popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

OkH8IPF.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 26, 2025, 11:14 a.m. March 26, 2025, 11:23 a.m.
Size 1.1MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 b38cd06513a826e8976bb39c3e855f64
SHA256 2e0b126dd788c027ca69b01335d4a08da28987c3c4296a3523d947da3c12cdc2
CRC32 34F2007E
ssdeep 12288:Ft2BxheJBtYqmlf4feLUqJ2kAGptEVnN3Dv13BsnMipoMex+p03HGUjfsGSZcRfU:CIaJbU8CDsMixexOs7RfbXwLI95ttS
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .gxfg
section .retplne
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
okh8ipf+0xa01b7 @ 0x13f5601b7
okh8ipf+0x2ee3b @ 0x13f4eee3b
okh8ipf+0x9d1dc @ 0x13f55d1dc
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 44 0f b7 01 44 2b c0 75 19 48 2b ca 66 85 c0 74
exception.symbol: okh8ipf+0xa01b7
exception.instruction: movzx r8d, word ptr [rcx]
exception.module: OkH8IPF.exe
exception.exception_code: 0xc0000005
exception.offset: 655799
exception.address: 0x13f5601b7
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: -72340172838076673
registers.rbx: 0
registers.rsp: 2292800
registers.r11: -9187201950435737472
registers.r8: 129390749
registers.r9: 2947240675
registers.rdx: 5357642740
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 75
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x00057800', u'virtual_address': u'0x000c0000', u'entropy': 7.999457942591201, u'name': u'.idata', u'virtual_size': u'0x00057800'} entropy 7.99945794259 description A section with a high entropy has been found
entropy 0.320953690967 description Overall entropy of this PE file is high
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Inject.1b!c
Cynet Malicious (score: 100)
CAT-QuickHeal cld.trojan.inject
Skyhigh BehavesLike.Win64.Trojan.th
ALYac Gen:Variant.Zusy.587132
Cylance Unsafe
VIPRE Gen:Variant.Zusy.587132
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Zusy.587132
K7GW Trojan ( 005c39d71 )
K7AntiVirus Trojan ( 005c39d71 )
Arcabit Trojan.Zusy.D8F57C
VirIT Trojan.Win64.Genus.HWR
Symantec Trojan Horse
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Injector.WR
APEX Malicious
Avast Win64:CrypterX-gen [Trj]
Kaspersky Trojan.Win32.Inject.aqken
MicroWorld-eScan Gen:Variant.Zusy.587132
Rising Trojan.Kryptik!8.8 (CLOUD)
Emsisoft Gen:Variant.Zusy.587132 (B)
DrWeb Trojan.PWS.Lumma.2188
McAfeeD ti!2E0B126DD788
CTX exe.trojan.zusy
Sophos Mal/Generic-S
FireEye Generic.mg.b38cd06513a826e8
Webroot Win.Trojan.Zusy
Google Detected
Antiy-AVL Trojan/Win64.GenKryptik
Gridinsoft Trojan.Win64.Kryptik.sa
Microsoft Trojan:Win32/Wacatac.B!ml
GData Gen:Variant.Zusy.587132
Varist W64/ABTrojan.UXJC-4759
AhnLab-V3 Trojan/Win.Zusy.R696935
McAfee Artemis!B38CD06513A8
DeepInstinct MALICIOUS
VBA32 TrojanPSW.Lumma
Malwarebytes Crypt.Trojan.MSIL.DDS
Ikarus Trojan.SuspectCRC
Panda Trj/Chgt.AD
TrendMicro-HouseCall Trojan.Win32.VSX.PE04C9V
Tencent Malware.Win32.Gencirc.10c3540a
MaxSecure Trojan.Malware.272843718.susgen
Fortinet W64/GenKryptik.HHHH!tr
AVG Win64:CrypterX-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan:Win/Inject.aezkj