Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Oct. 27, 2021, 9:30 a.m.	Oct. 27, 2021, 9:32 a.m.

Size	133.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`e6fa3028cd03318496852718143d256f`
SHA256	`f60a52512773b52def9ba9ce8aad61144d2cf351f6bc04d1c5a13abef8f3b89b`
CRC32	`3AEF8268`
ssdeep	`3072:aMGPLnkqtBoZ9B8ocW48kLcOpd29oRFdf:aZP7dXoZ9B8GJkVrd`
PDB Path	d:\Projects\My\loic\loic\obj\Release\LOIC.pdb
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware IsPE32 - (no description) Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT

LOIC.exe "C:\Users\test22\AppData\Local\Temp\LOIC.exe"
2496

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 27, 2021, 9:23 a.m.			0	0
IsDebuggerPresent Oct. 27, 2021, 9:23 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (10 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002776f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000277760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000277760 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000278560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000278560 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4dfe10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da1d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da1d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da1d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 27, 2021, 9:23 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4da1d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

d:\Projects\My\loic\loic\obj\Release\LOIC.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 27, 2021, 9:23 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 57 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000630000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000810000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1121000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef17bb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 720896 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000aa0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1122000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1124000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1124000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1124000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1124000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9198a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a3c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a66000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91a40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9199c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ab0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9199a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe919ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe919dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe919ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91982000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9199b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9198b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ab1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fefa937000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 27, 2021, 9:23 a.m.	process_identifier: 2496 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91af7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0001c400', u'virtual_address': u'0x00002000', u'entropy': 7.576787648284371, u'name': u'.text', u'virtual_size': u'0x0001c234'}

entropy

7.57678764828

description

A section with a high entropy has been found

entropy

0.852830188679

description

Overall entropy of this PE file is high

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Lionic	Trojan.MSIL.Agent.9!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.YakbeexMSIL.ZZ4
McAfee	HTool-Loic
Malwarebytes	HackTool.LOIC
Zillya	Tool.LOIC.Win32.151
Sangfor	Hacktool.MSIL.Flooder.gen
K7AntiVirus	Trojan ( 700000121 )
Alibaba	HackTool:MSIL/Uflooder.7cd5d9d1
K7GW	Trojan ( 700000121 )
Cybereason	malicious.8cd033
Arcabit	Application.Hacktool.US
Cyren	W32/MSIL_LOIC.CRA.gen!Eldorado
Symantec	Hacktool
ESET-NOD32	MSIL/HackTool.LOIC.AF potentially unsafe
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Tool.Loic-11
Kaspersky	HEUR:Trojan-DDoS.MSIL.Agent.gen
BitDefender	Application.Hacktool.US
NANO-Antivirus	Trojan.Win32.Mlw.eswpzj
ViRobot	Keygen.136192
MicroWorld-eScan	Application.Hacktool.US
Avast	Win32:Loic-A [Trj]
Tencent	Win32.Trojan.Agent.Wzsd
Ad-Aware	Application.Hacktool.US
Emsisoft	Application.Hacktool.US (B)
Comodo	Malware@#2bq2788hhdirm
DrWeb	Tool.Flooder.81
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_SPNR.0BA015
McAfee-GW-Edition	HTool-Loic
FireEye	Generic.mg.e6fa3028cd033184
Sophos	Mal/Generic-R + Troj/Loic-A
Ikarus	HackTool.Loic
Jiangmin	HackTool.MSIL.aet
Webroot	Hacktool:Oylecann.A
Avira	TR/Flooder.136192
Antiy-AVL	Trojan/Generic.ASMalwS.D68E39
Kingsoft	Win32.HackTool.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Agent.dg
Microsoft	HackTool:MSIL/Uflooder.C!bit
SUPERAntiSpyware	Hack.Tool/Gen-LOIC
GData	Application.Hacktool.US
AhnLab-V3	Trojan/Win32.Loic.R131592
VBA32	TScope.Trojan.MSIL
ALYac	Misc.HackTool.Loic
MAX	malware (ai score=100)
Cylance	Unsafe

LOIC.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All