Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

latestReport
11.13 04:11
hello.exe
11.13 03:11
espsemhvcioff.exe
11.13 02:11
Geek_se.exe
11.13 02:11
cred64.dll
11.13 02:11
svhost.exe
11.13 02:11
nb.exe
11.13 02:11
svcyr.exe
11.13 02:11
Ghost_1.5.11.5.exe
11.13 02:11
PowderGpl.exe
11.13 02:11
goodlabel%E6%89%93%E5%...

Latest News
11.14 05:11
[Control systems] Siem...
11.14 05:11
OpenAI Nears Launch of...
11.14 04:11
Execs identify AI-driv...
11.14 04:11
Intel security advisor...
11.14 04:11
Trump administration s...
11.14 04:11
A Security-First Appro...
11.14 04:11
FLOSS Weekly Episode 8...
11.14 04:11
Safer with Google: New...
11.14 04:11
These Guys Hacked AirP...
11.14 04:11
Sonatype recognized as...

Summary | ZeroBOX

AEO.exe

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 16, 2021, 1:23 p.m.	March 16, 2021, 1:25 p.m.

Size	148.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`4c44df8bf80b796ebb3e979519e723c4`
SHA256	`fdeb1da0df5e4ff9251597ce8e89060544e87fd7d978e73e7f513db4e4c2f2d6`
CRC32	`D3A11F7A`
ssdeep	`3072:iyyrsI07I3sOrfjioWyda6bxFEbgR9pp7yKSQpKQym:QH0I3sAji9yda6bXEbgR9pp7yKSh`
Yara	PE_Header_Zero - PE File Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) HasRichSignature - Rich Signature Check

AEO.exe "C:\Users\test22\AppData\Local\Temp\AEO.exe"
732

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 16, 2021, 1:23 p.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72d72000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 16, 2021, 1:23 p.m.	process_identifier: 732 region_size: 40960 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 16, 2021, 1:23 p.m.	process_identifier: 732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

File has been identified by 16 AntiVirus engines on VirusTotal as malicious (16 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.4c44df8bf80b796e
McAfee	Artemis!4C44DF8BF80B
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Trojan.Win32.Vebzenpak.aeeo
Webroot	W32.Trojan.Gen
AegisLab	Trojan.Multi.Generic.4!c
AhnLab-V3	Win-Trojan/VBKrand.Gen
Rising	Trojan.Kryptik!8.8 (CLOUD)
Fortinet	W32/Kryptik.EOVV!tr
AVG	FileRepMalware
CrowdStrike	win/malicious_confidence_80% (W)