popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

loader1.exe

PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 15, 2021, 1:03 p.m. June 15, 2021, 1:05 p.m.
Size 219.3KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 ca473ade92ba6526bf258bfeffc7248e
SHA256 06a1c5e88cebab0737f64cc311b0eb0e1ea159e98216743737f4683fef66849f
CRC32 E0FAA375
ssdeep 6144:Ds9g3o9J2aPgi/fr52x9KklYKruuEcRTDiGK0mHyPi:yx2aX/fWMaYS5Ec4Vnai
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)

Name Response Post-Analysis Lookup
www.accelerator.sydney
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.212
www.sportsiri.com
A 34.102.136.180
CNAME sportsiri.com
34.102.136.180
www.jimmymasks.com
A 96.126.123.244
A 72.14.185.43
A 72.14.178.174
A 45.33.23.183
A 45.79.19.196
A 198.58.118.167
A 45.33.30.197
A 45.33.20.235
A 45.56.79.23
A 45.33.2.79
A 45.33.18.44
A 173.255.194.134
45.33.23.183
www.bancambios.network
CNAME bancambios.network
A 185.224.138.83
185.224.138.83
www.xn--2o2b1z87x8sb.com
A 203.245.44.109
CNAME xn--2o2b1z87x8sb.com
203.245.44.109
www.oceancollaborative.com
A 184.168.131.241
CNAME oceancollaborative.com
184.168.131.241
www.amazingfinds4u.com
A 66.235.200.29
66.235.200.29
www.woodlandsceinics.com
A 103.224.182.242
103.224.182.242
www.trickshow.club
www.spinecompanion.com
A 217.70.184.50
CNAME webredir.vip.gandi.net
217.70.184.50
www.ilium-partners.com
CNAME webacc8.sd5.ghst.net
A 155.133.138.10
155.133.138.10
www.underce.com
A 75.2.73.220
CNAME vallble01.xshoppy.shop
75.2.73.220
www.doodstore.net
A 67.199.248.12
CNAME doodstore.net
A 67.199.248.13
67.199.248.13
www.kesat-ya10.com
www.5australiacl.com
A 52.147.15.202
52.147.15.202
IP Address Status Action
103.224.182.242 Active Moloch
155.133.138.10 Active Moloch
164.124.101.2 Active Moloch
184.168.131.241 Active Moloch
185.224.138.83 Active Moloch
198.54.117.212 Active Moloch
203.245.44.109 Active Moloch
217.70.184.50 Active Moloch
34.102.136.180 Active Moloch
45.79.19.196 Active Moloch
52.147.15.202 Active Moloch
66.235.200.29 Active Moloch
67.199.248.13 Active Moloch
75.2.73.220 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 203.245.44.109:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 203.245.44.109:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49231 -> 203.245.44.109:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 217.70.184.50:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 217.70.184.50:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 217.70.184.50:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 185.224.138.83:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 185.224.138.83:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49233 -> 185.224.138.83:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49230 -> 45.79.19.196:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49230 -> 45.79.19.196:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49230 -> 45.79.19.196:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 67.199.248.13:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 67.199.248.13:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 67.199.248.13:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 52.147.15.202:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 52.147.15.202:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 52.147.15.202:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49224 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 66.235.200.29:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 66.235.200.29:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 66.235.200.29:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 185.224.138.83:80 -> 192.168.56.101:49205 2030694 ET INFO BitNinja IO Security Check Misc activity
TCP 192.168.56.101:49228 -> 155.133.138.10:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49228 -> 155.133.138.10:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49228 -> 155.133.138.10:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 203.245.44.109:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 203.245.44.109:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 203.245.44.109:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 75.2.73.220:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 75.2.73.220:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 75.2.73.220:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.224.138.83:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.224.138.83:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 185.224.138.83:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 103.224.182.242:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 103.224.182.242:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 103.224.182.242:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49226 