popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Metin2Release.exe

Generic Malware Hide_EXE Malicious Library UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Feb. 26, 2025, 10:22 a.m. Feb. 26, 2025, 10:23 a.m.
Size 6.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 5d155e2650319956e20fb581e6542f3a
SHA256 00a571dd44f51629d22b28db2ec2f39c5a4314ecd00c06f1ce42107db2040d10
CRC32 EED2B1C9
ssdeep 98304:Zl1g7/lqLxgd0ikYNK33uxr4HGbhZOOqkfhPlE5q4l7ij:Z8lqLxakYNgFmbBhdl4l7K
PDB Path E:\m2 server extra\Santana_SF_08_02_2024\dy_client_source\VSFiles\UserInterface\Release\Metin2Release.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • hide_executable_file - Hide executable file
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path E:\m2 server extra\Santana_SF_08_02_2024\dy_client_source\VSFiles\UserInterface\Release\Metin2Release.pdb
section .data1
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_CURSOR language LANG_KOREAN filetype AmigaOS bitmap font sublanguage SUBLANG_KOREAN offset 0x006919e0 size 0x00000cac
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_ICON language LANG_KOREAN filetype dBase IV DBT of @.DBF, block length 4096, next free block index 40, next free block 4282795590, next used block 4282795590 sublanguage SUBLANG_KOREAN offset 0x006abec0 size 0x000010a8
name RT_DIALOG language LANG_KOREAN filetype data sublanguage SUBLANG_KOREAN offset 0x00689fc0 size 0x000000c0
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x006ad230 size 0x00000074
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x006ad230 size 0x00000074
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x006ad230 size 0x00000074
name RT_STRING language LANG_CHINESE filetype data sublanguage SUBLANG_CHINESE_SIMPLIFIED offset 0x006ad230 size 0x00000074
name RT_GROUP_CURSOR language LANG_KOREAN filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN offset 0x00692690 size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN offset 0x00692690 size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN offset 0x00692690 size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN offset 0x00692690 size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN offset 0x00692690 size 0x00000014
name RT_GROUP_CURSOR language LANG_KOREAN filetype Lotus unknown worksheet or configuration, revision 0x1 sublanguage SUBLANG_KOREAN offset 0x00692690 size 0x00000014
VBA32 BScope.Trojan.Khalesi