Summary | ZeroBOX

winfo.exe

Malicious Library PE32 PE File
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 20, 2024, 9:09 a.m. Oct. 20, 2024, 9:38 a.m.
Size 52.0KB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 36731ee0e883b48fea504491545d2bff
SHA256 807d1a00a996b7ff88e7070cf9812232e9ff70a3a9387c67c63ec162a5edd655
CRC32 BC35B277
ssdeep 768:TkP3dfDtLXV7/LnGd/T9VCtK7NBCUQ7aWyoe/lep8J0zlhhHecD:adfDLTA5VeKpEUQLaJ0zlDec
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleA

buffer: Winfo 2.0 - copyright (c) 1999-2003, Arne Vidstrom
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: - http://www.ntsecurity.nu/toolbox/winfo/
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: Usage: winfo <IP> [-n] [-v]
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: -n = establish null session before trying to dump info.
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: Without -n, any session already established will be used.
console_handle: 0x00000007
1 1 0

WriteConsoleA

buffer: -v = verbose mode, show detailed account information.
console_handle: 0x00000007
1 1 0
Bkav W32.AIDetectMalware
Jiangmin Trojan.Generic.hpuzc
Kingsoft malware.kb.a.973
Gridinsoft Malware.Win32.GenericMC.cc
MaxSecure Trojan.Malware.300983.susgen