popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

Sewi.exe.0021aed8_00123400.exe

Generic Malware Malicious Library UPX PE64 PE File OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 9, 2025, 9:29 a.m. April 9, 2025, 9:29 a.m.
Size 1.1MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 b7200b147304d0bc49cf8385434791c6
SHA256 826271169b58d653c83ac729eff2eb976f55ccfd806b336744ca29d2cd85cc89
CRC32 12C0F0E3
ssdeep 24576:CEhUTi8SQayuIEN8uEQgGlsNFygsnEfzK4fDa4Vkp:YglOFEEfzK2Daia
Yara
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

section .gxfg
section .retplne
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
sewi+0xb37d7 @ 0x13fb837d7
sewi+0x24b91 @ 0x13faf4b91
sewi+0xb07fc @ 0x13fb807fc
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x7718652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x772bc521

exception.instruction_r: 44 0f b7 01 44 2b c0 75 19 48 2b ca 66 85 c0 74
exception.symbol: sewi+0xb37d7
exception.instruction: movzx r8d, word ptr [rcx]
exception.module: Sewi.exe.0021aed8_00123400.exe
exception.exception_code: 0xc0000005
exception.offset: 735191
exception.address: 0x13fb837d7
registers.r14: 0
registers.r15: 0
registers.rcx: 0
registers.rsi: 0
registers.r10: 4294967040
registers.rbx: 0
registers.rsp: 3078144
registers.r11: 3841334785
registers.r8: 2351794881
registers.r9: 4294967295
registers.rdx: 5364077556
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 75
registers.r13: 0
1 0 0
section {u'size_of_data': u'0x00056400', u'virtual_address': u'0x000d3000', u'entropy': 7.999494474870142, u'name': u'.idata', u'virtual_size': u'0x00056400'} entropy 7.99949447487 description A section with a high entropy has been found
entropy 0.296519123335 description Overall entropy of this PE file is high
Bkav W64.AIDetectMalware
Cynet Malicious (score: 100)
ALYac Gen:Variant.Lazy.670229
Cylance Unsafe
VIPRE Gen:Variant.Lazy.670229
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (D)
BitDefender Gen:Variant.Lazy.670229
K7GW Riskware ( 00584baa1 )
K7AntiVirus Riskware ( 00584baa1 )
Arcabit Trojan.Lazy.DA3A15
VirIT Trojan.Win64.Genus.HWW
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win64/Injector.WR
APEX Malicious
Avast Win64:Evo-gen [Trj]
Kaspersky VHO:Trojan-PSW.Win32.Convagent.gen
MicroWorld-eScan Gen:Variant.Lazy.670229
Rising Trojan.ShellCodeLoader!1.12B07 (CLASSIC)
Emsisoft Gen:Variant.Lazy.670229 (B)
Zillya Trojan.Inject.Win32.352585
CTX exe.unknown.lazy
Sophos Generic ML PUA (PUA)
Webroot Win.Malware.Gen
Google Detected
Antiy-AVL Trojan/Win64.GenKryptik
Microsoft Trojan:Win32/LummaStealer.Z!MTB
GData Gen:Variant.Lazy.670229
AhnLab-V3 Trojan/Win.Zusy.R696935
DeepInstinct MALICIOUS
Malwarebytes Crypt.Trojan.MSIL.DDS
Ikarus Trojan.SuspectCRC
Panda Trj/GdSda.A
TrendMicro-HouseCall Trojan.Win32.VSX.PE04C9V
Tencent OB:Trojan.Win64.Injector.16001769
huorong Trojan/Injector.cep
MaxSecure Trojan.Malware.300983.susgen
Fortinet W64/Injector.WR!tr
AVG Win64:Evo-gen [Trj]