popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

1776871603.exe

PhysicalDrive Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 12, 2025, 11:26 a.m. March 12, 2025, 11:34 a.m.
Size 3.5MB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 8bede54b9c4860ddcc2363cd2cf561b5
SHA256 450b033145869b6b0dfcf0b1c5dd05044234402957ee9cf76cc56f24487e6b17
CRC32 4FA3C419
ssdeep 49152:smVwASOEGtlqCKIU6icdWriTEhTWdrGa+nQEycjrAyn5VYRVctpXkESh491acOIm:Nd+Wh5yUcOJx9iKqHHhrX2ANMnV
PDB Path C:\Users\Administrator\Desktop\OneDrive\good\d53f8fa2ef2f4fcabd436e7660115d80\x64\Release\LClipper.pdb
Yara
  • PhysicalDrive_20181001 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
ip-api.com
A 208.95.112.1
208.95.112.1
IP Address Status Action
164.124.101.2 Active Moloch
208.95.112.1 Active Moloch

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:54148 -> 164.124.101.2:53 2054141 ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com) Device Retrieving External IP Address Detected
TCP 192.168.56.101:49162 -> 208.95.112.1:80 2022082 ET POLICY External IP Lookup ip-api.com Device Retrieving External IP Address Detected

Suricata TLS

No Suricata TLS

pdb_path C:\Users\Administrator\Desktop\OneDrive\good\d53f8fa2ef2f4fcabd436e7660115d80\x64\Release\LClipper.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
request GET http://ip-api.com/line/
domain ip-api.com
section {u'size_of_data': u'0x001be400', u'virtual_address': u'0x00001000', u'entropy': 6.862718423504816, u'name': u'.text', u'virtual_size': u'0x001be218'} entropy 6.8627184235 description A section with a high entropy has been found
section {u'size_of_data': u'0x001a1200', u'virtual_address': u'0x001c0000', u'entropy': 7.4836410620012295, u'name': u'.rdata', u'virtual_size': u'0x001a1098'} entropy 7.483641062 description A section with a high entropy has been found
entropy 0.969675698442 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

NtCreateFile

 create_disposition: 1 (FILE_OPEN)
file_handle: 0x00000000000002bc
filepath: \??\PhysicalDrive0
desired_access: 0x00100080 (FILE_READ_ATTRIBUTES|SYNCHRONIZE)
file_attributes: 0 ()
filepath_r: \??\PhysicalDrive0
create_options: 96 (FILE_NON_DIRECTORY_FILE|FILE_SYNCHRONOUS_IO_NONALERT)
status_info: 0 (FILE_SUPERSEDED)
share_access: 3 (FILE_SHARE_READ|FILE_SHARE_WRITE)
1 0 0

DeviceIoControl

 input_buffer:
control_code: 458752 (IOCTL_DISK_GET_DRIVE_GEOMETRY)
device_handle: 0x00000000000002bc
output_buffer: Q ÿ?
1 1 0
Lionic Trojan.Win32.ClipBanker.Z!c
Cynet Malicious (score: 99)
CAT-QuickHeal Trojan.Ghanarava.1741728916f561b5
Skyhigh BehavesLike.Win64.Dropper.wc
ALYac Gen:Variant.Mikey.173341
Cylance Unsafe
VIPRE Gen:Variant.Mikey.173341
CrowdStrike win/malicious_confidence_90% (W)
BitDefender Gen:Variant.Mikey.173341
K7GW Trojan ( 005aeee81 )
K7AntiVirus Trojan ( 005aeee81 )
Arcabit Trojan.Mikey.D2A51D
VirIT Trojan.Win64.Genus.HWD
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/ClipBanker.EE
APEX Malicious
Avast Win64:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win64/ClipBanker.d0ee7091
MicroWorld-eScan Gen:Variant.Mikey.173341
Rising Trojan.ClipBanker!8.5FB (TFE:5:k7y2Rec47TQ)
Emsisoft Gen:Variant.Mikey.173341 (B)
F-Secure Trojan.TR/Spy.Banker.kdiut
Zillya Trojan.ClipBanker.Win64.620
TrendMicro TrojanSpy.Win64.LUMMASTEALER.YXFCLZ
McAfeeD ti!450B03314586
CTX exe.trojan.clipbanker
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Gen:Variant.Mikey.173341
Google Detected
Avira TR/Spy.Banker.kdiut
Antiy-AVL Trojan/Win64.ClipBanker
Gridinsoft Ransom.Win64.Wacatac.sa
Microsoft Trojan:Win32/Formbook!ml
GData Gen:Variant.Mikey.173341
Varist W64/ABPWS.HSZJ-8865
AhnLab-V3 Trojan/Win.Generic.C5696988
McAfee Artemis!8BEDE54B9C48
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.2965839658
Ikarus Trojan.Win64.Clipbanker
Panda Trj/Chgt.AD
TrendMicro-HouseCall TrojanSpy.Win64.LUMMASTEALER.YXFCLZ
Tencent Win32.Trojan.Spy.Zmhl
huorong TrojanSpy/ClipBanker.ae
Fortinet W64/ClipBanker.EE!tr
AVG Win64:MalwareX-gen [Trj]
Paloalto generic.ml