Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 13, 2021, 6:26 p.m.	July 13, 2021, 6:29 p.m.

Size	846.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`f9d986194bfbc6d9e56e62a7e6f3f1f7`
SHA256	`8eb065a0ab7b4771f2fb1ec4264cd0c1505a948b358e200b46ce5e540fcbdbf5`
CRC32	`E25F4CE6`
ssdeep	`24576:FAHnh+eWsN3skA4RV1Hom2KXMmHa5Gl5:0h+ZkldoPK8Ya5E`
Yara	IsPE32 - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check Device_Check_Zero - Device Check Zero UPX_Zero - UPX packed file FindFirstVolume_Zero - FindFirstVolume Zero CryptGenKey_Zero - CryptGenKey Zero Process_Snapshot_Kill_Zero - Process Kill Zero

umbr.exe "C:\Users\test22\AppData\Local\Temp\umbr.exe"
2232
- run.exe C:\Users\Public\run.exe
  492
explorer.exe C:\Windows\Explorer.EXE
1848

Name	Response	Post-Analysis Lookup
newja.webtm.ru	A 92.53.96.150	92.53.96.150

IP Address	Status	Action
164.124.101.2	Active	Moloch
92.53.96.150	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 13, 2021, 6:26 p.m.			0	0
IsDebuggerPresent July 13, 2021, 6:26 p.m.			0	0
IsDebuggerPresent July 13, 2021, 6:26 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey July 13, 2021, 6:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00568c38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 13, 2021, 6:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00568b38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey July 13, 2021, 6:27 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00568b38 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 13, 2021, 6:26 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Performs some HTTP requests (1 event)

request

GET http://newja.webtm.ru/mad.zip

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

newja.webtm.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (37 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 2232 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72b62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 2232 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x038c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 2031616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00910000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70561000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70562000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 1638400 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02060000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00505000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0050b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00507000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:26 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f01000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f02000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f04000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004fc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f05000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f12000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ee000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f08000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f0a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f13000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW July 13, 2021, 6:28 p.m.	total_number_of_free_bytes: 13726597120 free_bytes_available: 13726597120 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\Public\run.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW July 13, 2021, 6:27 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (11 events)

description	Match Windows Http API call	rule	Str_Win32_Http_API
description	Steal credential	rule	local_credential_Steal
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 1568 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0	0

Manipulates memory of a non-child process indicative of process injection (3 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 492 manipulating memory of non-child process 1568
NtUnmapViewOfSection July 13, 2021, 6:27 p.m.	base_address: 0x00400000 region_size: 331776 process_identifier: 1568 process_handle: 0x00000278	1	0	0
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 1568 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 492 called NtSetContextThread to modify thread in remote process 1568
NtSetContextThread July 13, 2021, 6:27 p.m.	registers.eip: 2000355780 registers.esp: 1374836 registers.edi: 0 registers.eax: 4456511 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 1568	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 492 resumed a thread in remote process 1568
NtResumeThread July 13, 2021, 6:27 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 1568	1	0	0