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.xn--2o2b1z87x8sb.com/bp3i/?hL3=w0/TDHIc1+HezrcFGU9wSyY7ZohJU/wG9FEU96VZi51pjs1Dms3z4YPKKIrAiX80z3Y2jYtY&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.bancambios.network/bp3i/?hL3=So2Tvg858PudF6S1Cru7EIQwZdKNOPQNXuZSsJd01w7rfiOz13eukPZjJ6Gsx5OGTBQdT6aj&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.sportsiri.com/bp3i/?hL3=aSvVGLLpXGw3OAXV2aZVnJ1iJf4AHcjemKA4E5Yqpc3oSPveS9L08/xGI3+5sNlqw1RF4nLk&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.spinecompanion.com/bp3i/?hL3=UA97/2DLXKvRnJU1h5VkqIpiqoWZJQJaus3zswYLrPQqMJGDrodJLS3TF80ieNuahAh9dksl&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.5australiacl.com/bp3i/?hL3=hlnmpWaLZzqLg9zidSvt+F/U/z6DLEVPJskb4RYsomUGO653irWJR3qFMH9TKGvgkpiCGqB2&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.doodstore.net/bp3i/?hL3=/O9fLU9dXI4Cg+gPjcQBjfSEDJBN8B2QQZuj7hhytBKbSIIxNnTjzVeygiwHPQAKsYvifEbO&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.amazingfinds4u.com/bp3i/?hL3=bHJAk3e2glQskLGcTBS4vnjCgYmn0W+yUItAHYRq6yKEhUAjOaA0BT1d8jwk1zuBKu571AZE&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.underce.com/bp3i/?hL3=80R/aSnSgbRYdyr7r61KDuAjYp2ZOr6pxPEzYeucJoCeLW8wo5sSyEnb1mJuzTy6cctVr7FI&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.woodlandsceinics.com/bp3i/?hL3=Dvte5eMh4FNlY5y4dnXfAFPL/8NXIF8YbtIAyCtpXIsx8mzur4SWz4GVMQCeSs9HFgJ9jJbz&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.accelerator.sydney/bp3i/?hL3=5pzeLuL3qyMdskDBx9eOPWveezrEwfwg/RcpCnMq22iE3aWrSKVhMe7FGWAUc7no09HPCT8S&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.oceancollaborative.com/bp3i/?hL3=+tA82degRgcQ4mmnQvXabF4qHjy6FJLdLGPOjGCu1vH9ecmhDfriaGule7Kf6ooavhCfc5XG&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.ilium-partners.com/bp3i/?hL3=bo80QDzEQyeGlZ8OUNyFMOAGqFcw71Q6/aO3zFCRtVVR0Kvd9F7XtEJsT/rJgDgTWE10iob7&opg=3foxnfH0Q0S0kj
suspicious_features GET method with no useragent header suspicious_request GET http://www.jimmymasks.com/bp3i/?hL3=vg5JU+BuXPY7P8htzulhoqwJTr5Zsvmf06SFUFvrLdUMeNvvl7hYXpnUg5SknS6N/5SQFa8e&opg=3foxnfH0Q0S0kj
request POST http://www.xn--2o2b1z87x8sb.com/bp3i/
request GET http://www.xn--2o2b1z87x8sb.com/bp3i/?hL3=w0/TDHIc1+HezrcFGU9wSyY7ZohJU/wG9FEU96VZi51pjs1Dms3z4YPKKIrAiX80z3Y2jYtY&opg=3foxnfH0Q0S0kj
request POST http://www.bancambios.network/bp3i/
request GET http://www.bancambios.network/bp3i/?hL3=So2Tvg858PudF6S1Cru7EIQwZdKNOPQNXuZSsJd01w7rfiOz13eukPZjJ6Gsx5OGTBQdT6aj&opg=3foxnfH0Q0S0kj
request POST http://www.sportsiri.com/bp3i/
request GET http://www.sportsiri.com/bp3i/?hL3=aSvVGLLpXGw3OAXV2aZVnJ1iJf4AHcjemKA4E5Yqpc3oSPveS9L08/xGI3+5sNlqw1RF4nLk&opg=3foxnfH0Q0S0kj
request POST http://www.spinecompanion.com/bp3i/
request GET http://www.spinecompanion.com/bp3i/?hL3=UA97/2DLXKvRnJU1h5VkqIpiqoWZJQJaus3zswYLrPQqMJGDrodJLS3TF80ieNuahAh9dksl&opg=3foxnfH0Q0S0kj
request POST http://www.5australiacl.com/bp3i/
request GET http://www.5australiacl.com/bp3i/?hL3=hlnmpWaLZzqLg9zidSvt+F/U/z6DLEVPJskb4RYsomUGO653irWJR3qFMH9TKGvgkpiCGqB2&opg=3foxnfH0Q0S0kj
request POST http://www.doodstore.net/bp3i/
request GET http://www.doodstore.net/bp3i/?hL3=/O9fLU9dXI4Cg+gPjcQBjfSEDJBN8B2QQZuj7hhytBKbSIIxNnTjzVeygiwHPQAKsYvifEbO&opg=3foxnfH0Q0S0kj
request POST http://www.amazingfinds4u.com/bp3i/
request GET http://www.amazingfinds4u.com/bp3i/?hL3=bHJAk3e2glQskLGcTBS4vnjCgYmn0W+yUItAHYRq6yKEhUAjOaA0BT1d8jwk1zuBKu571AZE&opg=3foxnfH0Q0S0kj
request POST http://www.underce.com/bp3i/
request GET http://www.underce.com/bp3i/?hL3=80R/aSnSgbRYdyr7r61KDuAjYp2ZOr6pxPEzYeucJoCeLW8wo5sSyEnb1mJuzTy6cctVr7FI&opg=3foxnfH0Q0S0kj
request POST http://www.woodlandsceinics.com/bp3i/
request GET http://www.woodlandsceinics.com/bp3i/?hL3=Dvte5eMh4FNlY5y4dnXfAFPL/8NXIF8YbtIAyCtpXIsx8mzur4SWz4GVMQCeSs9HFgJ9jJbz&opg=3foxnfH0Q0S0kj
request POST http://www.accelerator.sydney/bp3i/
request GET http://www.accelerator.sydney/bp3i/?hL3=5pzeLuL3qyMdskDBx9eOPWveezrEwfwg/RcpCnMq22iE3aWrSKVhMe7FGWAUc7no09HPCT8S&opg=3foxnfH0Q0S0kj
request POST http://www.oceancollaborative.com/bp3i/
request GET http://www.oceancollaborative.com/bp3i/?hL3=+tA82degRgcQ4mmnQvXabF4qHjy6FJLdLGPOjGCu1vH9ecmhDfriaGule7Kf6ooavhCfc5XG&opg=3foxnfH0Q0S0kj
request POST http://www.ilium-partners.com/bp3i/
request GET http://www.ilium-partners.com/bp3i/?hL3=bo80QDzEQyeGlZ8OUNyFMOAGqFcw71Q6/aO3zFCRtVVR0Kvd9F7XtEJsT/rJgDgTWE10iob7&opg=3foxnfH0Q0S0kj
request POST http://www.jimmymasks.com/bp3i/
request GET http://www.jimmymasks.com/bp3i/?hL3=vg5JU+BuXPY7P8htzulhoqwJTr5Zsvmf06SFUFvrLdUMeNvvl7hYXpnUg5SknS6N/5SQFa8e&opg=3foxnfH0Q0S0kj
request POST http://www.xn--2o2b1z87x8sb.com/bp3i/
request POST http://www.bancambios.network/bp3i/
request POST http://www.sportsiri.com/bp3i/
request POST http://www.spinecompanion.com/bp3i/
request POST http://www.5australiacl.com/bp3i/
request POST http://www.doodstore.net/bp3i/
request POST http://www.amazingfinds4u.com/bp3i/
request POST http://www.underce.com/bp3i/
request POST http://www.woodlandsceinics.com/bp3i/
request POST http://www.accelerator.sydney/bp3i/
request POST http://www.oceancollaborative.com/bp3i/
request POST http://www.ilium-partners.com/bp3i/
request POST http://www.jimmymasks.com/bp3i/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73ce4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73cd4000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 112
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 56897
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00335030
process_handle: 0xffffffff
3221225477 0

