popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

123321.exe

Generic Malware Malicious Library UPX Malicious Packer PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 1, 2024, 9:17 a.m. Nov. 1, 2024, 9:19 a.m.
Size 1.3MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 a917b1d8182ab760220c1f9a59c5576c
SHA256 2be1a242289c38722a8019eed87900389f591c799974fe986f635bcd88ee3f60
CRC32 5AF9C5E5
ssdeep 24576:9OJJ3zJrQ+zoEYPVibg9+tpm2h0lhSMXl13gu2w:Qr3zJE+Jqkkau
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.symbol:
        
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.address:
        0x0
        

      
    
  
    
      
        registers.r14:
        0
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        0
        

      
        registers.rsi:
        2590
        

      
        registers.r10:
        1996248688
        

      
        registers.rbx:
        5360640240
        

      
        registers.rsp:
        1498808
        

      
        registers.r11:
        1498800
        

      
        registers.r8:
        4096
        

      
        registers.r9:
        4
        

      
        registers.rdx:
        4096
        

      
        registers.r12:
        0
        

      
        registers.rbp:
        998
        

      
        registers.rdi:
        3
        

      
        registers.rax:
        5360640240
        

      
        registers.r13:
        0
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtAllocateVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          296
        
      
      
      

    
  
    
      region_size:
      
        
          131072
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00000000004e0000
        
      
      
      

    
  
    
      allocation_type:
      
        
          12288
        
      
      
        (MEM_COMMIT|MEM_RESERVE)
      
      

    
  
    
      process_handle:
      
        
          0xffffffffffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          296
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          1
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00000000002a8000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffffffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          296
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00000000749ac000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffffffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          296
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00000000749ac000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffffffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W64.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Generic.4!c
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Gen:Variant.Lazy.614752
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    Unsafe
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Gen:Variant.Lazy.614752
                                    
                                


                            

                        

                            

                                

                                    CrowdStrike
                                    win/malicious_confidence_70% (D)
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Gen:Variant.Lazy.614752
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Lazy.D96160
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Win64/GenKryptik.HCVV
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    MalwareX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    UDS:DangerousObject.Multi.Generic
                                    
                                


                            

                        

                            

                                

                                    Alibaba
                                    Trojan:Win64/GenKryptik.44c78615
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Gen:Variant.Lazy.614752
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Trojan.Kryptik@AI.83 (RDML:TCk/Ad+mIpcnhQMi7+ft1A)
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Gen:Variant.Lazy.614752 (B)
                                    
                                


                            

                        

                            

                                

                                    McAfeeD
                                    ti!2BE1A242289C
                                    
                                


                            

                        

                            

                                

                                    CTX
                                    exe.trojan.lazy
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Generic Reputation PUA (PUA)
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Gen:Variant.Lazy.614752
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    Kingsoft
                                    Win32.Troj.Unknown.a
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Trojan.Win64.Kryptik.sa
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Program:Win32/Wacapew.C!ml
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Gen:Variant.Lazy.614752
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!A917B1D8182A
                                    
                                


                            

                        

                            

                                

                                    DeepInstinct
                                    MALICIOUS
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Generic.Malware/Suspicious
                                    
                                


                            

                        

                            

                                

                                    Ikarus
                                    Win32.Outbreak
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/Chgt.AD
                                    
                                


                            

                        

                            

                                

                                    MaxSecure
                                    Trojan.Malware.300983.susgen
                                    
                                


                            

                        

                            

                                

                                    AVG
                                    MalwareX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    alibabacloud
                                    Trojan[stealer]:Win/Wacapew.C9nj