popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

GI59vO6.exe

Emotet Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Dec. 4, 2024, 4:15 p.m. Dec. 4, 2024, 4:17 p.m.
Size 5.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 71c8588c96e879748f4c320c9b4aeec2
SHA256 a4bb60772446f2cd2f7629574bbf5702c35ce2afcf6e4b3a3d157281cecc7234
CRC32 496C6D03
ssdeep 98304:hX/XSdTQkJrp1n2D9yHPR7yt9b8wt9OqcnXBM:hXaJSD0HyJdt9uxM
PDB Path D:\Projects\GRAFU_SHED\Fusion_F_3\Fusion\Release\Fusion.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\GRAFU_SHED\Fusion_F_3\Fusion\Release\Fusion.pdb
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 348160
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00360000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 851968
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02610000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2560
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2560
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76f70000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x000a6600', u'virtual_address': u'0x0051d000', u'entropy': 7.032908664977128, u'name': u'.reloc', u'virtual_size': u'0x000a6600'} entropy 7.03290866498 description A section with a high entropy has been found
Elastic malicious (high confidence)
Kaspersky UDS:DangerousObject.Multi.Generic
McAfeeD ti!A4BB60772446
Sophos Mal/Generic-S
Kingsoft Win32.Troj.Unknown.a
Gridinsoft Spy.Win32.Gen.tr
Microsoft Program:Win32/Wacapew.C!ml
McAfee Artemis!71C8588C96E8
VBA32 BScope.Trojan.MTA
Paloalto generic.ml
alibabacloud Backdoor