popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

41.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Feb. 3, 2025, 10:06 a.m. Feb. 3, 2025, 10:17 a.m.
Size 1.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 fe39ef84af0348989582186bd57ba303
SHA256 3097ce3a1e4e4d755bd501e801d0e56fd4bf38b97805f6e62ce149acbe0f75a4
CRC32 2AF6261B
ssdeep 24576:FX/DC7Vpa1T/qqZQ0ob5Bc/wXmSRLGTy:FX/ua17qqZQb5eWQy
PDB Path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
resource name None
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009ae04 size 0x00000048
name RT_MENU language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009ae04 size 0x00000048
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009b324 size 0x000000fa
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009b324 size 0x000000fa
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009b324 size 0x000000fa
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009b324 size 0x000000fa
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0009bd28 size 0x000000a2
section {u'size_of_data': u'0x000b0800', u'virtual_address': u'0x00058000', u'entropy': 7.498804588443545, u'name': u'.rsrc', u'virtual_size': u'0x000b07f0'} entropy 7.49880458844 description A section with a high entropy has been found
entropy 0.669829222011 description Overall entropy of this PE file is high
Lionic Trojan.Win32.Agentb.X!c
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Ghanarava.17385338917ba303
Skyhigh Artemis!Trojan
ALYac Gen:Variant.Jaik.263476
Cylance Unsafe
VIPRE Gen:Variant.Jaik.263476
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Jaik.263476
K7GW Trojan ( 005c00a71 )
K7AntiVirus Trojan ( 005c00a71 )
Arcabit Trojan.Jaik.D40534
Symantec Trojan.Gen.MBT
Elastic Windows.Trojan.TwistedTinsel
ESET-NOD32 a variant of Win32/Agent.AHCE
Avast Win32:Agent-BDDR [Drp]
Kaspersky HEUR:Trojan.Win32.Agentb.gen
Alibaba Trojan:Win32/Generic.7b21c7ec
NANO-Antivirus Trojan.Win32.Babar.kvlmgd
MicroWorld-eScan Gen:Variant.Jaik.263476
Rising Trojan.Sabsik!8.128D4 (TFE:5:9u6a2PLrbiL)
Emsisoft Gen:Variant.Jaik.263476 (B)
F-Secure Trojan.TR/Agent.ociqs
Zillya Trojan.Agent.Win32.4128111
McAfeeD ti!3097CE3A1E4E
CTX exe.trojan.generic
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.fe39ef84af034898
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Agent.ociqs
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Trojan.Agentb.gen
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Malware@#1gx2vyidfzgng
Microsoft Program:Win32/Multiverze
ViRobot Trojan.Win.Z.Agent.1087152
GData Gen:Variant.Jaik.263476
Varist W32/ABTrojan.JNUK-3391
AhnLab-V3 Dropper/Win.Generic.R689899
McAfee Artemis!FE39EF84AF03
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Downloader
Malwarebytes Malware.AI.1163237881
Ikarus Trojan.Win32.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H09AO25
Tencent Malware.Win32.Gencirc.10c0a4c2