popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

XCV.exe

Generic Malware Malicious Packer
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 March 17, 2021, 5:41 p.m. March 17, 2021, 5:43 p.m.
Size 148.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 8d2ee34543afa9e564d264108c723b99
SHA256 347e0a3158914fee15d4f43ab5f855e827f6af9487620c74dd7c9f34b625beff
CRC32 10E8C704
ssdeep 3072:NOP9AfZYpI4YYWoxOzBYYuut5D+fdspxaL4rmP1:mKn4YtoxOzBYYuut5D+fdspxaP
Yara
  • Generic_Malware_Zero - Generic Malware
  • PE_Header_Zero - PE File Signature Zero
  • Malicious_Packer_Zero - Malicious Packer
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasRichSignature - Rich Signature Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
172.217.25.14 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 5580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73772000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 5580
region_size: 36864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 5580
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 24576
protection: 32 (PAGE_EXECUTE_READ)
base_address: 0x003f0000
process_handle: 0xffffffff
1 0 0
host 172.217.25.14
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Ser.Ursu.18757
FireEye Generic.mg.8d2ee34543afa9e5
ALYac Gen:Variant.Ser.Ursu.18757
Cylance Unsafe
AegisLab Trojan.Multi.Generic.4!c
Sangfor Trojan.Win32.Save.a
BitDefender Gen:Variant.Ser.Ursu.18757
CrowdStrike win/malicious_confidence_60% (D)
BitDefenderTheta Gen:NN.ZevbaF.34608.jm0@aqFHOvli
APEX Malicious
Avast Win32:Malware-gen
Kaspersky UDS:DangerousObject.Multi.Generic
Ad-Aware Gen:Variant.Ser.Ursu.18757
Emsisoft Gen:Variant.Ser.Ursu.18757 (B)
SentinelOne Static AI - Suspicious PE
Microsoft Trojan:Win32/Wacatac.B!ml
AhnLab-V3 Win-Trojan/VBKrand.Gen
GData Gen:Variant.Ser.Ursu.18757
Cynet Malicious (score: 100)
MAX malware (ai score=85)
Ikarus Trojan.VB.Crypt
Fortinet W32/Kryptik.EOVV!tr
AVG Win32:Malware-gen
Cybereason malicious.543afa