Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 22, 2021, 9:14 a.m.	March 22, 2021, 9:14 a.m.

Size	955.5KB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	`91ee2afefdf066eae3aead061a8075ed`
SHA256	`4435942b9f09846a337474f396fd0a885f41742f05899dcc1a12b6b44a31126b`
CRC32	`2D840A63`
ssdeep	`12288:2GjMVZYw0CREHRVULpO7uagohcOQkfoLTqcekccO:2GjMnYw0wEHRVULcaNohcBsSa`
Yara	PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero win_files_operation - Affect private profile IsPE64 - (no description) IsWindowsGUI - (no description) HasDebugData - DebugData Check HasRichSignature - Rich Signature Check

ss.exe "C:\Users\test22\AppData\Local\Temp\ss.exe"
2648

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 22, 2021, 9:14 a.m.	stacktrace: exception.symbol: exception.exception_code: 0xc0000005 exception.address: 0x0 registers.r14: 30801920 registers.r15: 1998659424 registers.rcx: 0 registers.rsi: 0 registers.r10: 30994992 registers.rbx: 1 registers.rsp: 2352664 registers.r11: 2164392969 registers.r8: 0 registers.r9: 23 registers.rdx: 2352704 registers.r12: 30801920 registers.rbp: 2352736 registers.rdi: 1 registers.rax: 2532016 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 22, 2021, 9:14 a.m.	process_identifier: 2648 region_size: 217088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000001d60000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (1 event)

section

{u'size_of_data': u'0x0002d200', u'virtual_address': u'0x000ba000', u'entropy': 6.880606331466274, u'name': u'.rdata', u'virtual_size': u'0x0002d132'}

entropy

6.88060633147

description

A section with a high entropy has been found

File has been identified by 33 AntiVirus engines on VirusTotal as malicious (33 events)

McAfee	RDN/Generic.tfr
Alibaba	Trojan:Win64/GenKryptik.38d2ded3
K7GW	Trojan ( 005797361 )
CrowdStrike	win/malicious_confidence_60% (W)
Arcabit	Trojan.Generic.D22DA70E
ESET-NOD32	a variant of Win64/GenKryptik.FDCN
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.36546318
ViRobot	Trojan.Win32.Z.Genkryptik.978432
MicroWorld-eScan	Trojan.GenericKD.36546318
Avast	Win64:CrypterX-gen [Trj]
Ad-Aware	Trojan.GenericKD.36546318
Emsisoft	Trojan.GenericKD.36546318 (B)
DrWeb	Trojan.Siggen12.48113
McAfee-GW-Edition	BehavesLike.Win64.Generic.dh
FireEye	Generic.mg.91ee2afefdf066ea
Sophos	Mal/Generic-S
Ikarus	Trojan.Win64.Krypt
Avira	TR/Crypt.Agent.fecwv
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Gridinsoft	Trojan.Win64.Kryptik.oa
Microsoft	Trojan:Win32/Cobaltstrike!ml
AegisLab	Trojan.Win32.Generic.4!c
GData	Trojan.GenericKD.36546318
ALYac	Trojan.GenericKD.36546318
MAX	malware (ai score=80)
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Fortinet	W64/GenKryptik.FDCN!tr
AVG	Win64:CrypterX-gen [Trj]
Cybereason	malicious.602595
Qihoo-360	Win64/Trojan.Generic.HgEASRIA

ss.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All