popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cabalmain.exe

Gen1 Generic Malware EnigmaProtector Themida UPX Downloader Antivirus Malicious Packer Malicious Library Anti_VM ftp PE File dll OS Processor Check PE32 DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 20, 2025, 12:21 p.m. Feb. 20, 2025, 12:25 p.m.
Size 44.4MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b66b3067ed8dc4b46efc17cf619a7626
SHA256 b8d000c3a1bffd4e429c70f8d7ff1f46a0e391bb8f9b823674473f5686991529
CRC32 EE68B493
ssdeep 786432:un+hk3ne9HPNCdzj+6ARJnQ4UpEQRCjShkCVYVJN+:NGne9HP+m6AbnQ4UvRmSeCun
Yara
  • themida_packer - themida packer
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • ftp_command - ftp command
  • Antivirus - Contains references to security software
  • Network_Downloader - File Downloader
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • DllRegisterServer_Zero - execute regsvr32.exe
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • EnigmaProtector_IN - EnigmaProtector

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .NewIT
section .newimp
section .enigma1
section .enigma2
name RT_VERSION language LANG_KOREAN filetype PGP symmetric key encrypted data - Plaintext or unencrypted data sublanguage SUBLANG_KOREAN offset 0x00ceeb54 size 0x0000028c
section {u'size_of_data': u'0x01f30000', u'virtual_address': u'0x00d06000', u'entropy': 7.400679349631002, u'name': u'.enigma1', u'virtual_size': u'0x00001000'} entropy 7.40067934963 description A section with a high entropy has been found
entropy 0.70195181994 description Overall entropy of this PE file is high
ALYac Gen:Variant.Giant.Lazy.502
Cylance Unsafe
VIPRE Gen:Variant.Giant.Lazy.502
Sangfor Suspicious.Win32.Save.ins
CrowdStrike win/malicious_confidence_70% (D)
BitDefender Gen:Variant.Giant.Lazy.502
Arcabit Trojan.Giant.Lazy.502
VirIT Trojan.Win32.X-Mazzec.L
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
Avast Win32:Malware-gen
ClamAV Win.Trojan.Generic-10014772-0
MicroWorld-eScan Gen:Variant.Giant.Lazy.502
Emsisoft Gen:Variant.Giant.Lazy.502 (B)
Zillya Trojan.Patched.Win32.156041
McAfeeD ti!B8D000C3A1BF
Trapmine malicious.high.ml.score
CTX exe.unknown.giant
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.b66b3067ed8dc4b4
Webroot W32.Malware.gen
Antiy-AVL Trojan/Win32.Wacatac
Gridinsoft Trojan.Heur!.03052421
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Giant.Lazy.502
AhnLab-V3 Malware/Win.Generic.R566434
DeepInstinct MALICIOUS
VBA32 Trojan.Downloader
Ikarus Trojan.Crypt
MaxSecure Trojan.Malware.296327845.susgen
Fortinet W32/PossibleThreat
AVG Win32:Malware-gen