popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

3.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 3, 2025, 10:05 a.m. Feb. 3, 2025, 10:20 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 4baf0b102a3fae3a35c57173c191fca1
SHA256 61a0d401d5192d6d72745bf244f83d777aa30351319a2719e52b007547e4e81b
CRC32 9BBC471E
ssdeep 24576:EX/DC7Vpa1T/ZNtWksbTqz5X9C0nlDvKUbScLcBDvSHnI06JQlZgzTyw9R:EX/ua178nwtCElj6ccRSo06oZgnyY
PDB Path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
resource name None
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000b0160 size 0x000000bc
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000b0160 size 0x000000bc
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x000b021c size 0x000000ba
section {u'size_of_data': u'0x000c4e00', u'virtual_address': u'0x00058000', u'entropy': 7.064819051900886, u'name': u'.rsrc', u'virtual_size': u'0x000c4cec'} entropy 7.0648190519 description A section with a high entropy has been found
entropy 0.693527080581 description Overall entropy of this PE file is high
Lionic Trojan.Win32.Agentb.X!c
Cynet Malicious (score: 99)
CTX exe.trojan.agentb
CAT-QuickHeal Trojan.Agentb
ALYac Gen:Variant.Jaik.264595
Cylance Unsafe
VIPRE Gen:Variant.Jaik.264595
Sangfor Trojan.Win32.Agent.Aevi
CrowdStrike win/malicious_confidence_90% (W)
Alibaba Trojan:Win32/Generic.9b2d9704
K7GW Trojan ( 005c00a71 )
K7AntiVirus Trojan ( 005c00a71 )
Arcabit Trojan.Jaik.D40993
Symantec Trojan.Gen.MBT
Elastic Windows.Trojan.TwistedTinsel
ESET-NOD32 a variant of Win32/Agent.AHCE
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Agentb.gen
BitDefender Gen:Variant.Jaik.264595
NANO-Antivirus Trojan.Win32.Babar.kvlmgd
MicroWorld-eScan Gen:Variant.Jaik.264595
Rising Trojan.Sabsik!8.128D4 (TFE:5:9u6a2PLrbiL)
Emsisoft Gen:Variant.Jaik.264595 (B)
F-Secure Trojan.TR/Agent.odjev
Zillya Trojan.Agent.Win32.4128111
McAfeeD ti!61A0D401D519
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.4baf0b102a3fae3a
Webroot Win.Trojan.Babar
Google Detected
Avira TR/Agent.odjev
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Trojan.Agentb.gen
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Malware@#1ikcz4s9joqt9
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Jaik.264595
Varist W32/ABTrojan.WLJG-6529
AhnLab-V3 Dropper/Win.Generic.R689899
VBA32 BScope.Trojan.Downloader
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.1163237881
Ikarus Trojan.Win32.Agent
TrendMicro-HouseCall TROJ_GEN.R002H09AQ25
Tencent Malware.Win32.Gencirc.10c0a4c2
Yandex Trojan.Agent!ut1/lfR1OZ8
MaxSecure Trojan.Malware.324987160.susgen
Fortinet W32/Agent.AHCE!tr
Panda Trj/Chgt.AD