Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 27, 2023, 9:45 a.m.	April 27, 2023, 9:55 a.m.

Size	15.1KB
Type	PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`881bef8377f48946c3863d06b3de735a`
SHA256	`3147bb5595c16445b63ad43b9c5019f98bc881b2032634128aec7f97282578d7`
CRC32	`D2459AD8`
ssdeep	`384:EuAfvvbBnFoTE/TKZRthUOGs7KFKjqfvGBkSy:BAf3b1FkamRtuOn7KFKcMk3`
PDB Path	C:\PROJ\LOADERS\CS\hmloader\calcinstall\obj\Release\calcinstall.pdb
Yara	Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) PE_Header_Zero - PE File Signature

calcinstall.exe "C:\Users\test22\AppData\Local\Temp\calcinstall.exe"
1648
- smcalc.exe "C:\Users\test22\AppData\Local\Temp\smcalc.exe"
  2208
  - smcalc.tmp "C:\Users\test22\AppData\Local\Temp\is-JENHH.tmp\smcalc.tmp" /SL5="$20166,30886868,832512,C:\Users\test22\AppData\Local\Temp\smcalc.exe"
    2328
    - smcalc.exe "C:\Users\test22\AppData\Local\Temp\smcalc.exe" /verysilent
      2424
      - smcalc.tmp "C:\Users\test22\AppData\Local\Temp\is-T4KI2.tmp\smcalc.tmp" /SL5="$30166,30886868,832512,C:\Users\test22\AppData\Local\Temp\smcalc.exe" /verysilent
        2508
        
        taskkill.exe "taskkill.exe" /f /im "Calculator.exe"
        2592
        
        taskkill.exe "taskkill.exe" /f /im "Calculator.exe"
        2724
        
        Calculator.exe "C:\Users\test22\AppData\Local\SmartTool Calculator\Calculator.exe" minimized
        2968
        
        Calculator.exe "C:\Users\test22\AppData\Local\SmartTool Calculator\Calculator.exe" --type=renderer --no-sandbox --service-pipe-token=8726FCE7934DC1A51B2F35044C997E64 --lang=en-US --app-user-model-id=28C03FE7-5479-424F-A3A9-E2C470A11798 --app-path="C:\Users\test22\AppData\Local\SmartTool Calculator\resources\app.asar" --node-integration=true --webview-tag=false --no-sandbox --background-color=#fff --context-id=2 --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553 --disable-accelerated-video-decode --disable-gpu-compositing --enable-gpu-async-worker-context --service-request-channel-token=8726FCE7934DC1A51B2F35044C997E64 --renderer-client-id=3 --mojo-platform-channel-handle=1432 /prefetch:1
        2144
        
        reg.exe C:\Windows\system32\reg.exe QUERY HKCU\Software\SmartTools\Calculator /v channel
        2404
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
best-calc.ru	A 176.9.121.140	176.9.121.140
www.google-analytics.com	A 172.217.27.14	142.250.207.110
hamstersoft-app-install.s3.eu-west-2.amazonaws.com	A 3.5.244.142 CNAME s3-r-w.eu-west-2.amazonaws.com	52.95.142.38

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.27.14	Active	Moloch
176.9.121.140	Active	Moloch
3.5.244.142	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.103:49161 -> 3.5.244.142:443	906200054	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLSv1 192.168.56.103:49161 3.5.244.142:443	C=US, O=Amazon, OU=Server CA 1B, CN=Amazon	CN=*.s3.eu-west-2.amazonaws.com	01:4c:50:3e:74:45:88:c6:01:3c:ec:37:59:e3:3c:3f:c1:bc:32:83
TLS 1.2 192.168.56.103:49176 172.217.27.14:443	C=US, O=Google Trust Services LLC, CN=GTS CA 1C3	CN=*.google-analytics.com	07:22:19:79:30:9e:4c:35:4e:21:bd:55:7d:44:2f:a9:71:9e:4c:aa

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 27, 2023, 9:45 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (41 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0
IsDebuggerPresent April 27, 2023, 9:45 a.m.			0	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 27, 2023, 9:45 a.m.	buffer: ERROR: The process "Calculator.exe" not found. console_handle: 0x0000000b	1	1	0
WriteConsoleW April 27, 2023, 9:45 a.m.	buffer: ERROR: The process "Calculator.exe" not found. console_handle: 0x0000000b	1	1	0

This executable has a PDB path (1 event)

pdb_path

C:\PROJ\LOADERS\CS\hmloader\calcinstall\obj\Release\calcinstall.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 27, 2023, 9:45 a.m.		1	1	0

