popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

NlmvJyQ.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 8, 2025, 9:13 a.m. April 8, 2025, 9:15 a.m.
Size 674.0KB
Type PE32+ executable (GUI) x86-64, for MS Windows
MD5 c6a119bfd5690fd9740d4b0ceda18c46
SHA256 9d2adad9a2ce99316677b5133953f620720286d5820c0d54adb610ddb71cb8bd
CRC32 7C4CB7C3
ssdeep 12288:SLz2g5eVQ9bgzo0y900DK/OiU0av3OSkWdlK8c3MIpr4NT:gz/5eVP2XiUCRWdw86Mz
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .BSS
section .gxfg
section .retplne
section _RDATA
section .cSs
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
nlmvjyq+0x2b177 @ 0x13febb177
nlmvjyq+0xfac7 @ 0x13fe9fac7
nlmvjyq+0x22d2d @ 0x13feb2d2d
nlmvjyq+0x2991e @ 0x13feb991e
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 44 0f b7 01 44 2b c0 75 19 48 2b ca 66 85 c0 74
exception.symbol: nlmvjyq+0x2b177
exception.instruction: movzx r8d, word ptr [rcx]
exception.module: NlmvJyQ.exe
exception.exception_code: 0xc0000005
exception.offset: 176503
exception.address: 0x13febb177
registers.r14: 0
registers.r15: 0
registers.rcx: 110
registers.rsi: 0
registers.r10: -72340172838076928
registers.rbx: 0
registers.rsp: 7339984
registers.r11: 0
registers.r8: 1994794592
registers.r9: 0
registers.rdx: 5367475166
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 75
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x0003a800', u'virtual_address': u'0x00001000', u'entropy': 6.988471115891725, u'name': u'.text', u'virtual_size': u'0x0003a6ea'} entropy 6.98847111589 description A section with a high entropy has been found
section {u'size_of_data': u'0x0005cc00', u'virtual_address': u'0x00054000', u'entropy': 7.999501351928852, u'name': u'.cSs', u'virtual_size': u'0x0005cc00'} entropy 7.99950135193 description A section with a high entropy has been found
entropy 0.899628252788 description Overall entropy of this PE file is high
Bkav W64.AIDetectMalware
Lionic Trojan.Win32.Lumma.1u!c
MicroWorld-eScan Gen:Variant.Lazy.674883
CAT-QuickHeal Trojan.Ghanarava.1744046911a18c46
Skyhigh BehavesLike.Win64.Trickbot.jc
ALYac Gen:Variant.Lazy.674883
Cylance Unsafe
VIPRE Gen:Variant.Lazy.674883
Sangfor Trojan.Win64.Kryptik.Vbv7
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Lazy.674883
Arcabit Trojan.Lazy.DA4C43
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Kryptik.EZV
APEX Malicious
Avast Win64:CrypterX-gen [Trj]
Cynet Malicious (score: 100)
Kaspersky UDS:DangerousObject.Multi.Generic
Alibaba Trojan:Win64/Kryptik.f373edea
Rising Trojan.ShellCodeLoader!1.12B08 (CLASSIC)
Emsisoft Gen:Variant.Lazy.674883 (B)
McAfeeD ti!9D2ADAD9A2CE
CTX exe.trojan.kryptik
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.c6a119bfd5690fd9
Webroot W32.Trojan.Gen
Google Detected
Avira TR/Kryptik.bucdx
Antiy-AVL Trojan/Win64.Kryptik
Kingsoft malware.kb.a.996
Gridinsoft Ransom.Win64.TrickBot.sa
Microsoft Trojan:Win64/LummaC.AN!MTB
GData Gen:Variant.Lazy.674883
Varist W64/ABTrojan.JARF-5539
AhnLab-V3 Trojan/Win.Kryptik.R699262
McAfee Artemis!C6A119BFD569
DeepInstinct MALICIOUS
Malwarebytes Crypt.Trojan.MSIL.DDS
Panda Trj/GdSda.A
TrendMicro-HouseCall Trojan.Win32.VSX.PE04C9V
Fortinet W64/Kryptik.EZV!tr
AVG Win64:CrypterX-gen [Trj]
Paloalto generic.ml
alibabacloud Trojan[stealer]:Win/LummaC.AT8PHU