Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 16, 2021, 1:20 p.m.	Oct. 16, 2021, 1:33 p.m.

Size	289.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b007ee7994afb90b45e3fb23d0acc313`
SHA256	`f4fac38f145a5b369bf01511466f7fbafc0fa12abdde0f5838321885cb252f9e`
CRC32	`CF90DF8F`
ssdeep	`6144:mE/z/NMkhBxim3La4JOkNfefbpk8tzLZ2rkjs:pmSBnba4JheXzs`
PDB Path	cDisplayClass4.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

.wininit.exe "C:\Users\test22\AppData\Local\Temp\.wininit.exe"
1944

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 16, 2021, 1:20 p.m.			0	0
IsDebuggerPresent Oct. 16, 2021, 1:20 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

cDisplayClass4.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 16, 2021, 1:20 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (26 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 1703936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00920000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x731a2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 1507328 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02080000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x70692000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1944 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00047a00', u'virtual_address': u'0x00002000', u'entropy': 7.760920626530969, u'name': u'.text', u'virtual_size': u'0x000479a4'}

entropy

7.76092062653

description

A section with a high entropy has been found

entropy

0.991349480969

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 16, 2021, 1:20 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 2332 process_handle: 0x00000264
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 2332 process_handle: 0x00000264	1
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 2512 process_handle: 0x00000270
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 2512 process_handle: 0x00000270	1
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 1776 process_handle: 0x00000278
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 1776 process_handle: 0x00000278	1
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 424 process_handle: 0x00000280
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 424 process_handle: 0x00000280	1
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 2808 process_handle: 0x00000288
NtTerminateProcess Oct. 16, 2021, 1:20 p.m.	status_code: 0xffffffff process_identifier: 2808 process_handle: 0x00000288	1

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2332 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2512 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268	3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1776 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 424 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	3221225496
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2808 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 1944 manipulating memory of non-child process 2332
Process injection	Process 1944 manipulating memory of non-child process 2512
Process injection	Process 1944 manipulating memory of non-child process 1776
Process injection	Process 1944 manipulating memory of non-child process 424
Process injection	Process 1944 manipulating memory of non-child process 2808
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2332 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254	3221225496	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2512 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268	3221225496	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1776 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c	3221225496	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 424 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274	3221225496	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2808 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c	3221225496	0

Executed a process and injected code into it, probably while unpacking (18 events)

Time & API	Arguments	Status	Return
NtResumeThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 1944	1	0
NtResumeThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 1944	1	0
NtResumeThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 1944	1	0
CreateProcessInternalW Oct. 16, 2021, 1:20 p.m.	thread_identifier: 1792 thread_handle: 0x00000250 process_identifier: 2332 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\.wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000254	1	1
NtGetContextThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x00000250	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2332 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000254		3221225496
CreateProcessInternalW Oct. 16, 2021, 1:20 p.m.	thread_identifier: 2812 thread_handle: 0x00000264 process_identifier: 2512 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\.wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000268	1	1
NtGetContextThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x00000264	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2512 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000268		3221225496
CreateProcessInternalW Oct. 16, 2021, 1:20 p.m.	thread_identifier: 2760 thread_handle: 0x00000270 process_identifier: 1776 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\.wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000026c	1	1
NtGetContextThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x00000270	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 1776 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000026c		3221225496
CreateProcessInternalW Oct. 16, 2021, 1:20 p.m.	thread_identifier: 2920 thread_handle: 0x00000278 process_identifier: 424 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\.wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000274	1	1
NtGetContextThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x00000278	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 424 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000274		3221225496
CreateProcessInternalW Oct. 16, 2021, 1:20 p.m.	thread_identifier: 2748 thread_handle: 0x00000280 process_identifier: 2808 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\.wininit.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\.wininit.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000027c	1	1
NtGetContextThread Oct. 16, 2021, 1:20 p.m.	thread_handle: 0x00000280	1	0
NtAllocateVirtualMemory Oct. 16, 2021, 1:20 p.m.	process_identifier: 2808 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000027c		3221225496

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Lionic	Trojan.MSIL.Noon.l!c
Elastic	malicious (high confidence)
DrWeb	Trojan.Packed2.43506
MicroWorld-eScan	Trojan.GenericKD.37803724
FireEye	Generic.mg.b007ee7994afb90b
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00588f391 )
Alibaba	Trojan:Win32/Kryptik.ali2000016
K7GW	Trojan ( 00588f391 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZemsilF.34218.sm0@aC6vo2m
Cyren	W32/MSIL_Kryptik.FWD.gen!Eldorado
Symantec	Trojan.Gen.9
ESET-NOD32	a variant of MSIL/Kryptik.ADEJ
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.MSIL.Noon.gen
BitDefender	Trojan.GenericKD.37803724
Avast	Win32:PWSX-gen [Trj]
Ad-Aware	Trojan.GenericKD.37803724
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Agent.mqnew@0
McAfee-GW-Edition	RDN/Generic PWS.y
Emsisoft	Trojan.GenericKD.37803724 (B)
Ikarus	Trojan-Spy.Keylogger.AgentTesla
MAX	malware (ai score=99)
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/AgentTesla!ml
ZoneAlarm	HEUR:Trojan-Spy.MSIL.Noon.gen
GData	Trojan.GenericKD.37803724
Cynet	Malicious (score: 100)
McAfee	RDN/Generic PWS.y
Malwarebytes	Trojan.MalPack
TrendMicro-HouseCall	TROJ_FRS.VSNW0FJ21
SentinelOne	Static AI - Suspicious PE
Fortinet	MSIL/Kryptik.ADDN!tr
AVG	Win32:PWSX-gen [Trj]
MaxSecure	Trojan.Malware.300983.susgen

.wininit.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All