rets.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.gfids

The file contains an unknown PE resource name possibly indicative of a packer (2 events)

resource name	AFX_DIALOG_LAYOUT
resource name	RT_RIBBON_XML

File has been identified by 8 AntiVirus engines on VirusTotal as malicious (8 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.e31198c0a7e97c05
Cylance	Unsafe
Cybereason	malicious.c0188e
APEX	Malicious
Kaspersky	VHO:Trojan-Dropper.Win32.Dapato.gen
Sophos	ML/PE-A
CrowdStrike	win/malicious_confidence_70% (W)

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x0000a200', u'virtual_address': u'0x00026000', u'entropy': 7.846830410596916, u'name': u'.data', u'virtual_size': u'0x0000b4f0'}				entropy	7.8468304106				description	A section with a high entropy has been found
entropy	0.20716112532				description	Overall entropy of this PE file is high

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14