NtAllocateVirtualMemory

 process_identifier: 1772
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsu6378.tmp\System.dll
file C:\Users\test22\AppData\Local\Temp\nsu6378.tmp\System.dll
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x000001dc
process_name: audiodg.exe
process_identifier: 892
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: WmiPrvSE.exe
process_identifier: 1916
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: pw.exe
process_identifier: 2816
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: SearchIndexer.exe
process_identifier: 2940
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: SearchProtocolHost.exe
process_identifier: 1480
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: SearchFilterHost.exe
process_identifier: 3040
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: SearchProtocolHost.exe
process_identifier: 2120
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: mobsync.exe
process_identifier: 2492
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: pw.exe
process_identifier: 3064
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: taskhost.exe
process_identifier: 2764
1 1 0

Process32NextW

 snapshot_handle: 0x000001dc
process_name: loader1.exe
process_identifier: 112
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Process injection Process 112 called NtSetContextThread to modify thread in remote process 1772
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313216
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f0
process_identifier: 1772
1 0 0
MicroWorld-eScan Gen:Variant.Nemesis.1556
FireEye Generic.mg.ca473ade92ba6526
McAfee Artemis!CA473ADE92BA
Cylance Unsafe
K7AntiVirus Trojan ( 0057de9f1 )
Alibaba TrojanPSW:Win32/Injector.e0a81307
K7GW Trojan ( 0057de9f1 )
Cybereason malicious.a4966d
Cyren W32/Agent.CXX.gen!Eldorado
Symantec Trojan.Gen.2
ESET-NOD32 NSIS/Injector.AMA
APEX Malicious
Avast FileRepMalware
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan-PSW.Win32.Stelega.gen
BitDefender Gen:Variant.Nemesis.1556
Paloalto generic.ml
Sophos Mal/Generic-S + Troj/Formbok-NC
DrWeb Trojan.Loader.844
McAfee-GW-Edition BehavesLike.Win32.Dropper.dc
Emsisoft Gen:Variant.Nemesis.1556 (B)
SentinelOne Static AI - Malicious PE
Avira TR/Injector.wdpuw
MAX malware (ai score=86)
Gridinsoft Trojan.Win32.Downloader.oa
Microsoft Trojan:Win32/Tnega.KF!MTB
AegisLab Trojan.Win32.Stelega.i!c
GData Gen:Variant.Nemesis.1556
ALYac Gen:Variant.Nemesis.1556
VBA32 Trojan.Wacatac
TrendMicro-HouseCall TROJ_GEN.R002H0DFD21
Fortinet W32/Kryptik.J!tr
Webroot W32.Malware.Gen
AVG FileRepMalware
Panda Trj/CI.A