popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

4261683a-d502-4ae4-afca-0498751d574f

Emotet Gen1 Malicious Library UPX AntiDebug PE64 PE File ZIP Format CAB AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 8, 2025, 12:01 p.m. March 8, 2025, 12:26 p.m.
Size 99.5KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 6ca1d8895e299ea630a4673213536564
SHA256 da620174bef1c7f41f581104a7193808d5aba54cf2edde9169c012854795e7f8
CRC32 45DA3343
ssdeep 1536:irae78zjORCDGwfdCSog01313XWs5gZEvw+WPi4UFr6cOyLpSRI:KahKyd2n31/5iEvw+Gi4UYu1SRI
PDB Path wextract.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Win32_Trojan_Emotet_RL_Gen_Zero - Win32 Trojan Emotet
  • CAB_file_format - CAB archive file
  • Win32_Trojan_Gen_1_0904B0_Zero - Win32 Trojan Emotet
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: '2.xlsx' is not recognized as an internal or external command, operable program or batch file.
console_handle: 0x000000000000000b
1 1 0
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid
pdb_path wextract.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
resource name AVI
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\21720~1.XLS
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\1.vbs
cmdline cmd.exe /c 1.vbs && 2.xlsx
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 reg_value rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\"
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\1.vbs
file C:\Users\test22\AppData\Local\Temp\IXP000.TMP\1.vbs
Process injection Process 2664 resumed a thread in remote process 2776
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000000000000284
suspend_count: 1
process_identifier: 2776
1 0 0
Lionic Trojan.Win32.GuLoader.4!c
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Ghanarava.1740520631536564
Skyhigh BehavesLike.Win64.Dropper.nm
ALYac Trojan.Generic.37526518
Cylance Unsafe
VIPRE Trojan.Generic.37526518
Sangfor Downloader.Win32.Agent.Vu6f
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.Generic.37526518
K7GW Trojan ( 005b825a1 )
K7AntiVirus Trojan ( 005b825a1 )
Arcabit Trojan.Generic.D23C9BF6
Symantec ML.Attribute.HighConfidence
Elastic malicious (moderate confidence)
ESET-NOD32 VBS/Agent.QMG
APEX Malicious
Avast Script:SNH-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Script/Generic.3a552e23
NANO-Antivirus Trojan.Win64.Dwn.kvpndp
MicroWorld-eScan Trojan.Generic.37526518
Rising Downloader.GuLoader/VBS!1.12749 (CLASSIC)
Emsisoft Trojan.Generic.37526518 (B)
F-Secure Trojan.TR/AVI.Agent.btjgf
DrWeb Trojan.DownLoader48.9429
Zillya Trojan.Generic.Script.14
TrendMicro TrojanSpy.Win64.LUMMASTEALER.YXFBLZ
McAfeeD ti!DA620174BEF1
CTX exe.trojan.generic
Sophos Mal/Generic-S
FireEye Generic.mg.6ca1d8895e299ea6
Google Detected
Avira TR/AVI.Agent.btjgf
Kingsoft Win32.Troj.Unknown.a
Microsoft Trojan:Win32/Wacatac.B!ml
GData Trojan.Generic.37526518
Varist VBS/Agent.BWT
McAfee Artemis!6CA1D8895E29
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.4115918142
Ikarus Trojan.VBS.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win64.LUMMASTEALER.YXFBLZ
Tencent Script.Trojan.Generic.Fmnw
huorong Trojan/VBS.GuLoader.ar
Fortinet W32/PossibleThreat
AVG Script:SNH-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan:Multi/Generic.Gen