Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 18, 2025, 6:20 p.m.	Feb. 18, 2025, 6:25 p.m.

Size	3.2MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`c1ab7781370290e0f7d8ea98705e8c84`
SHA256	`17bc5b41b35d894b37224e5daa66e2c7326e10a8309e299af122c6602afc953e`
CRC32	`29825802`
ssdeep	`98304:fLpbNHeg4DbSYB5rkUQD4xxmIQV0ymRNmQP:fLpbN+g4n/kUQ4/QVoiQP`
PDB Path	C:\AdminC6\Workspace\687321993\Project\Debug\Project.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
104.21.73.114	Active	Moloch
185.143.228.176	Active	Moloch

No Suricata Alerts

No Suricata TLS

pdb_path

C:\AdminC6\Workspace\687321993\Project\Debug\Project.pdb

section

.textbss

packer

Microsoft Visual C++ V8.0 (Debug)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Feb. 14, 2025, 11:14 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01830000 process_handle: 0xffffffff	1	0	0
NtProtectVirtualMemory Feb. 14, 2025, 11:14 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01831000 process_handle: 0xffffffff	1	0	0

host	104.21.73.114
host	185.143.228.176

Cynet	Malicious (score: 99)
CTX	exe.trojan.generic
Skyhigh	Artemis!Trojan
ALYac	Trojan.GenericKD.75864806
Cylance	Unsafe
VIPRE	Trojan.GenericKD.75864806
CrowdStrike	win/malicious_confidence_70% (W)
Alibaba	Trojan:Win32/Kryptik.4509b00d
Arcabit	Trojan.Generic.D4859AE6
VirIT	Trojan.Win32.Genus.XOG
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Kryptik.HYTD
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.75864806
MicroWorld-eScan	Trojan.GenericKD.75864806
Rising	Trojan.ShellCodeRunner!1.1275A (CLASSIC)
Emsisoft	Trojan.GenericKD.75864806 (B)
F-Secure	Trojan.TR/Crypt.Agent.lllso
McAfeeD	ti!17BC5B41B35D
FireEye	Trojan.GenericKD.75864806
Google	Detected
Avira	TR/Crypt.Agent.lllso
Antiy-AVL	GrayWare/Win32.Wacapew
Kingsoft	Win32.Troj.Unknown.a
Gridinsoft	Trojan.Win32.Generic.cl
Xcitium	Malware@#2m645ivd7rppd
Microsoft	Program:Win32/Wacapew.C!ml
GData	Trojan.GenericKD.75864806
AhnLab-V3	Malware/Win.Generic.C5730210
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.MalPack.Generic
Ikarus	Trojan-Spy.Win32.LummaStealer
Tencent	Win32.Trojan.Kryptik.Njgl
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/PossibleThreat
Panda	Trj/Chgt.AD

main.exe