Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 8, 2025, 12:03 p.m.	March 8, 2025, 12:07 p.m.

Size	372.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`93e601392dd24741a740d6d63c248c60`
SHA256	`86360dbbd5c68ae37e1b04f6b8befa07980b52b5604c2a9969c81f3b123255ab`
CRC32	`EB2A9996`
ssdeep	`6144:XZRsT1/1mQrGkU3tctmUbAnG/j5mfNxYEOtzarMfhuLALdDVXmiZ:TYTSB3tGmyAnI5mla3za4EALdDVWiZ`
Yara	PE_Header_Zero - PE File Signature Is_DotNET_EXE - (no description) IsPE32 - (no description)

223ed60e-7c3f-4203-ab46-549662cc14bf.exe "C:\Users\test22\AppData\Local\Temp\223ed60e-7c3f-4203-ab46-549662cc14bf.exe"
1504

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 8, 2025, 12:03 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW March 8, 2025, 12:03 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 8, 2025, 12:03 p.m.			0	0
IsDebuggerPresent March 8, 2025, 12:03 p.m.			0	0
IsDebuggerPresent March 8, 2025, 12:03 p.m.			0	0
IsDebuggerPresent March 8, 2025, 12:03 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 8, 2025, 12:03 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.CSS

Allocates read-write-execute memory (usually to unpack itself) (16 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00890000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00830000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 8, 2025, 12:03 p.m.	process_identifier: 1504 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0005a400', u'virtual_address': u'0x0000a000', u'entropy': 7.9995066704937665, u'name': u'.CSS', u'virtual_size': u'0x0005a400'}

entropy

7.99950667049

description

A section with a high entropy has been found

entropy

0.971736204576

description

Overall entropy of this PE file is high

File has been identified by 55 AntiVirus engines on VirusTotal as malicious (50 out of 55 events)

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Stelpak.4!c
CAT-QuickHeal	Trojan.MSIL
Skyhigh	BehavesLike.Win32.Generic.fc
ALYac	Gen:Variant.Lazy.656125
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.656125
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Zusy.584302
K7GW	Trojan ( 005c27361 )
K7AntiVirus	Trojan ( 005c27361 )
Arcabit	Trojan.Zusy.D8EA6E
VirIT	Trojan.Win32.GenusT.ERFU
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Kryptik.ANFM
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
ClamAV	Win.Packed.Msilzilla-10042543-0
Kaspersky	HEUR:Trojan.MSIL.Stelpak.gen
Alibaba	Trojan:MSIL/Stelpak.4af52b97
NANO-Antivirus	Trojan.Win32.Stelpak.kvzolr
MicroWorld-eScan	Gen:Variant.Zusy.584302
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:0hOzxbJfSu8iFiJimWGMNQ)
Emsisoft	Gen:Variant.Zusy.584302 (B)
F-Secure	Trojan.TR/AD.Nekark.depcy
DrWeb	Trojan.PWS.Lumma.1819
McAfeeD	Real Protect-LS!93E601392DD2
CTX	exe.trojan.msil
Sophos	Troj/MSIL-THD
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.93e601392dd24741
Webroot	W32.Malware.gen
Google	Detected
Avira	TR/AD.Nekark.depcy
Kingsoft	MSIL.Trojan.Stelpak.gen
Gridinsoft	Spy.Win32.Gen.tr
Microsoft	Trojan:MSIL/LummaC.AFNA!MTB
GData	Win32.Trojan.Kryptik.CC2AOM
Varist	W32/ABTrojan.CBHR-4065
AhnLab-V3	Trojan/Win.Generic.C5736914
McAfee	GenericRXWQ-QK!93E601392DD2
DeepInstinct	MALICIOUS
VBA32	TScope.Trojan.MSIL
Malwarebytes	Trojan.MalPack
Ikarus	Trojan.MSIL.Krypt
Panda	Trj/Chgt.AD
Tencent	Malware.Win32.Gencirc.10c16924
huorong	Trojan/MSIL.Agent.vl

223ed60e-7c3f-4203-ab46-549662cc14bf

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All