Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 31, 2025, 1:29 p.m.	Jan. 31, 2025, 1:31 p.m.

Size	1.3MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a6d3322c4eb7ecef7a01647c920d1c2a`
SHA256	`b2abdb37479f1f2f23509709b38a89a17896f1b8ae8519a29b8acc1ee7bd7d10`
CRC32	`CBD99624`
ssdeep	`24576:DX/DC7Vpa1T/AtLpwUtLpwuFwLiIiaMZzt1mTCMYNe5Yp27cTy:DX/ua17AtLVtLZwLn+n1IF5YW+y`
PDB Path	G:\ç®å½\2025å·¥ä½ç«\ä¸»æ§å·¥ç¨\ä¸»æ§ä¿®å¤ä¸çº¿å\shellcode\æ³¨å¥èªèº«è¿ç¨\Release\æ³¨å¥èªèº«è¿ç¨.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 31, 2025, 1:29 p.m.			0	0

pdb_path

resource name

None

section

{u'size_of_data': u'0x000e9a00', u'virtual_address': u'0x00058000', u'entropy': 6.802649301094691, u'name': u'.rsrc', u'virtual_size': u'0x000e9a00'}

entropy

6.80264930109

description

A section with a high entropy has been found

entropy

0.72865497076

description

Overall entropy of this PE file is high

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Babar.4!c
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Ghanarava.17382431830d1c2a
Skyhigh	BehavesLike.Win32.Dropper.th
ALYac	Gen:Variant.Babar.540722
Cylance	Unsafe
VIPRE	Gen:Variant.Jaik.264998
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jaik.264998
K7GW	Trojan ( 005c00a71 )
K7AntiVirus	Trojan ( 005c00a71 )
Arcabit	Trojan.Jaik.D40B26
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Trojan.TwistedTinsel
ESET-NOD32	a variant of Win32/Agent.AHCE
APEX	Malicious
Avast	Win32:Agent-BDDR [Drp]
Kaspersky	HEUR:Trojan.Win32.Agentb.gen
Alibaba	Trojan:Win32/Generic.19eb4cff
NANO-Antivirus	Trojan.Win32.Babar.kvlmgd
MicroWorld-eScan	Gen:Variant.Jaik.264998
Rising	Trojan.Sabsik!8.128D4 (TFE:5:9u6a2PLrbiL)
Emsisoft	Gen:Variant.Jaik.264998 (B)
F-Secure	Trojan.TR/Dropper.Gen
Zillya	Trojan.Agent.Win32.4128111
McAfeeD	ti!B2ABDB37479F
CTX	exe.trojan.generic
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.a6d3322c4eb7ecef
Webroot	Win.Trojan.Babar
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	GrayWare/Win32.Wacapew
Kingsoft	Win32.Trojan.Agentb.gen
Gridinsoft	Trojan.Win32.Agent.sa
Xcitium	Malware@#1mxmlel10uc6g
Microsoft	Trojan:Win32/Multiverze
GData	Gen:Variant.Jaik.264998
Varist	W32/ABTrojan.WJSZ-8133
AhnLab-V3	Dropper/Win.Generic.R689797
McAfee	Artemis!A6D3322C4EB7
DeepInstinct	MALICIOUS
VBA32	BScope.Trojan.Downloader
Malwarebytes	Malware.AI.1163237881
Ikarus	Trojan.Win32.Agent
Panda	Trj/Agent.ASH
Tencent	Malware.Win32.Gencirc.10c0a4c2

29.exe