popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

ChromeUpdate.exe

Poorweb PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 26, 2025, 3:42 p.m. March 26, 2025, 3:42 p.m.
Size 88.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5 168e78a7154b2453627f5ca82e9ccced
SHA256 d311d65ddc8477c84bd77baa9606980515962231ea048e6c65d3d9b1bc527464
CRC32 24ABD2C5
ssdeep 1536:xkUWKUdv3CFSZeDzHLCepBZC6ZqByD9zY+6QKyxpPBUovMaZw4:xTFUdEUeDzH5ZCGp98+SYJUod9
Yara
  • PE_Header_Zero - PE File Signature
  • Poorweb_Zero - Poorweb
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 20480
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00880000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x00013a00', u'virtual_address': u'0x00025000', u'entropy': 7.894851611113123, u'name': u'UPX1', u'virtual_size': u'0x00014000'} entropy 7.89485161111 description A section with a high entropy has been found
entropy 0.897142857143 description Overall entropy of this PE file is high
section UPX0 description Section name indicates UPX
section UPX1 description Section name indicates UPX
Bkav W32.AIDetectMalware
Lionic Trojan.Win32.Dump.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Ghanarava.17377303009ccced
Skyhigh BehavesLike.Win32.Generic.mc
ALYac Dump:Generic.Mint.Zamg.8.EE4F4168
Cylance Unsafe
VIPRE Dump:Generic.Mint.Zamg.8.EE4F4168
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (W)
BitDefender Dump:Generic.Mint.Zamg.8.EE4F4168
K7GW Ransomware ( 00547c951 )
K7AntiVirus Ransomware ( 00547c951 )
Arcabit Dump:Generic.Mint.Zamg.8.EE4F4168
Symantec Infostealer.Rultazo
Elastic malicious (moderate confidence)
ESET-NOD32 a variant of Win32/Kryptik.GPFY
APEX Malicious
Avast Win32:Trojan-gen
ClamAV Win.Packed.Gandcrab-6914437-0
Kaspersky Trojan.Win32.Chapak.byhu
Alibaba Trojan:Win32/Chapak.d9c1a1eb
NANO-Antivirus Trojan.Win32.Kryptik.fmprui
MicroWorld-eScan Dump:Generic.Mint.Zamg.8.EE4F4168
Rising Trojan.Kryptik!8.8 (CLOUD)
Emsisoft Dump:Generic.Mint.Zamg.8.EE4F4168 (B)
F-Secure Heuristic.HEUR/AGEN.1306094
DrWeb Trojan.MulDrop9.2191
TrendMicro Ransom_Gandcrab.R002C0CAR25
McAfeeD Real Protect-LS!168E78A7154B
Trapmine malicious.moderate.ml.score
CTX exe.trojan.chapak
Sophos Mal/GandCrab-G
SentinelOne Static AI - Malicious PE
FireEye Generic.mg.168e78a7154b2453
Jiangmin Trojan.Chapak.baw
Google Detected
Avira HEUR/AGEN.1306094
Antiy-AVL Trojan/Win32.Chapak
Xcitium TrojWare.Win32.Azden.PB@8fhzsu
Microsoft PWS:Win32/Zbot!ml
ZoneAlarm Mal/GandCrab-G
GData Dump:Generic.Mint.Zamg.8.EE4F4168
AhnLab-V3 Malware/Win32.Generic.C3022206
McAfee Artemis!168E78A7154B
DeepInstinct MALICIOUS
VBA32 BScope.Trojan.Fuery
Malwarebytes Generic.Malware/Suspicious
Ikarus Trojan.Win32.Crypt
Panda Trj/GdSda.A