clip.exe

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

The executable uses a known packer (1 event)

packer

UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses March 23, 2023, 1:01 p.m.	flags: 16 family: 0	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x0042ea00', u'virtual_address': u'0x0039f000', u'entropy': 7.893639426606801, u'name': u'UPX1', u'virtual_size': u'0x0042f000'}				entropy	7.89363942661				description	A section with a high entropy has been found
entropy	0.999883259398				description	Overall entropy of this PE file is high

The executable is compressed using UPX (3 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX
section	UPX2				description	Section name indicates UPX

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\clip.exe

reg_value

C:\Users\test22\AppData\Local\Temp\clip.exe

Attempts to create or modify system certificates (2 events)

registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2796BAE63F1801E277261BA0D77770028F20EEE4\Blob

Detects the presence of Wine emulator (1 event)

Time & API	Arguments	Status	Return	Repeated
LdrGetProcedureAddress March 23, 2023, 1:01 p.m.	ordinal: 0 function_address: 0x0022fb39 function_name: wine_get_version module: ntdll module_address: 0x778a0000		3221225785	0

File has been identified by 26 AntiVirus engines on VirusTotal as malicious (26 events)

Lionic	Riskware.Win32.Generic.1!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Razy.873823
FireEye	Gen:Variant.Razy.873823
ALYac	Gen:Variant.Razy.873823
Malwarebytes	Malware.Heuristic.1003
Sangfor	Riskware.Win32.Razy.Vc8k
CrowdStrike	win/malicious_confidence_70% (W)
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	not-a-virus:HEUR:RiskTool.Win32.Generic
BitDefender	Gen:Variant.Razy.873823
BitDefenderTheta	Gen:NN.ZexaF.36344.@pGfaSi!0Y
VIPRE	Gen:Variant.Razy.873823
Trapmine	suspicious.low.ml.score
Sophos	Generic ML PUA (PUA)
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	GrayWare/Win32.Kryptik.ffp
Gridinsoft	PUP.Win32.Heur.cl
Arcabit	Trojan.Razy.DD555F
GData	Gen:Variant.Razy.873823
TrendMicro-HouseCall	TROJ_GEN.R002H07CM23
Tencent	Win32.Risktool.Generic.Dkjl
MAX	malware (ai score=82)