popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 29, 2024, 5:08 p.m. Oct. 29, 2024, 5:15 p.m.
Size 5.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1db00ee7f85164f081e7cf05d7fa08a9
SHA256 a428a19abb6b3df11ef0abb1b0766df0b431400b362c1227f81ae3912f01d95c
CRC32 34DA3962
ssdeep 98304:QxPDFz2Q0zP4KwiMGbWkGkHJA6WHV6Xq2jUJqRdy:ePDFz2Q0zrwSdPm16Xq2vry
PDB Path c:\sourcecode\animation\release\expressanimate.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path c:\sourcecode\animation\release\expressanimate.pdb
resource name None
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 786432
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02a60000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2544
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02ae0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Kaspersky UDS:DangerousObject.Multi.Generic
VBA32 BScope.Trojan.MTA
section {u'size_of_data': u'0x001baa00', u'virtual_address': u'0x0040c000', u'entropy': 7.151774021456505, u'name': u'.rsrc', u'virtual_size': u'0x001baa00'} entropy 7.15177402146 description A section with a high entropy has been found
entropy 0.342953995157 description Overall entropy of this PE file is high