popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

jajajdva.exe

RedLine stealer Generic Malware .NET framework(MSIL) UPX Malicious Packer Malicious Library PE File DLL OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 26, 2025, 11:10 a.m. March 26, 2025, 11:20 a.m.
Size 320.0KB
Type PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 4f0990ea72c03f3911be671cbceb7fda
SHA256 b9e894c975b74265c0c359706931d61227c1ab7074cdf981d2d4a5ceacda9290
CRC32 A9D45CEA
ssdeep 6144:lKTuj7ot3QBAlFV7evwYkBS7asV24JU71esarL:lJjs3QBqFV7YlV674H
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Malicious_Packer_Zero - Malicious Packer
  • RedLine_Stealer_b_Zero - RedLine stealer
  • Is_DotNET_EXE - (no description)
  • IsPE32 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 1703936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f31000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73f32000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 2097152
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02260000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02420000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003c2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fb000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003dc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00760000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1872
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ca000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1872
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 790528
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x757f0000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Roaming\gdi32.dll
file C:\Users\test22\AppData\Roaming\gdi32.dll
Lionic Trojan.Win32.InjectorNetT.4!c
ALYac Gen:Variant.Jalapeno.19167
Cylance Unsafe
VIPRE Gen:Variant.Jalapeno.19167
Sangfor Dropper.Msil.Agent.Vgnh
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Jalapeno.19167
Arcabit Trojan.Jalapeno.D4ADF
Symantec ML.Attribute.HighConfidence
Elastic Windows.Infostealer.PhemedroneStealer
ESET-NOD32 a variant of MSIL/TrojanDropper.Agent.GCY
APEX Malicious
Avast Win32:DropperX-gen [Drp]
ClamAV Win.Packed.Msilzilla-10026835-0
Kaspersky HEUR:Trojan.MSIL.InjectorNetT.gen
MicroWorld-eScan Gen:Variant.Jalapeno.19167
Rising Stealer.Phemedrone!1.F3D5 (CLASSIC)
Emsisoft Gen:Variant.Jalapeno.19167 (B)
DrWeb Trojan.PWS.Lumma.1113
Trapmine suspicious.low.ml.score
CTX exe.unknown.jalapeno
Sophos Mal/Generic-S
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.4f0990ea72c03f39
Google Detected
Kingsoft malware.kb.c.887
Microsoft Trojan:MSIL/LummaC.AXGA!MTB
GData Gen:Variant.Jalapeno.19167
Varist W32/MSIL_Agent.IZS.gen!Eldorado
AhnLab-V3 Dropper/Win.Generic.C5708054
DeepInstinct MALICIOUS
VBA32 TrojanStealer.MSIL.Phemedrone.Heur
Malwarebytes Malware.AI.4093355048
Ikarus Trojan.Win32.Rozena
Tencent Malware.Win32.Gencirc.1426d666
huorong Trojan/MSIL.Agent.ih
Fortinet MSIL/Agent.GCY!tr
AVG Win32:DropperX-gen [Drp]