popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

apple.exe

Generic Malware Malicious Library UPX WinRAR AntiDebug PE File OS Processor Check PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 26, 2025, 11:12 a.m. March 26, 2025, 11:30 a.m.
Size 327.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 f0676528d1fc19da84c92fe256950bd7
SHA256 493b897d1a54e3aa3f177b49b2529d07cdd791c6d693b6be2f9a4f1144b74a32
CRC32 D6969600
ssdeep 6144:RTouKrWBEu3/Z2lpGDHU3ykJVvr/o6KaV7NRZfUlyT/g:RToPWBv/cpGrU3ygro8V7felu4
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
section .didat
file C:\Users\test22\AppData\Local\Temp\C0BB.tmp\C0BC.tmp\C0CC.bat
file C:\Users\test22\AppData\Local\Temp\11.exe
file C:\Users\test22\AppData\Local\Temp\C406.tmp\C407.tmp\C428.bat
cmdline "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\C406.tmp\C407.tmp\C428.bat C:\Users\test22\AppData\Local\Temp\11.exe go"
cmdline "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\C0BB.tmp\C0BC.tmp\C0CC.bat C:\Users\test22\AppData\Local\Temp\11.exe"
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\sysnative\cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\C0BB.tmp\C0BC.tmp\C0CC.bat C:\Users\test22\AppData\Local\Temp\11.exe"
filepath: C:\Windows\sysnative\cmd
1 1 0

ShellExecuteExW

 show_type: 0
filepath_r: C:\Windows\sysnative\cmd
parameters: /c "C:\Users\test22\AppData\Local\Temp\C406.tmp\C407.tmp\C428.bat C:\Users\test22\AppData\Local\Temp\11.exe go"
filepath: C:\Windows\sysnative\cmd
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline C:\Windows\sysnative\cmd /c "C:\Users\test22\AppData\Local\Temp\C406.tmp\C407.tmp\C428.bat C:\Users\test22\AppData\Local\Temp\11.exe go"
cmdline C:\Windows\sysnative\cmd /c "C:\Users\test22\AppData\Local\Temp\C0BB.tmp\C0BC.tmp\C0CC.bat C:\Users\test22\AppData\Local\Temp\11.exe"
cmdline "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\C406.tmp\C407.tmp\C428.bat C:\Users\test22\AppData\Local\Temp\11.exe go"
cmdline "C:\Windows\sysnative\cmd.exe" /c "C:\Users\test22\AppData\Local\Temp\C0BB.tmp\C0BC.tmp\C0CC.bat C:\Users\test22\AppData\Local\Temp\11.exe"
cmdline sc start ddrver
cmdline sc create ddrver type= kernel binPath= "C:\Users\test22\AppData\Local\Temp\ssisd.sys"
Time & API Arguments Status Return Repeated

CreateServiceW

 service_start_name:
start_type: 3
password:
display_name:
filepath: C:\Users\test22\AppData\Local\Temp\ssisd.sys
service_name: ddrver
filepath_r: C:\Users\test22\AppData\Local\Temp\ssisd.sys
desired_access: 983551
service_handle: 0x00000000002d69d0
error_control: 1
service_type: 1
service_manager_handle: 0x00000000002d69a0
1 2976208 0
Process injection Process 2056 resumed a thread in remote process 2140
Process injection Process 2252 resumed a thread in remote process 2340
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000208
suspend_count: 1
process_identifier: 2140
1 0 0

NtResumeThread

 thread_handle: 0x00000208
suspend_count: 1
process_identifier: 2340
1 0 0
Lionic Trojan.Win32.GenCBL.4!c
CAT-QuickHeal Trojan.Ghanarava.1742853193cb6765
Skyhigh BehavesLike.Win32.RealProtect.fh
ALYac Zum.Razy.1
Cylance Unsafe
VIPRE Trojan.GenericKD.76023058
Sangfor Trojan.Win32.Gencbl.Vnig
CrowdStrike win/malicious_confidence_60% (W)
BitDefender Trojan.GenericKD.76023058
K7GW Trojan ( 005c40e51 )
K7AntiVirus Trojan ( 005c40e51 )
Arcabit Trojan.Generic.D4880512 [many]
VirIT Trojan.Win32.Genus.IHW
Symantec Trojan Horse
ESET-NOD32 a variant of Win32/GenCBL.FRW
Avast Win64:MalwareX-gen [Trj]
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win32/GenCBL.e2a95cb6
MicroWorld-eScan Trojan.GenericKD.76023058
Rising Trojan.MalCert!1.101B3 (CLASSIC)
Emsisoft Trojan.GenericKD.76023058 (B)
TrendMicro Trojan.Win32.AMADEY.YXFCXZ
McAfeeD ti!493B897D1A54
Trapmine suspicious.low.ml.score
CTX exe.trojan.gencbl
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious SFX
FireEye Generic.mg.f0676528d1fc19da
Google Detected
Antiy-AVL GrayWare/Win32.Puwaders
Gridinsoft Ransom.Win32.Wacatac.sa
Microsoft Trojan:Win32/Etset!rfn
ViRobot Trojan.Win.Z.Agent.335469
GData Win32.Trojan.Agent.HS9404
Varist W64/ABTrojan.QVCK-1613
McAfee Artemis!F0676528D1FC
DeepInstinct MALICIOUS
VBA32 Trojan.BAT.KillFiles
Malwarebytes Malware.AI.4005561822
Ikarus Win32.Outbreak
Panda Trj/Chgt.AD
Zoner Trojan.Win32.85523
TrendMicro-HouseCall Trojan.Win32.AMADEY.YXFCXZ
Tencent Win32.Trojan.Generic.Dnhl
Fortinet W32/PossibleThreat
AVG Win64:MalwareX-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan:Win/GenCBL.FVL