Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 8, 2025, noon	March 8, 2025, 12:04 p.m.

Size	286.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`4ca928ae23fcfa668b951b98f847a10c`
SHA256	`9e6aef22dddfad9f4f3e2b478c59e5091233270da722712011011df2b6cf2ac0`
CRC32	`9A613884`
ssdeep	`6144:t/Juw3FOBVEqLsGIfkSKM6riUCxaKP6aAON2kQxQxQMMJzCWOG8iZr:t/8w3FCEqI9kSKMmSagPJlx2vJWjGXZr`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

2c723a71-ac56-4b53-8a88-a2422485de90.exe "C:\Users\test22\AppData\Local\Temp\2c723a71-ac56-4b53-8a88-a2422485de90.exe"
2556

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 8, 2025, noon	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 8, 2025, noon	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 8, 2025, noon			0	0
IsDebuggerPresent March 8, 2025, noon			0	0
IsDebuggerPresent March 8, 2025, noon			0	0
IsDebuggerPresent March 8, 2025, noon			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 8, 2025, noon		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.CSS

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00470000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00550000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, noon	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, noon	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x727a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 2162688 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02390000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00530000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0032b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00327000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00325000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00316000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, noon	process_identifier: 2556 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00317000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0003a600', u'virtual_address': u'0x00014000', u'entropy': 7.999218341561572, u'name': u'.CSS', u'virtual_size': u'0x0003a600'}

entropy

7.99921834156

description

A section with a high entropy has been found

entropy

0.819298245614

description

Overall entropy of this PE file is high

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stelpak.4!c
CAT-QuickHeal	Trojan.MSIL
Skyhigh	BehavesLike.Win32.Generic.dc
ALYac	Gen:Variant.Lazy.658915
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Jalapeno.19871
K7GW	Trojan ( 005c27361 )
K7AntiVirus	Trojan ( 005c27361 )
Arcabit	Trojan.Jalapeno.D4D9F
VirIT	Trojan.Win32.GenusT.ERGM
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.ANFM
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Msilzilla-10042543-0
Kaspersky	HEUR:Trojan.MSIL.Stelpak.gen
Alibaba	Trojan:MSIL/Stelpak.0997b584
MicroWorld-eScan	Gen:Variant.Jalapeno.19871
Rising	Malware.Obfus/MSIL@AI.94 (RDM.MSIL2:ucNZSA7mMbU3kczIfOKqBw)
Emsisoft	Gen:Variant.Jalapeno.19871 (B)
F-Secure	Trojan.TR/AD.Nekark.cxkym
McAfeeD	Real Protect-LS!4CA928AE23FC
CTX	exe.trojan.msil
Sophos	Troj/MSIL-THD
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.4ca928ae23fcfa66
Webroot	W32.Malware.gen
Google	Detected
Avira	TR/AD.Nekark.cxkym
Antiy-AVL	RiskWare[Obfuscator]/MSIL.Reactor.a
Kingsoft	MSIL.Trojan.Stelpak.gen
Gridinsoft	Malware.Win32.XWorm.tr
Microsoft	Trojan:MSIL/Remcos.MBV!MTB
GData	Gen:Variant.Jalapeno.19871
Varist	W32/MSIL_Kryptik.LWW.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5736614
McAfee	GenericRXWQ-QK!4CA928AE23FC
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.MSIL
Malwarebytes	Spyware.Lumma
Ikarus	Trojan.MSIL.Crypt
Panda	Trj/Chgt.AD
Tencent	Malware.Win32.Gencirc.10c16915
huorong	Trojan/MSIL.Agent.vl
Fortinet	MSIL/Kryptik.ANFM!tr
AVG	Win32:PWSX-gen [Trj]

2c723a71-ac56-4b53-8a88-a2422485de90

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All