popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

2.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Feb. 3, 2025, 10:04 a.m. Feb. 3, 2025, 10:35 a.m.
Size 1.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 712ad2871de1468749729ac94f8d9587
SHA256 4883280412e4f66f70ab0c3ab56e4c57872e2957679ec05c2f6a2a97ecaf8884
CRC32 A070BD2F
ssdeep 24576:5X/DC7Vpa1T/u863shP1e4wROEvfjNk0USu4Tyg:5X/ua17u863q13UDXjNk0nbyg
PDB Path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
resource name None
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bf4b0 size 0x000000be
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bf4b0 size 0x000000be
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfbe4 size 0x000000a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfcbc size 0x000000c4
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000bfcbc size 0x000000c4
section {u'size_of_data': u'0x000d4800', u'virtual_address': u'0x00058000', u'entropy': 7.025076506732082, u'name': u'.rsrc', u'virtual_size': u'0x000d4794'} entropy 7.02507650673 description A section with a high entropy has been found
entropy 0.709515859766 description Overall entropy of this PE file is high
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Agentb.X!c
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Agentb
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Jaik.264595
Cylance Unsafe
VIPRE Gen:Variant.Jaik.264595
Sangfor Trojan.Win32.Agent.Ag9o
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Jaik.264595
K7GW Trojan ( 005c00a71 )
K7AntiVirus Trojan ( 005c00a71 )
Arcabit Trojan.Jaik.D40993
Symantec Trojan.Gen.MBT
Elastic Windows.Trojan.TwistedTinsel
ESET-NOD32 a variant of Win32/Agent.AHCE
Avast Win32:Agent-BDDR [Drp]
Kaspersky HEUR:Trojan.Win32.Agentb.gen
Alibaba Trojan:Win32/Generic.fa219977
NANO-Antivirus Trojan.Win32.Babar.kvlmgd
MicroWorld-eScan Gen:Variant.Jaik.264595
Rising Trojan.Sabsik!8.128D4 (TFE:5:9u6a2PLrbiL)
Emsisoft Gen:Variant.Jaik.264595 (B)
F-Secure Trojan.TR/Agent.qevxi
Zillya Trojan.Agent.Win32.4128111
McAfeeD ti!4883280412E4
CTX exe.trojan.generic
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.712ad2871de14687
Webroot Win.Trojan.Babar
Google Detected
Avira TR/Agent.qevxi
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Trojan.Agentb.gen
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Jaik.264595
Varist W32/ABTrojan.ZSMD-8405
AhnLab-V3 Dropper/Win.Generic.R689899
McAfee Artemis!712AD2871DE1
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Downloader
Malwarebytes Malware.AI.1163237881
Ikarus Trojan.Win32.Agent
TrendMicro-HouseCall TROJ_GEN.R002H09AU25
Tencent Malware.Win32.Gencirc.10c0a4c2
Yandex Trojan.Agent!ut1/lfR1OZ8
MaxSecure Trojan.Malware.326043986.susgen