popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

jjyvr7o8if.exe

Gen1 Generic Malware Malicious Library Antivirus UPX Malicious Packer Anti_VM ftp PE File PE64 dll OS Processor Check wget DLL DllRegisterServer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 31, 2025, 12:06 p.m. March 31, 2025, 12:08 p.m.
Size 14.0MB
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
MD5 e58d52724427879218e2df01bad79481
SHA256 c19fa111a64d034a62f30ce750eedc2f685be6f8ae5143f15efa923f2c841ed2
CRC32 3AED6AAE
ssdeep 393216:69zZmHIWR5xhwNNiSa6VZ+12iPKS2YfL1Z7Aih2UowLVMkNJgC0:6E6NN66VQoUKcRZ7auTg
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2 @ 0x777840f2
EtwEnumerateProcessRegGuids+0x216 RtlTraceDatabaseLock-0x2a ntdll+0xc4736 @ 0x77784736
RtlQueryProcessLockInformation+0x972 RtlTraceDatabaseEnumerate-0xe ntdll+0xc5942 @ 0x77785942
RtlLogStackBackTrace+0x444 RtlTraceDatabaseCreate-0x4ec ntdll+0xc75f4 @ 0x777875f4
RtlLogStackBackTrace+0x828 RtlTraceDatabaseCreate-0x108 ntdll+0xc79d8 @ 0x777879d8
MD5Final+0x9cb0 TpDbgSetLogRoutine-0x6920 ntdll+0x9c280 @ 0x7775c280
RtlSubAuthorityCountSid+0xcc8 RtlCompareUnicodeStrings-0x4b8 ntdll+0x31df8 @ 0x776f1df8
RtlSubAuthorityCountSid+0xb50 RtlCompareUnicodeStrings-0x630 ntdll+0x31c80 @ 0x776f1c80
RtlAllocateHeap+0x178 AlpcGetMessageAttribute-0x14e8 ntdll+0x53518 @ 0x77713518
RtlUpcaseUnicodeChar+0x342 EtwEventEnabled-0x12e ntdll+0x2bf82 @ 0x776ebf82
RtlQueryEnvironmentVariable+0x70c _wcsicmp-0x744 ntdll+0x2623c @ 0x776e623c
RtlAllocateHeap+0xe8 AlpcGetMessageAttribute-0x1578 ntdll+0x53488 @ 0x77713488
RtlGetOwnerSecurityDescriptor+0x1b7 A_SHAInit-0x159 ntdll+0x8ef7 @ 0x776c8ef7
RtlUserThreadStart+0x9f strchr-0x361 ntdll+0x2c59f @ 0x776ec59f
LdrInitializeThunk+0x10f RtlUserThreadStart-0xd1 ntdll+0x2c42f @ 0x776ec42f
LdrInitializeThunk+0xe RtlUserThreadStart-0x1d2 ntdll+0x2c32e @ 0x776ec32e

exception.instruction_r: eb 00 48 8b 9c 24 d0 00 00 00 48 81 c4 c0 00 00
exception.symbol: RtlUnhandledExceptionFilter+0x2d2 LdrQueryModuleServiceTags-0x6e ntdll+0xc40f2
exception.instruction: jmp 0x777840f4
exception.module: ntdll.dll
exception.exception_code: 0xc0000374
exception.offset: 803058
exception.address: 0x777840f2
registers.r14: 0
registers.r15: 0
registers.rcx: 127655936
registers.rsi: 0
registers.r10: 0
registers.rbx: 0
registers.rsp: 127661088
registers.r11: 646
registers.r8: 3668801806742034531
registers.r9: 1460712879
registers.rdx: 2004857936
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1894021550
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1236
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00000000047c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffffffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\jjyvr7o8if.exe
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\libcrypto-3.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\tk86t.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\pywintypes312.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\sqlite3.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\pythoncom312.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\tcl86t.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\python312.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\vcruntime140_1.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\libssl-3.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\zlib1.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\libffi-8.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\vcruntime140.dll
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\python3.dll
section {u'size_of_data': u'0x00dd5400', u'virtual_address': u'0x0004d000', u'entropy': 7.999090692290962, u'name': u'.rsrc', u'virtual_size': u'0x00dd53f4'} entropy 7.99909069229 description A section with a high entropy has been found
entropy 0.99069799972 description Overall entropy of this PE file is high
file C:\Users\test22\AppData\Local\Temp\onefile_300_133878676013437500\jjyvr7o8if.exe
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Nuitka.i!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Ghanarava.1743277478d79481
Skyhigh BehavesLike.Win64.Dropper.tc
Cylance Unsafe
VIPRE Application.Generic.3953535
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Application.Generic.3953535
K7GW Trojan ( 005bddf51 )
K7AntiVirus Trojan ( 005bddf51 )
Arcabit Application.Generic.D3C537F
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 Python/PSW.Agent.BUN
Avast Win64:Malware-gen
Kaspersky Trojan-PSW.Win64.Disco.kfk
Alibaba Packed:Application/Nuitka.1d3d6582
MicroWorld-eScan Application.Generic.3953535
Emsisoft Application.Generic.3953535 (B)
F-Secure Trojan.TR/PSW.Agent.oowsz
Zillya Trojan.Stealer.Win32.194434
McAfeeD ti!C19FA111A64D
CTX exe.trojan.nuitka
Sophos Generic Reputation PUA (PUA)
SentinelOne Static AI - Suspicious PE
FireEye Application.Generic.3953535
Google Detected
Avira TR/PSW.Agent.oowsz
Microsoft Program:Win32/Wacapew.C!ml
GData Application.Generic.3953535
Varist W64/ABApplication.ESWN-4790
McAfee Artemis!E58D52724427
DeepInstinct MALICIOUS
Malwarebytes Malware.AI.1993370092
Ikarus PUA.Python.Nuitka
Fortinet W64/Agent_AGen.D!tr
AVG Win64:Malware-gen
alibabacloud VirTool:Python/Packed.Nuitka.Y