32/Rhadamanthys.5e5d4212
NANO-Antivirus Trojan.Win32.Inject5.kotejh
SUPERAntiSpyware Trojan.Agent/Gen-Strab
MicroWorld-eScan Gen:Variant.Lazy.553425
Rising Trojan.Rhadamanthys!8.178A1 (TFE:1:EE65rmTGwTO)
Emsisoft Gen:Variant.Lazy.553425 (B)
F-Secure Trojan.TR/Crypt.Agent.erqwk
DrWeb Trojan.Inject5.5936
Zillya Trojan.Strab.Win32.9439
TrendMicro TrojanSpy.Win32.RHADAMANTHYS.YXEISZ
McAfeeD ti!C339BC88C7EC
CTX exe.trojan.strab
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.844b868dabe70a27
Jiangmin Trojan.Strab.csh
Webroot W32.Malware.Gen
Google Detected
Avira TR/Crypt.Agent.erqwk
Antiy-AVL Trojan/Win32.Strab
Kingsoft malware.kb.a.975
Gridinsoft Trojan.Win32.Kryptik.sa
Xcitium Malware@#19rpkkmg1587z
Microsoft Trojan:Win32/Rhadamanthys.C!MTB
ViRobot Trojan.Win.Z.Strab.433152.Y
ZoneAlarm HEUR:Trojan.Win32.Strab.gen
GData Gen:Variant.Lazy.553425
Varist W32/Trojan.ICPK-8767
AhnLab-V3 Trojan/Win.Evo-gen.R657258
McAfee GenericRXWO-WK!844B868DABE7
TACHYON Trojan/W32.Strab.433152.B