popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Offnewhere.exe

Generic Malware Malicious Library UPX Malicious Packer PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 7, 2024, 12:59 p.m. Nov. 7, 2024, 1:05 p.m.
Size 429.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c07e06e76de584bcddd59073a4161dbb
SHA256 cf67a50598ee170e0d8596f4e22f79cf70e1283b013c3e33e36094e1905ba8d9
CRC32 9136006C
ssdeep 12288:H/RCVy1xtsmUQTXNujba1fM0HRm77vRMmg:ntsouyBM+RmnRLg
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
185.215.113.36 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2568
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2568
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x01fb0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1452
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004730000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
file C:\Users\test22\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Users\test22\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
parameters:
filepath: C:\Users\test22\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
1 1 0
host 185.215.113.36
file C:\ProgramData\AVAST Software
file C:\ProgramData\Avira
file C:\ProgramData\Kaspersky Lab
file C:\ProgramData\Panda Security
file C:\ProgramData\Bitdefender
file C:\ProgramData\AVG
file C:\ProgramData\Doctor Web
file C:\Windows\Tasks\Gxtuum.job
dead_host 185.215.113.36:80
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Amadey.a!c
MicroWorld-eScan Trojan.GenericKD.74672006
CTX exe.trojan.amadey
CAT-QuickHeal Trojandownloader.Deyma
ALYac Gen:Variant.Doina.48774
Cylance Unsafe
VIPRE Trojan.GenericKD.74672006
CrowdStrike win/malicious_confidence_100% (D)
Alibaba TrojanDownloader:Win32/Deyma.16768b2e
K7GW Trojan-Downloader ( 005790d31 )
K7AntiVirus Trojan-Downloader ( 005790d31 )
VirIT Trojan.Win32.Genus.WWP
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.A
APEX Malicious
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.GenericKD.74672006
NANO-Antivirus Trojan.Win32.AVI.ktfoir
Rising Downloader.Amadey!8.125AC (TFE:5:NOjn92KW7VV)
Emsisoft Trojan.GenericKD.74672006 (B)
DrWeb Trojan.MulDrop28.36200
Zillya Downloader.Amadey.Win32.481
McAfeeD Real Protect-LS!C07E06E76DE5
Trapmine malicious.moderate.ml.score
Sophos Troj/Amadey-O
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.c07e06e76de584bc
Google Detected
Avira DR/AVI.Agent.zxrkv
Antiy-AVL Trojan[Downloader]/Win32.Deyma
Kingsoft Win32.Trojan-Downloader.Deyma.gen
Gridinsoft Trojan.Win32.Amadey.tr
Xcitium Malware@#1yo3drjdyrl54
Arcabit Trojan.Generic.D4736786
ZoneAlarm HEUR:Trojan-Downloader.Win32.Deyma.gen
Microsoft Trojan:Win32/Multiverze
Varist W32/Agent.DJJ.gen!Eldorado
AhnLab-V3 Dropper/Win.Generic.C5689800
VBA32 BScope.TrojanDownloader.Deyma
DeepInstinct MALICIOUS
Malwarebytes Trojan.MalPack
Ikarus Trojan.Spy.Stealer
Tencent Malware.Win32.Gencirc.11caf0b6
Yandex Trojan.DL.Amadey!l2iDsWs+1R8
Fortinet W32/Amadey.A!tr.dldr
Panda Trj/Chgt.AD