Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

MAGNIFICENT_MAILBOX.exe

Malicious Packer UPX PE64 PE File

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Feb. 19, 2025, 11:20 a.m.	Feb. 19, 2025, 11:37 a.m.

Size	15.0MB
Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5	`a1d8035b93923215c7d7cbc17e735deb`
SHA256	`5a37021cd9626f6b48a8cf31c79d350946a5ac9dd94b96f51e121b991b5353dc`
CRC32	`06EB702F`
ssdeep	`98304:L3SxOjhGAjzbKwCdgVNIBh3dzU5DqcLbDudEo9GWc5V/by:DSSX2+VNIBphU5mcLvo9GW6xy`
Yara	PE_Header_Zero - PE File Signature Malicious_Packer_Zero - Malicious Packer IsPE64 - (no description) UPX_Zero - UPX packed file

MAGNIFICENT_MAILBOX.exe "C:\Users\test22\AppData\Local\Temp\MAGNIFICENT_MAILBOX.exe"
2620

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
193.3.23.122	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Feb. 19, 2025, 11:13 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.symtab

Communicates with host for which no DNS query was performed (1 event)

host

193.3.23.122

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress Feb. 19, 2025, 11:13 a.m.	ordinal: 0 function_address: 0x000007fefd6b7a50 function_name: wine_get_version module: ntdll module_address: 0x0000000076d30000		-1073741511	0

Connects to IP addresses that are no longer responding to requests (legitimate services will remain up-and-running usually) (3 events)

dead_host	192.168.56.101:49164
dead_host	192.168.56.101:49161
dead_host	193.3.23.122:8888