popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

update.exe

Generic Malware Malicious Library UPX PE File dll OS Processor Check PE32 DLL DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 18, 2025, 5:29 p.m. Feb. 18, 2025, 5:33 p.m.
Size 71.0MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 0c1d951bd8edb3b7ee31d34c543c3db3
SHA256 f38ecda755dc8ba8825fb364c2f24ca53ed33ec01332238ac074afede77edb6b
CRC32 0E69F2A7
ssdeep 786432:ZFNLpFCkXnOgD/+BHmvWvzIivUGMjNV5A+TubYBoNVHQmb5YNyzombOn5PKNRYAn:ZFd+kXOgDg6AvMLv/aDrHQQYNEbffV
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
packer Armadillo v1.71
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x733d1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73341000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73304000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x733d2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x1001c000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x75511000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2660
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72ac1000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\GL_500.EXE
file C:\Users\test22\AppData\Local\Temp\GLJFD1D.tmp
file C:\Users\test22\AppData\Local\Temp\GLCFD0D.tmp
file C:\Users\test22\AppData\Local\Temp\GL_500.EXE
file C:\Users\test22\AppData\Local\Temp\GLH106.tmp
file C:\Users\test22\AppData\Local\Temp\GLH30B.tmp