popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

setup.exe

Generic Malware Malicious Library Antivirus UPX Malicious Packer OS Processor Check PE32 PE File CAB
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 24, 2025, 10:13 a.m. March 24, 2025, 10:24 a.m.
Size 3.9MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 c2c13e8b677ff2f552b1ded66b87549d
SHA256 22a07506913757e97f80ad6b8f1a2a9ec44d18b0e31fdc7adb89e3506c1ffcda
CRC32 DB2CF96C
ssdeep 98304:z0Fxb8yuO+WFwLId3DUVxaZumRdhfCqcqmP/C1:z0Fxb8yuO+JLA3DUuX
PDB Path C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Malicious_Packer_Zero - Malicious Packer
  • Antivirus - Contains references to security software
  • CAB_file_format - CAB archive file
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
github.com
A 20.200.245.247
20.200.245.247
IP Address Status Action
164.124.101.2 Active Moloch
20.200.245.247 Active Moloch

pdb_path C:\ReleaseAI\win\Release\stubs\x86\ExternalUi.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .didat
section .fptable
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2552
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x022c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2552
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72502000
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

RegSetValueExA

 key_handle: 0x000003a0
regkey_r: ProxyEnable
reg_type: 4 (REG_DWORD)
value: 0
regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable
1 0 0
Lionic Trojan.Win32.Generic.4!c
ALYac Gen:Variant.Fragtor.807103
Cylance Unsafe
VIPRE Gen:Variant.Fragtor.807103
BitDefender Gen:Variant.Fragtor.807103
Arcabit Trojan.Fragtor.DC50BF
Symantec Trojan.Gen.MBT
Avast FileRepMalware [Misc]
MicroWorld-eScan Gen:Variant.Fragtor.807103
Emsisoft Gen:Variant.Fragtor.807103 (B)
McAfeeD ti!22A075069137
CTX exe.trojan.fragtor
Sophos Generic Reputation PUA (PUA)
FireEye Gen:Variant.Fragtor.807103
Google Detected
Xcitium ApplicUnwnt@#34zjct6ev8lsk
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Fragtor.807103
Varist W32/ABTrojan.NBGS-2579
AhnLab-V3 Malware/Win.Generic.C5743781
McAfee Artemis!C2C13E8B677F
DeepInstinct MALICIOUS
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R014H09CL25
Fortinet W32/PossibleThreat
AVG FileRepMalware [Misc]