popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

dll007.dll

UPX PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 20, 2024, 9:31 a.m. Nov. 20, 2024, 9:33 a.m.
Size 5.3KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 46ff33dbadc5b36e0c1f1df20eca90a0
SHA256 a3cf86c9d16fe62fa80010395991c72be7be4549641f0565b031144dd26747a5
CRC32 59785478
ssdeep 48:CCy86+Wet9Q/iooHeiefhe+/lSMYEqD6//RQCCzrTEBzlroWFFmT3W0IW9GmxYVt:hy859x0P8MaRCCzr0yrjW0IOGm2VH1
Yara
  • IsDLL - (no description)
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
packer Armadillo v1.xx - v2.xx
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74502000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74490000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74461000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74361000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x741c1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x752e1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 840
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75931000
process_handle: 0xffffffff
1 0 0
Bkav W32.FamVT.DebrisA.Worm
Lionic Worm.Win32.Debris.tsC7
tehtris Generic.Malware
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Agent.WL
Skyhigh BehavesLike.Win32.Worm.zt
ALYac Gen:Variant.Barys.381856
Cylance Unsafe
VIPRE Gen:Variant.Barys.381856
Sangfor Suspicious.Win32.Save.ins
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Barys.381856
K7GW EmailWorm ( 0040f5281 )
K7AntiVirus EmailWorm ( 0040f5281 )
Arcabit Trojan.Barys.D5D3A0
Baidu Win32.Worm.Bundpil.y
VirIT Worm.Win32.Generic.GRN
Symantec Downloader.Dromedan
Elastic malicious (high confidence)
ESET-NOD32 Win32/Bundpil.AO
APEX Malicious
Avast Win32:Sg-I [Trj]
ClamAV Win.Adware.Downware-251
Kaspersky Worm.Win32.Debris.b
Alibaba Malware:Win32/km_2a460.None
NANO-Antivirus Trojan.Win32.Debris.cqkxyu
SUPERAntiSpyware Trojan.Agent/Gen-Crypt
MicroWorld-eScan Gen:Variant.Barys.381856
Rising Worm.Gamarue!1.9CB3 (CLASSIC)
Emsisoft Gen:Variant.Barys.381856 (B)
F-Secure Worm.WORM/Gamarue.511265
DrWeb Trojan.MulDrop4.25343
Zillya Worm.DebrisGen.Win32.11
TrendMicro WORM_GAMARUE.SML
McAfeeD ti!A3CF86C9D16F
CTX dll.worm.bundpil
Sophos W32/Gamarue-BL
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.46ff33dbadc5b36e
Jiangmin Trojan/Generic.axdgt
Webroot W32.Worm.Gen
Google Detected
Avira WORM/Gamarue.511265
Antiy-AVL Worm/Win32.Debris
Kingsoft Win32.Troj.Bundpil.AO
Gridinsoft Worm.Win32.Autorun.sa
Xcitium Worm.Win32.Bundpil.AH@4yjufs
Microsoft TrojanDownloader:Win32/Andromeda!pz
ZoneAlarm Worm.Win32.Debris.b
GData Win32.Worm.Bundpil.B