Executed a process and injected code into it, probably while unpacking (12 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW July 13, 2021, 6:26 p.m.	thread_identifier: 2208 thread_handle: 0x00000258 process_identifier: 2680 current_directory: filepath: C:\Windows\System32\rundll32.exe track: 1 command_line: "C:\Windows\system32\rundll32.exe" "C:\Windows\syswow64\WININET.dll",DispatchAPICall 1 filepath_r: C:\Windows\system32\rundll32.exe stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000025c	1	1
CreateProcessInternalW July 13, 2021, 6:26 p.m.	thread_identifier: 1976 thread_handle: 0x00000450 process_identifier: 492 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: C:\Users\Public\run.exe filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x0000045c	1	1
CreateProcessInternalW July 13, 2021, 6:26 p.m.	thread_identifier: 0 thread_handle: 0x00000000 process_identifier: 0 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 0 command_line: C:\Users\Public\run2.exe filepath_r: stack_pivoted: 0 creation_flags: 0 () inherit_handles: 0 process_handle: 0x00000000		0
NtResumeThread July 13, 2021, 6:26 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 492	1	0
NtResumeThread July 13, 2021, 6:26 p.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 492	1	0
NtResumeThread July 13, 2021, 6:26 p.m.	thread_handle: 0x00000190 suspend_count: 1 process_identifier: 492	1	0
CreateProcessInternalW July 13, 2021, 6:27 p.m.	thread_identifier: 2692 thread_handle: 0x0000027c process_identifier: 1568 current_directory: C:\Users\Public filepath: track: 1 command_line: C:\Users\Public\run.exe filepath_r: stack_pivoted: 0 creation_flags: 134217740 (CREATE_NO_WINDOW\|CREATE_SUSPENDED\|DETACHED_PROCESS) inherit_handles: 0 process_handle: 0x00000278	1	1
NtUnmapViewOfSection July 13, 2021, 6:27 p.m.	base_address: 0x00400000 region_size: 331776 process_identifier: 1568 process_handle: 0x00000278	1	0
NtAllocateVirtualMemory July 13, 2021, 6:27 p.m.	process_identifier: 1568 region_size: 610304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000278	1	0
NtGetContextThread July 13, 2021, 6:27 p.m.	thread_handle: 0x0000027c	1	0
NtSetContextThread July 13, 2021, 6:27 p.m.	registers.eip: 2000355780 registers.esp: 1374836 registers.edi: 0 registers.eax: 4456511 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000027c process_identifier: 1568	1	0
NtResumeThread July 13, 2021, 6:27 p.m.	thread_handle: 0x0000027c suspend_count: 1 process_identifier: 1568	1	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Lionic	Hacktool.Win32.Gamehack.3!e
MicroWorld-eScan	Trojan.GenericKD.37141768
FireEye	Trojan.GenericKD.37141768
CAT-QuickHeal	Trojanpws.Msil
McAfee	Artemis!F9D986194BFB
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 0057d9aa1 )
Alibaba	TrojanDownloader:Win32/Bingoml.b06edc6d
K7GW	Trojan-Downloader ( 0057d9aa1 )
Cybereason	malicious.3139e5
Arcabit	Trojan.Generic.D236BD08
Cyren	W32/Trojan.SRSM-1551
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/TrojanDownloader.Autoit.PDT
TrendMicro-HouseCall	TROJ_GEN.R002C0PFM21
Paloalto	generic.ml
Kaspersky	Trojan.Win32.Bingoml.bwgb
BitDefender	Trojan.GenericKD.37141768
Avast	Win32:Trojan-gen
Ad-Aware	Trojan.GenericKD.37141768
Emsisoft	Trojan-Downloader.Autoit (A)
Comodo	Malware@#804huqmx9gj
DrWeb	Trojan.Siggen14.12702
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PFM21
McAfee-GW-Edition	BehavesLike.Win32.TrojanAitInject.ch
Sophos	Mal/Generic-S
APEX	Malicious
Webroot	W32.Malware.Gen
Avira	TR/Downloader.ihenr
MAX	malware (ai score=100)
Kingsoft	Win32.Troj.Bingoml.bw.(kcloud)
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Tiggre!rfn
ViRobot	Trojan.Win32.Z.Nymeria.866304.H
GData	Trojan.GenericKD.37141768
Cynet	Malicious (score: 99)
VBA32	Trojan.Bingoml
ALYac	Trojan.GenericKD.37141768
Malwarebytes	Trojan.Agent.AutoIt
Ikarus	Trojan-Downloader.Win32.AutoIt
Fortinet	W32/Autoit.PDT!tr.dldr
MaxSecure	Trojan.Malware.119094307.susgen
AVG	Win32:Trojan-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Loda.HgIASXAA

umbr.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All