popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Updater.exe

UPX Malicious Library PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 14, 2024, 10:37 a.m. Oct. 14, 2024, 10:39 a.m.
Size 4.2MB
Type PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
MD5 9fb8cc095e016caf986f28f61a4334ca
SHA256 369a92d10be574e4e96680100bba4bb8f1b94f23a129d04ce0cef93dbb4d92a1
CRC32 39119D11
ssdeep 98304:SA98w3AJb77ixCX3xPVLY9/zVHW2X3sANemWxOAn:x98wwJjnBPVE1zRVX8ApWbn
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: SUCCESS: The scheduled task "MyApp" has successfully been created.
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .vmp\xec\x9b\x83\xec
resource name PNG
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: cmd.exe
parameters: /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
filepath: cmd.exe
1 1 0
section {u'size_of_data': u'0x0040b200', u'virtual_address': u'0x00234000', u'entropy': 7.98873116396396, u'name': u'.vmp\\xec\\x9b\\x83\\xec', u'virtual_size': u'0x0040b1c0'} entropy 7.98873116396 description A section with a high entropy has been found
entropy 0.955904421101 description Overall entropy of this PE file is high
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
section .vmp\xec\x9b\x83\xec description Section name indicates VMProtect
section .vmp\xec\x9b\x83\xec description Section name indicates VMProtect
section .vmp\xec\x9b\x83\xec description Section name indicates VMProtect
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline cmd.exe /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline schtasks /create /tn MyApp /tr C:\Users\test22\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
cmdline "C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Fsysna.4!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.Generic.rc
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
K7GW Trojan ( 0059f91f1 )
K7AntiVirus Trojan ( 0059f91f1 )
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Packed.VMProtect.BC suspicious
APEX Malicious
Avast Win32:Evo-gen [Trj]
Kaspersky UDS:Trojan.Win32.Fsysna.jxyn
Rising Trojan.Kryptik@AI.84 (RDML:XGdsaXKnHPLcnQzQlyDttg)
F-Secure Trojan.TR/AVI.ClipBanker.rtyqx
McAfeeD ti!369A92D10BE5
Trapmine suspicious.low.ml.score
CTX exe.trojan.clipbanker
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.9fb8cc095e016caf
Avira TR/AVI.ClipBanker.rtyqx
Kingsoft malware.kb.b.860
Gridinsoft Trojan.Heur!.02210201
Microsoft Trojan:Win32/Sonbokli.A!cl
ViRobot Trojan.Win.Z.Agent.4436480
ZoneAlarm UDS:Trojan.Win32.Fsysna.jxyn
GData Win32.Trojan.Agent.XYCBWH
AhnLab-V3 Malware/Gen.Reputation.C4302750
McAfee Artemis!9FB8CC095E01
DeepInstinct MALICIOUS
Malwarebytes Malware.Heuristic.2108
Ikarus Win32.Outbreak
Tencent Win32.Trojan.Fsysna.Edhl
Fortinet Riskware/Application
AVG Win32:Evo-gen [Trj]