Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 26, 2024, 5:18 p.m.	Oct. 26, 2024, 5:22 p.m.

Size	13.3MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`437db7be6be5da78c90225d5de946a94`
SHA256	`fafa91885db6e09ef0c1a10a7115afa70aab8130a7e447802ededfb8fb6d9f76`
CRC32	`D7644F87`
ssdeep	`393216:ARtHWuNv2A6shgRhXePD8Y9OxefYj354vy5l:S7N+ohgXsUxefYW65`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE64 - (no description)

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 26, 2024, 5:11 p.m.		1	1	0

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Oct. 26, 2024, 5:12 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000004620000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0	0

file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\app.exe
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\vcruntime140.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\libffi-7.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\libssl-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\python3.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\pythoncom310.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\pywintypes310.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\sqlite3.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\vcruntime140_1.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\libcrypto-1_1.dll
file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\python310.dll

section

{u'size_of_data': u'0x00d24200', u'virtual_address': u'0x0004b000', u'entropy': 7.999030978458364, u'name': u'.rsrc', u'virtual_size': u'0x00d240b0'}

entropy

7.99903097846

description

A section with a high entropy has been found

entropy

0.990358785649

description

Overall entropy of this PE file is high

file	C:\Users\test22\AppData\Local\Temp\onefile_2552_133744055049062500\app.exe

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Generic.4!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Agent
Skyhigh	BehavesLike.Win64.Chir.tc
ALYac	Trojan.GenericKDZ.108201
Cylance	Unsafe
VIPRE	Trojan.GenericKDZ.108201
Sangfor	Trojan.Win32.Agent.Voqm
CrowdStrike	win/malicious_confidence_70% (D)
BitDefender	Trojan.GenericKDZ.108201
K7GW	Trojan ( 005b876e1 )
K7AntiVirus	Trojan ( 005b876e1 )
Arcabit	Trojan.Generic.D1A6A9
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Avast	Win64:Evo-gen [Trj]
Kaspersky	Trojan-PSW.Win32.Greedy.fxb
Alibaba	TrojanPSW:Win32/Greedy.36990e1a
MicroWorld-eScan	Trojan.GenericKDZ.108201
Emsisoft	Trojan.GenericKDZ.108201 (B)
F-Secure	Trojan.TR/Redcap.qasuh
DrWeb	Trojan.PWS.Stealer.39881
Zillya	Trojan.Agent.Win64.62052
McAfeeD	ti!FAFA91885DB6
CTX	exe.trojan.generic
Sophos	Generic Reputation PUA (PUA)
SentinelOne	Static AI - Suspicious PE
FireEye	Trojan.GenericKDZ.108201
Jiangmin	Trojan.Tedy.d
Google	Detected
Avira	TR/Redcap.qasuh
Antiy-AVL	Trojan[Packed]/Python.Nuitka
Gridinsoft	Trojan.Win64.Packed.sa
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Trojan.GenericKDZ.108201
AhnLab-V3	Malware/Win.Generic.R660067
McAfee	Artemis!437DB7BE6BE5
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.3660686442
Ikarus	Trojan.Python.Psw
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H09JF24
Tencent	Win32.Trojan-QQPass.QQRob.Xfow
Yandex	Trojan.PWS.Coins!/nPvfECPnK4
Fortinet	W32/PossibleThreat
AVG	Win64:Evo-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan:Win/Wacapew.C9nj

app.exe