Summary | ZeroBOX

1.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 14, 2024, 10:43 a.m. Oct. 14, 2024, 10:58 a.m.
Size 6.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 81c15b0f839ae1f7d3745904b03d0910
SHA256 2e2ffdcb93d205faf722b60590c232f55d6695e4885a1ae97383ee8c0ab7a6ed
CRC32 84D1D276
ssdeep 98304:BbR4Odb8V3ZZYzuX6GG6f78bMkhEsotAfIpuvTtCTfRcaKQWZW/get9sio1Uh4Z:BVNdY3ZWkh9zW1ytNVTuaHWZgg3Ch4Z
PDB Path C:\Users\удача\Desktop\StubClear#2\Release\BigProject.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

IP Address Status Action
104.192.140.24 Active Moloch
164.124.101.2 Active Moloch

pdb_path C:\Users\удача\Desktop\StubClear#2\Release\BigProject.pdb
resource name CSD
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
1+0x2b0a1 @ 0x12b0a1
1+0x2d90b @ 0x12d90b
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5

exception.instruction_r: 03 51 3c 89 55 dc c7 85 b0 fe ff ff 01 00 00 00
exception.symbol: 1+0xf888
exception.instruction: add edx, dword ptr [ecx + 0x3c]
exception.module: 1.exe
exception.exception_code: 0xc0000005
exception.offset: 63624
exception.address: 0x10f888
registers.esp: 11780008
registers.edi: 0
registers.eax: 2482225828
registers.ebp: 11790504
registers.edx: 0
registers.ebx: 11790516
registers.esi: 27508
registers.ecx: 0
1 0 0
section {u'size_of_data': u'0x00601a00', u'virtual_address': u'0x0005d000', u'entropy': 7.999016155725801, u'name': u'.rsrc', u'virtual_size': u'0x00601980'} entropy 7.99901615573 description A section with a high entropy has been found
entropy 0.943328220859 description Overall entropy of this PE file is high