popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

tK0oYx3.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 26, 2025, 11:12 a.m. March 26, 2025, 11:18 a.m.
Size 1.2MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 e3f8c373ee1990eecfc3a762e7f3bc3b
SHA256 41b06a71f35f168f8772eb1d2cf420ebcd0afe2259728fd92d5fe4d0ea99ca6a
CRC32 B98C833C
ssdeep 12288:v+78guA7BSXlY7CvfHVgYRur7LHADkNGcqv9R/lQ46qP1wAmorhHc5u1jSZcRfQm:gKFsMoLq9wY/j7RfbXwLI95etSrt
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .gxfg
section .retplne
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
tk0oyx3+0xb0777 @ 0x13f310777
tk0oyx3+0x36446 @ 0x13f296446
tk0oyx3+0xad79c @ 0x13f30d79c
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 44 0f b7 01 44 2b c0 75 19 48 2b ca 66 85 c0 74
exception.symbol: tk0oyx3+0xb0777
exception.instruction: movzx r8d, word ptr [rcx]
exception.module: tK0oYx3.exe
exception.exception_code: 0xc0000005
exception.offset: 722807
exception.address: 0x13f310777
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 3978117600
registers.rbx: 0
registers.rsp: 3145216
registers.r11: 4294967295
registers.r8: 76597505
registers.r9: 4218369536
registers.rdx: 5355217908
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 75
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x00057800', u'virtual_address': u'0x000d0000', u'entropy': 7.999466248902026, u'name': u'.idata', u'virtual_size': u'0x00057800'} entropy 7.9994662489 description A section with a high entropy has been found
entropy 0.30276816609 description Overall entropy of this PE file is high
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.InjectorNetT.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Ghanarava.1742894699f3bc3b
Skyhigh BehavesLike.Win64.Trojan.th
ALYac Gen:Variant.Midie.162967
Cylance Unsafe
VIPRE Gen:Variant.Midie.162967
Sangfor Trojan.Win32.Kryptik.Vp5p
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Midie.162967
K7GW Trojan ( 005c39d71 )
K7AntiVirus Trojan ( 005c39d71 )
Arcabit Trojan.Midie.D27C97
VirIT Trojan.Win64.Genus.HWR
Symantec Trojan Horse
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Injector.WR
APEX Malicious
Avast Win64:CrypterX-gen [Trj]
Kaspersky Trojan.Win32.InjectorNetT.mb
Alibaba Trojan:Win64/GenKryptik.4470e0b6
MicroWorld-eScan Gen:Variant.Midie.162967
Rising Trojan.Kryptik!8.8 (CLOUD)
Emsisoft Gen:Variant.Midie.162967 (B)
F-Secure Trojan.TR/Crypt.Agent.gpyoa
McAfeeD ti!41B06A71F35F
CTX exe.trojan.crypt
Sophos Mal/Generic-S
FireEye Generic.mg.e3f8c373ee1990ee
Webroot Win.Trojan.Gen
Google Detected
Avira TR/Crypt.Agent.gpyoa
Antiy-AVL Trojan/Win64.GenKryptik
Gridinsoft Ransom.Win64.Wacatac.oa!s1
GData Gen:Variant.Midie.162967
Varist W64/ABTrojan.GKHD-0448
AhnLab-V3 Trojan/Win.Zusy.R696935
McAfee Artemis!E3F8C373EE19
DeepInstinct MALICIOUS
VBA32 TrojanPSW.Lumma
Malwarebytes Crypt.Trojan.MSIL.DDS
Ikarus Trojan.Crypt.Agent
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.VSX.PE04C9V
Tencent Malware.Win32.Gencirc.10c351d5
MaxSecure Trojan.Malware.218555844.susgen
Fortinet W64/GenKryptik.HHHH!tr
AVG Win64:CrypterX-gen [Trj]
Paloalto generic.ml