popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

random.exe

Emotet Gen1 Generic Malware Malicious Library UPX Anti_VM PE64 MZP Format PE File OS Processor Check PE32 DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Jan. 27, 2025, 4:42 p.m. Jan. 27, 2025, 4:53 p.m.
Size 3.5MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 2a64314ecf5802e9e0edb3cd12d25991
SHA256 bb2d3b77e3a123d3525ec2835a10f674ef9e0773d4f1e02e4045cce4396c8899
CRC32 D22D1D1A
ssdeep 98304:4t/pHrnjRgo4H0O47iQd9w3M7QX8DW1dn+jr:c/dnjRHPNsc7Q2jr
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • Win32_Trojan_Emotet_2_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • mzp_file_format - MZP(Delphi) file format
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
random+0x3e35a @ 0x43e35a
random+0x3d76b @ 0x43d76b
random+0x954ee @ 0x4954ee
random+0x8112a @ 0x48112a
random+0x993b3 @ 0x4993b3
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: f7 37 89 06 e9 dd 07 00 00 8b 06 33 d2 8a 17 8b
exception.symbol: random+0x3b64f
exception.instruction: div dword ptr [edi]
exception.module: random.tmp
exception.exception_code: 0xc0000094
exception.offset: 243279
exception.address: 0x43b64f
registers.esp: 1637772
registers.edi: 31297656
registers.eax: 6113562
registers.ebp: 1637852
registers.edx: 0
registers.ebx: 1
registers.esi: 31297648
registers.ecx: 31297656
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 40960
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00401000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1000
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040f000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 296
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0000000004ba0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\is-5PM43.tmp\_isetup\_iscrypt.dll
file C:\Users\test22\AppData\Local\Temp\is-5PM43.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Cross-platform Player 3.99\crossplatformplayer.exe
file C:\Users\test22\AppData\Local\Temp\is-AK5D8.tmp\random.tmp
file C:\Users\test22\AppData\Local\Temp\is-5PM43.tmp\_isetup\_shfoldr.dll
file C:\Users\test22\AppData\Local\Temp\is-5PM43.tmp\_isetup\_iscrypt.dll
Time & API Arguments Status Return Repeated

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000001
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
base_handle: 0x80000001
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
2 0

RegOpenKeyExA

 regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
base_handle: 0x80000002
key_handle: 0x00000000
options: 0
access: 0x00000008
regkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Cross-platform Player_is1
2 0
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Ekstak.4!c
Cynet Malicious (score: 99)
Skyhigh BehavesLike.Win32.ObfuscatedPoly.wc
McAfee Artemis!2A64314ECF58
Cylance Unsafe
VIPRE Gen:Heur.Munp.1
CrowdStrike win/grayware_confidence_70% (W)
BitDefender Gen:Heur.Munp.1
Arcabit Trojan.Munp.1
Symantec Trojan Horse
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDropper.Agent.SLC
Avast FileRepMalware [Adw]
Kaspersky Trojan.Win32.Ekstak.azmnb
MicroWorld-eScan Gen:Heur.Munp.1
Emsisoft Gen:Heur.Munp.1 (B)
F-Secure Heuristic.HEUR/AGEN.1375784
DrWeb Trojan.MulDrop29.2217
TrendMicro Trojan.Win32.AMADEY.YXFAZZ
McAfeeD ti!BB2D3B77E3A1
CTX exe.trojan.agen
Sophos Generic Reputation PUA (PUA)
FireEye Gen:Heur.Munp.1
Webroot W32.Malware.gen
Avira HEUR/AGEN.1375784
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Trojan.Ekstak.azmnb
GData Win32.Trojan.Kryptik.AVPEO0
AhnLab-V3 Malware/Win.Generic.C5722275
DeepInstinct MALICIOUS
Ikarus Trojan.Win32.Crypt
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXFAZZ
Tencent Win32.Trojan.Agen.Osmw
huorong HEUR:TrojanDropper/Agent.t
Fortinet Riskware/Agent
AVG FileRepMalware [Adw]
alibabacloud Trojan[dropper]:Win/Wacatac.B9nj