popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

DK.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 27, 2024, 11:44 a.m. Oct. 27, 2024, 11:58 a.m.
Size 423.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 14988e9d35a0c92435297f7b2821dc60
SHA256 677b8ff45ebb9486a99aecf8dd2b4b362010573ecc4d0d082eda6a36a7cab671
CRC32 DEAFFD65
ssdeep 6144:YAYM3ZEWqf/qwPF7LR5W8ZJ74zmRiOFBbMh9q/JSt3ChNeK06iiRzmi0F9:YWBqf/qq3R5W8ZB4zmRzbagsViRUF9
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.196.11.237 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .textbss
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 61440
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f30000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x778e6000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 4132864
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02f3f000
process_handle: 0xffffffff
1 0 0
host 185.196.11.237
dead_host 185.196.11.237:9697
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Strab.4!c
CAT-QuickHeal Trojan.Vmprot
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Lazy.553425
Cylance Unsafe
VIPRE Gen:Variant.Lazy.553425
Sangfor Spyware.Win32.Rhadamanthys.Vz2e
BitDefender Gen:Variant.Lazy.553425
K7GW Trojan ( 005b7aa71 )
K7AntiVirus Trojan ( 005b7aa71 )
Arcabit Trojan.Lazy.D871D1
VirIT Trojan.Win32.GenusT.DYEZ
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Spy.Rhadamanthys.AD
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Trojan.Generic-10036401-0
Kaspersky HEUR:Trojan.Win32.Strab.gen
Alibaba TrojanSpy:Win32/Vmprot.2b227714
NANO-Antivirus Trojan.Win32.Inject5.kotejh
SUPERAntiSpyware Trojan.Agent/Gen-Strab
MicroWorld-eScan Gen:Variant.Lazy.553425
Rising Trojan.Rhadamanthys!8.178A1 (TFE:1:EE65rmTGwTO)
Emsisoft Gen:Variant.Lazy.553425 (B)
DrWeb Trojan.Inject5.5936
Zillya Trojan.Strab.Win32.9439
TrendMicro TrojanSpy.Win32.RHADAMANTHYS.YXEJRZ
McAfeeD ti!677B8FF45EBB
CTX exe.trojan.strab
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.14988e9d35a0c924
Jiangmin Trojan.Strab.csh
Google Detected
Antiy-AVL Trojan/Win32.Strab
Kingsoft malware.kb.a.974
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Win32/Vmprot.GQ!MTB
ViRobot Trojan.Win.Z.Strab.433152.AK
ZoneAlarm HEUR:Trojan.Win32.Strab.gen
GData Win32.Trojan.PSE.194YKYY
Varist W32/Trojan.ICPK-8767
AhnLab-V3 Trojan/Win.Evo-gen.R657258
McAfee GenericRXWO-WK!14988E9D35A0
TACHYON Trojan/W32.Strab.433152.B
DeepInstinct MALICIOUS
Malwarebytes Trojan.MalPack
Ikarus Trojan.Win32.Crypt