popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

6.exe

Generic Malware Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 3, 2025, 10:06 a.m. Feb. 3, 2025, 10:14 a.m.
Size 878.4KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 ebb6e511ac2ce8c76dbe6fd308eb27ec
SHA256 031995c8c954676707cf62bee1a1412c4332c82dcd0ee6311b7b5e2a0e73573f
CRC32 88D0D837
ssdeep 12288:OoA/DC7VtVyUHa1TQuI1O7KYLDIyr4ajX0TVuNbiRWclX4pHxismxSeT/L10z:OX/DC7Vpa1T/7K5a7n2RWmX4xhm/TTyz
PDB Path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
pdb_path G:\目录\2025工作站\主控工程\主控修复上线包\shellcode\注入自身进程\Release\注入自身进程.pdb
resource name None
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005ba94 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005ba94 size 0x00000144
name RT_BITMAP language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0005ba94 size 0x00000144
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006cf04 size 0x00000034
name RT_DIALOG language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006cf04 size 0x00000034
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x0006d874 size 0x000001a6
section {u'size_of_data': u'0x00082600', u'virtual_address': u'0x00058000', u'entropy': 7.890194735156755, u'name': u'.rsrc', u'virtual_size': u'0x0008250c'} entropy 7.89019473516 description A section with a high entropy has been found
entropy 0.599769982749 description Overall entropy of this PE file is high
Lionic Trojan.Win32.Agentb.X!c
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Agentb
ALYac Gen:Variant.Jaik.263476
Cylance Unsafe
VIPRE Gen:Variant.Jaik.263476
Sangfor Trojan.Win32.Agent.Aifj
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Jaik.263476
K7GW Trojan ( 005c00a71 )
K7AntiVirus Trojan ( 005c00a71 )
Arcabit Trojan.Jaik.D40534
Symantec Trojan.Gen.MBT
Elastic Windows.Trojan.TwistedTinsel
ESET-NOD32 a variant of Win32/Agent.AHCE
Avast Win32:Agent-BDDR [Drp]
Kaspersky HEUR:Trojan.Win32.Agentb.gen
Alibaba Trojan:Win32/Generic.55d91b25
NANO-Antivirus Trojan.Win32.Babar.kvlmgd
MicroWorld-eScan Gen:Variant.Jaik.263476
Rising Trojan.Sabsik!8.128D4 (TFE:5:9u6a2PLrbiL)
Emsisoft Gen:Variant.Jaik.263476 (B)
F-Secure Trojan.TR/Agent.htebu
Zillya Trojan.Agent.Win32.4128111
McAfeeD ti!031995C8C954
CTX exe.trojan.generic
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Gen:Variant.Jaik.263476
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Agent.htebu
Antiy-AVL GrayWare/Win32.Wacapew
Kingsoft Win32.Trojan.Agentb.gen
Gridinsoft Ransom.Win32.Wacatac.sa
Xcitium Malware@#113vbi47umtkr
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Jaik.263476
Varist W32/ABTrojan.LTEJ-8944
AhnLab-V3 Dropper/Win.Generic.R689899
McAfee Artemis!EBB6E511AC2C
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Downloader
Malwarebytes Malware.AI.1163237881
Ikarus Trojan.Win32.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002H09AP25
Tencent Malware.Win32.Gencirc.10c0a4c2
Yandex Trojan.Agent!ut1/lfR1OZ8
MaxSecure Trojan.Malware.324987160.susgen