Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 19, 2021, 1:24 p.m.	May 19, 2021, 1:30 p.m.

Size	478.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`c436b9b71dd9f9bd7872f288fd632fb8`
SHA256	`0394635a92cc7ec39b77d0393db4cacd48809d659705e1bf98e57a2888f41795`
CRC32	`CA110DDE`
ssdeep	`12288:QfuWyy0mhGwOmqqO7BUwjLBKS7aOykpIn7+ROs68//tqMvOeiGBm0qLlE1:QGWv8xmF6VJaOdpInHsRU`
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature IsPE32 - (no description)

paypal.exe "C:\Users\test22\AppData\Local\Temp\paypal.exe"
1468

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (2 events)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 19, 2021, 1:24 p.m.	computer_name: TEST22-PC	1	1	0
GetComputerNameW May 19, 2021, 1:24 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 19, 2021, 1:24 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:24 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:24 p.m.			0	0
IsDebuggerPresent May 19, 2021, 1:24 p.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 19, 2021, 1:24 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	ow{do$\x0c?
section

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 19, 2021, 1:24 p.m.	stacktrace: 0x8000d0 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8 CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2 LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63 CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998 CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726 CreateAssemblyNameObject+0x2f451 GetMetaDataInternalInterface-0x901e clr+0x5c8ea @ 0x7279c8ea DllGetClassObjectInternal+0x526a2 CorDllMainForThunk-0x39e59 clr+0x11771b @ 0x7285771b CorDllMainForThunk+0x593 _CorExeMain-0x2647 clr+0x151b07 @ 0x72891b07 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5 exception.instruction_r: 39 09 e8 0f b8 bf 6e 8b c8 39 09 e8 ba b5 73 6f exception.instruction: cmp dword ptr [ecx], ecx exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x806306 registers.esp: 1370160 registers.edi: 43819604 registers.eax: 0 registers.ebp: 1370168 registers.edx: 8416552 registers.ebx: 1370376 registers.esi: 480042551 registers.ecx: 0	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

May 19, 2021, 1:24 p.m.

stacktrace:

0x8000d0
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x72742652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x7275264f
CoUninitializeEE+0xa5b4 CreateAssemblyNameObject-0x36a1 clr+0x29df8 @ 0x72769df8
CoUninitializeEE+0xa5eb CreateAssemblyNameObject-0x366a clr+0x29e2f @ 0x72769e2f
CoUninitializeEE+0xa6b9 CreateAssemblyNameObject-0x359c clr+0x29efd @ 0x72769efd
CoUninitializeEE+0xa75e CreateAssemblyNameObject-0x34f7 clr+0x29fa2 @ 0x72769fa2
LogHelp_TerminateOnAssert+0x16b0b GetPrivateContextsPerfCounters-0x2937 clr+0x8564b @ 0x727c564b
CreateAssemblyNameObject+0x2e9ca GetMetaDataInternalInterface-0x9aa5 clr+0x5be63 @ 0x7279be63
CreateAssemblyNameObject+0x2e4ff GetMetaDataInternalInterface-0x9f70 clr+0x5b998 @ 0x7279b998
CreateAssemblyNameObject+0x2e28d GetMetaDataInternalInterface-0xa1e2 clr+0x5b726 @ 0x7279b726
CreateAssemblyNameObject+0x2f451 GetMetaDataInternalInterface-0x901e clr+0x5c8ea @ 0x7279c8ea
DllGetClassObjectInternal+0x526a2 CorDllMainForThunk-0x39e59 clr+0x11771b @ 0x7285771b
CorDllMainForThunk+0x593 _CorExeMain-0x2647 clr+0x151b07 @ 0x72891b07
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x72891e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x72891f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7289416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x7376f5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x743c7f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x743c4de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x773d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x773d9ea5

exception.instruction_r: 39 09 e8 0f b8 bf 6e 8b c8 39 09 e8 ba b5 73 6f
exception.instruction: cmp dword ptr [ecx], ecx
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x806306
registers.esp: 1370160
registers.edi: 43819604
registers.eax: 0
registers.ebp: 1370168
registers.edx: 8416552
registers.ebx: 1370376
registers.esi: 480042551
registers.ecx: 0

Allocates read-write-execute memory (usually to unpack itself) (42 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72741000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72742000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02220000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00462000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0047c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 438272 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b22000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00801000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00802000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00803000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00805000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b20000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1
NtProtectVirtualMemory May 19, 2021, 1:24 p.m.	process_identifier: 1468 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b8e000 process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0006b000', u'virtual_address': u'0x00002000', u'entropy': 7.999581583966703, u'name': u'ow{do$\\x0c?', u'virtual_size': u'0x0006ae40'}

entropy

7.99958158397

description

A section with a high entropy has been found

entropy

0.896335078534

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW May 19, 2021, 1:24 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

File has been identified by 37 AntiVirus engines on VirusTotal as malicious (37 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.697969
FireEye	Generic.mg.c436b9b71dd9f9bd
McAfee	PWS-FCSO!C436B9B71DD9
Sangfor	Trojan.Win32.Save.a
Cybereason	malicious.71dd9f
BitDefenderTheta	Gen:NN.ZemsilF.34690.Du0@ai2ORRi
Cyren	W32/MSIL_Kryptik.CZQ.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.ERTO
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
ClamAV	Win.Packed.Razy-9808221-0
Kaspersky	HEUR:Trojan.MSIL.Injuke.gen
BitDefender	Gen:Variant.Razy.697969
Ad-Aware	Gen:Variant.Razy.697969
Emsisoft	Gen:Variant.Razy.697969 (B)
TrendMicro	Trojan.MSIL.BOILOD.SM4.hp
McAfee-GW-Edition	BehavesLike.Win32.Packed.gc
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1139302
MAX	malware (ai score=84)
Microsoft	Trojan:Win32/AgentTesla!ml
Gridinsoft	Trojan.Heur!.03013281
GData	MSIL.Trojan.Gogo.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Wacatac.C4200479
Acronis	suspicious
ALYac	Gen:Variant.Razy.697969
Cylance	Unsafe
TrendMicro-HouseCall	Trojan.MSIL.BOILOD.SM4.hp
Rising	Trojan.Injuke!8.10932 (CLOUD)
Yandex	Trojan.Slntscn24.bVfx7x
eGambit	Unsafe.AI_Score_99%
AVG	Win32:MalwareX-gen [Trj]

paypal.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All