popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

License.exe

Generic Malware Malicious Library UPX WinRAR PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 5, 2025, 1:31 a.m. April 5, 2025, 1:31 a.m.
Size 474.8KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 35585060bb1b65654fee82799996e9d0
SHA256 eeabf2ab0f987a3fbf99a51387712f7f387afe709940d401159d6df397eeb409
CRC32 42528F85
ssdeep 12288:vePeKtMk9UOyjefSphh+6/72LgxYokYqxWDaWp:2P/GkwRlyLgxhkYqx9Wp
PDB Path D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • Win32_WinRAR_SFX_Zero - Win32 WinRAR SFX
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb
section .didat
section _RDATA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2544
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
Skyhigh BehavesLike.Win64.Discord.gm
DeepInstinct MALICIOUS