popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

helps.hta

UPX PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 24, 2025, 1:52 p.m. Jan. 24, 2025, 1:56 p.m.
Size 62.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 407c9a93188dc7088e19d688a589c8c5
SHA256 924c4682daa9e4f5dbb41a71458e6d37a927f86c01465ad209f9c78fe17973da
CRC32 BC7948E8
ssdeep 1536:0DAVfkzHIrV6EG0bd881SvsKjh0uRN4fcezQ0zfIikL:34HIx6g1S3jhhRNHz0zQL
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
idc6.yjzj.org
A 122.114.69.29
122.114.69.29
IP Address Status Action
122.114.69.29 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

packer UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
resource name None
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00032200 size 0x000004e8
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x00032200 size 0x000004e8
name RT_ACCELERATOR language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000326ec size 0x00000008
name None language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000326f8 size 0x0000000a
Time & API Arguments Status Return Repeated

CreateServiceA

 service_start_name:
start_type: 2
password:
display_name: Pfctbe qoiesabe
filepath: C:\Program Files (x86)\Common Files\System\algst.exe
service_name: Uhrwdk oegxpa
filepath_r: C:\Program Files (x86)\Common Files\System\algst.exe
desired_access: 983551
service_handle: 0x004c0bf8
error_control: 0
service_type: 272
service_manager_handle: 0x004c0c98
1 4983800 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000000bc
process_name: taskhost.exe
process_identifier: 804
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: SearchProtocolHost.exe
process_identifier: 2024
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: conhost.exe
process_identifier: 496
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: SearchFilterHost.exe
process_identifier: 316
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: pw.exe
process_identifier: 1704
1 1 0

Process32NextW

 snapshot_handle: 0x000000bc
process_name: algst.exe
process_identifier: 2088
1 1 0
section {u'size_of_data': u'0x0000ea00', u'virtual_address': u'0x00023000', u'entropy': 7.904558996461495, u'name': u'UPX1', u'virtual_size': u'0x0000f000'} entropy 7.90455899646 description A section with a high entropy has been found
entropy 0.959016393443 description Overall entropy of this PE file is high
process algst.exe
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
service_name Uhrwdk oegxpa service_path C:\Program Files (x86)\Common Files\System\algst.exe
dead_host 122.114.69.29:56577
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Farfli.m!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Mauvaise.SL1
Skyhigh BehavesLike.Win32.Generic.kc
Cylance Unsafe
VIPRE Gen:Heur.Mint.Zard.30
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.75526179
K7GW Trojan ( 0053af701 )
K7AntiVirus Trojan ( 0053af701 )
Arcabit Trojan.Mint.Zard.30
Baidu Win32.Trojan.Farfli.t
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Farfli.ATE
APEX Malicious
Avast Win32:Evo-gen [Trj]
ClamAV Win.Trojan.Generic-6305873-0
Kaspersky HEUR:Backdoor.Win32.Generic
Alibaba Backdoor:Win32/Farfli.13f8489b
NANO-Antivirus Trojan.Win32.Dwn.dxihqn
MicroWorld-eScan Trojan.GenericKD.75526179
Rising Trojan.Farfli!8.FF (TFE:5:CQejOpL0yUV)
Emsisoft Trojan.GenericKD.75526179 (B)
DrWeb Trojan.DownLoader16.26781
Zillya Trojan.Farfli.Win32.44655
TrendMicro BKDR_ZEGOST.SM44
McAfeeD ti!924C4682DAA9
Trapmine malicious.moderate.ml.score
CTX exe.trojan.farfli
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.407c9a93188dc708
Jiangmin Backdoor.Generic.bqnp
Google Detected
Antiy-AVL Trojan/Win32.Farfli
Kingsoft malware.kb.b.987
Xcitium TrojWare.Win32.AntiAV.~D@fny3h
Microsoft Trojan:Win32/Farfli!rfn
ViRobot Trojan.Win32.Agent.192512.FD[UPX]
GData Trojan.GenericKD.75526179
Varist W32/ABTrojan.FYFU-9137
AhnLab-V3 Trojan/Win32.Agent.R97143
McAfee Artemis!407C9A93188D
TACHYON Trojan/W32.Agent.188416.BMN
DeepInstinct MALICIOUS
VBA32 BScope.Backdoor.gh0RAT
Malwarebytes MachineLearning/Anomalous.100%