filename.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.vadunac
section	.guli
section	.new

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 12, 2021, 2:33 p.m.	process_identifier: 7388 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 327680 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x002bc000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 12, 2021, 2:33 p.m.	process_identifier: 7388 region_size: 593920 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00078a00', u'virtual_address': u'0x00001000', u'entropy': 7.783843540574542, u'name': u'.text', u'virtual_size': u'0x0007896f'}				entropy	7.78384354057				description	A section with a high entropy has been found
entropy	0.874094202899				description	Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.7b8cec428653a5a8
McAfee	GenericRXAA-FA!7B8CEC428653
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7GW	Riskware ( 800800801 )
Cybereason	malicious.2a5f62
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Sophos	ML/PE-A
McAfee-GW-Edition	BehavesLike.Win32.Generic.hc
Ikarus	Trojan.Win32.Crypt
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34670.ICW@aOcffUcG
Malwarebytes	Trojan.Agent.UKED
Rising	Malware.Heuristic!ET#80% (RDMK:cmRtazpdK5JCOsoOlNzlRFh5NIpG)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/GenKryptik.FDXJ!tr
CrowdStrike	win/malicious_confidence_80% (D)
Qihoo-360	HEUR/QVM10.1.8769.Malware.Gen