popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

FreePhotoShop%20Meme%20Coin%20Packs.exe

RedlineStealer RedLine stealer Generic Malware UPX Malicious Packer .NET framework(MSIL) Malicious Library PE File OS Processor Check PE32 .NET EXE
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 April 29, 2025, 10:29 a.m. April 29, 2025, 10:36 a.m.
Size 250.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 310c1b76fbf1b164cc59a158949d24f3
SHA256 138b3883e8ccf6496ae1d5f9499a8dda3e46be499eed57d054d810079b91ecb2
CRC32 E4C9ADC5
ssdeep 6144:P6AfoFv2O72QFbFB/lkyO4k/v9bdUkbz:SAQFuS2QFhjkysw
Yara
  • PE_Header_Zero - PE File Signature
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult
  • Malicious_Packer_Zero - Malicious Packer
  • RedLine_Stealer_b_Zero - RedLine stealer
  • Is_DotNET_EXE - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file
  • detect_Redline_Stealer_V2 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003e0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00450000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2556
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x727a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00490000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002d5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002bc000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00530000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2556
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x002aa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.DataStealer.i!c
CAT-QuickHeal Trojan.Ghanarava.17457931919d24f3
Skyhigh Artemis!Trojan
ALYac Trojan.GenericKD.76268388
Cylance Unsafe
VIPRE Trojan.GenericKD.76268388
Sangfor Suspicious.Win32.Save.a
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.GenericKD.76268388
K7GW Spyware ( 0056dd401 )
K7AntiVirus Spyware ( 0056dd401 )
Arcabit Trojan.Generic.D48BC364
VirIT Trojan.Win32.MSIL_Heur.A
Symantec Infostealer
Elastic Windows.Generic.Threat
ESET-NOD32 a variant of MSIL/PSW.Agent.RXP
Avast Win32:MalwareX-gen [Pws]
Kaspersky HEUR:Trojan-PSW.MSIL.Stealer.gen
Alibaba TrojanPSW:MSIL/Stealgen.abb06039
NANO-Antivirus Trojan.Win32.Stealer.kwxwkr
MicroWorld-eScan Trojan.GenericKD.76268388
Rising Stealer.Phemedrone!1.F3D5 (CLASSIC)
Emsisoft Trojan.GenericKD.76268388 (B)
F-Secure Heuristic.HEUR/AGEN.1307370
DrWeb Trojan.PWS.Stealer.41994
Zillya Trojan.Agent.Win32.4219411
TrendMicro TROJ_GEN.R002C0DDF25
McAfeeD Real Protect-LS!310C1B76FBF1
CTX exe.trojan.msil
Sophos Troj/Steal-FDX
SentinelOne Static AI - Malicious PE
Webroot Win.Redline.Stealer
Google Detected
Avira HEUR/AGEN.1307370
Gridinsoft Trojan.Win32.Agent.sa
Microsoft PWS:MSIL/Stealgen.GA!MTB
ViRobot Trojan.Win.Z.Datastealer.256000.P
ZoneAlarm Troj/Steal-FDX
GData MSIL.Trojan-Stealer.DataStealer.B
Varist W32/MSIL_Agent.FTF.gen!Eldorado
AhnLab-V3 Trojan/Win.Evital.C5728862
McAfee Artemis!310C1B76FBF1
DeepInstinct MALICIOUS
VBA32 Trojan.MSIL.InfoStealer.gen.D
Malwarebytes Spyware.StormKitty.MSIL
Panda Trj/GdSda.A
TrendMicro-HouseCall Trojan.Win32.VSX.PE04C9Z
Tencent Malware.Win32.Gencirc.11df6ad4
huorong TrojanSpy/Stealer.gg