popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Geek.exe

Emotet Generic Malware Malicious Library Antivirus UPX Malicious Packer PE File dll OS Processor Check PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 18, 2024, 10:09 a.m. Oct. 18, 2024, 10:22 a.m.
Size 6.7MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c0eeaaaae6a849152fe8e826a21b6054
SHA256 ba619aed58332f8cf8fb93939e6986f9d8b3d0bae3ffa0348dbad5b43c186b19
CRC32 EE3A12D9
ssdeep 98304:1DGNSuNY3icztjLO5UE2Ymg77UQ1mfa/ews4VOp9mD:NGNO3icztfO5UEIg7oQcfa/ewsWOpsD
PDB Path G:\Projects\uninstall-tool\Ready\geek.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • DllRegisterServer_Zero - execute regsvr32.exe
  • Antivirus - Contains references to security software
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
47.236.122.191 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path G:\Projects\uninstall-tool\Ready\geek.pdb
resource name BIN
resource name PNG
resource name XML
resource name None
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2064
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00370000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x001e8400', u'virtual_address': u'0x00001000', u'entropy': 7.057187319830817, u'name': u'.text', u'virtual_size': u'0x001e8333'} entropy 7.05718731983 description A section with a high entropy has been found
entropy 0.285756090424 description Overall entropy of this PE file is high
host 47.236.122.191
dead_host 47.236.122.191:7900
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.CryptZ.4!c
Cynet Malicious (score: 99)
ALYac Trojan.CryptZ.Marte.1.Gen
Cylance Unsafe
VIPRE Trojan.CryptZ.Marte.1.Gen
Sangfor HackTool.Win32.Reverse_Bin_v2_5_through_v4_x.uwccg
CrowdStrike win/malicious_confidence_100% (D)
BitDefender Trojan.CryptZ.Marte.1.Gen
Arcabit Trojan.CryptZ.Marte.1.Gen
VirIT Trojan.Win32.Rozena.AA
Symantec Meterpreter
Elastic Windows.Trojan.Metasploit
ESET-NOD32 a variant of Win32/Rozena.AA
APEX Malicious
Avast Win32:Meterpreter-B [Expl]
ClamAV Win.Trojan.Swrort-5710536-0
Kaspersky UDS:DangerousObject.Multi.Generic
NANO-Antivirus Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan Trojan.CryptZ.Marte.1.Gen
Rising HackTool.Swrort!1.6477 (CLASSIC)
Emsisoft Trojan.CryptZ.Marte.1.Gen (B)
F-Secure Trojan.TR/Patched.Gen2
TrendMicro Backdoor.Win32.SWRORT.YXEJRZ
McAfeeD ti!BA619AED5833
Trapmine suspicious.low.ml.score
CTX exe.trojan.meterpreter
Sophos Mal/EncPk-ACE
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.c0eeaaaae6a84915
Google Detected
Avira TR/Patched.Gen2
Antiy-AVL Trojan/Win32.Meterpreter
Kingsoft Win32.Trojan.Shelm.aqkw
Gridinsoft Trojan.Win32.Gen.tr
Xcitium TrojWare.Win32.Rozena.A@4jwdqr
Microsoft Trojan:Win32/Meterpreter.RPZ!MTB
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Trojan.CryptZ.Marte.1.Gen
Varist W32/Swrort.B.gen!Eldorado
McAfee Artemis!C0EEAAAAE6A8
DeepInstinct MALICIOUS
Ikarus Win32.Outbreak
Panda Trj/CI.A
TrendMicro-HouseCall Backdoor.Win32.SWRORT.YXEJRZ
Tencent Trojan.Win32.Metasploit_heur.16000690
huorong VirTool/Meterpreter.a
Fortinet W32/Swrort.C!tr
AVG Win32:Meterpreter-B [Expl]
Paloalto generic.ml