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 27, 2023, 9:45 a.m.	stacktrace: TMethodImplementationIntercept+0x1fc132 dbkFCallWrapperAddr-0x21696 smcalc+0x2b1faa @ 0x6b1faa TMethodImplementationIntercept+0x1fc132 dbkFCallWrapperAddr-0x21696 smcalc+0x2b1faa @ 0x6b1faa TMethodImplementationIntercept+0x20f8f4 dbkFCallWrapperAddr-0xded4 smcalc+0x2c576c @ 0x6c576c BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xeedfade exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 1637804 registers.edi: 0 registers.eax: 1637804 registers.ebp: 1637884 registers.edx: 0 registers.ebx: 3 registers.esi: 2 registers.ecx: 7	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

April 27, 2023, 9:45 a.m.

stacktrace:

TMethodImplementationIntercept+0x1fc132 dbkFCallWrapperAddr-0x21696 smcalc+0x2b1faa @ 0x6b1faa
TMethodImplementationIntercept+0x1fc132 dbkFCallWrapperAddr-0x21696 smcalc+0x2b1faa @ 0x6b1faa
TMethodImplementationIntercept+0x20f8f4 dbkFCallWrapperAddr-0xded4 smcalc+0x2c576c @ 0x6c576c
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xeedfade
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 1637804
registers.edi: 0
registers.eax: 1637804
registers.ebp: 1637884
registers.edx: 0
registers.ebx: 3
registers.esi: 2
registers.ecx: 7

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header

suspicious_request

GET http://best-calc.ru/api/1/update/?

Performs some HTTP requests (1 event)

request

GET http://best-calc.ru/api/1/update/?

Resolves a suspicious Top Level Domain (TLD) (1 event)

domain

best-calc.ru

description

Russian Federation domain TLD

Allocates read-write-execute memory (usually to unpack itself) (50 out of 55 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 1572864 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 1179648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00620000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00482000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004bb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0048a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004a7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 1648 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0049a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2208 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2328 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x021c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:38 a.m.	process_identifier: 1236 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000006b80000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 745472 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00401000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 73728 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004c6000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x022a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x005a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x11386000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09786000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x3dc06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0e886000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2a806000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x18086000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x11387000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09787000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x3dc07000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2968 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x09b00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72491000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x27d06000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x38986000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x2b406000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 27, 2023, 9:45 a.m.	process_identifier: 2144 region_size: 495616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x07306000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (3 events)

Time & API	Arguments	Status	Return
GetDiskFreeSpaceExW April 27, 2023, 9:38 a.m.	total_number_of_free_bytes: 0 free_bytes_available: 9801891840 root_path: C:\Users\test22\AppData\Local\Microsoft\Windows\Explorer total_number_of_bytes: 0	1	1
GetDiskFreeSpaceExW April 27, 2023, 9:45 a.m.	total_number_of_free_bytes: 17575006175232 free_bytes_available: 344 root_path: C:\Users\test22\AppData\Roaming\Calculator\blob_storage\88bb02c0-5c36-4daf-aa43-a86d18a81b93 total_number_of_bytes: 695806159778741100		0
GetDiskFreeSpaceExW April 27, 2023, 9:45 a.m.	total_number_of_free_bytes: 9801854976 free_bytes_available: 9801854976 root_path: C:\Users\test22\AppData\Roaming\Calculator\Cache total_number_of_bytes: 34252779520	1	1

Creates executable files on the filesystem (3 events)

file	C:\Users\test22\AppData\Local\Temp\smcalc.exe
file	C:\Users\test22\Desktop\Калькулятор SmartTool.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Калькулятор SmartTool.lnk

Creates a shortcut to an executable file (2 events)

file	C:\Users\test22\Desktop\Калькулятор SmartTool.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Калькулятор SmartTool.lnk

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\smcalc.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\smcalc.exe
file	C:\Users\test22\AppData\Local\Temp\is-JENHH.tmp\smcalc.tmp

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "Calculator.exe")

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW April 27, 2023, 9:45 a.m.	show_type: 0 filepath_r: C:\Users\test22\AppData\Local\Temp\smcalc.exe parameters: filepath: C:\Users\test22\AppData\Local\Temp\smcalc.exe	1	1	0

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (35 events)

Time & API	Arguments	Status	Return
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: smss.exe process_identifier: 232	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: csrss.exe process_identifier: 308	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: wininit.exe process_identifier: 344	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: csrss.exe process_identifier: 356	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: winlogon.exe process_identifier: 392	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: services.exe process_identifier: 436	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: lsass.exe process_identifier: 452	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 560	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 636	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 716	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 780	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 824	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: audiodg.exe process_identifier: 896	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 984	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 340	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: spoolsv.exe process_identifier: 1060	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: taskhost.exe process_identifier: 1112	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 1120	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: dwm.exe process_identifier: 1192	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: explorer.exe process_identifier: 1236	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 1744	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: pw.exe process_identifier: 1888	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: SearchIndexer.exe process_identifier: 1652	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: pw.exe process_identifier: 1696	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: taskhost.exe process_identifier: 1156	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: SearchProtocolHost.exe process_identifier: 1492	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: SearchFilterHost.exe process_identifier: 1132	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: svchost.exe process_identifier: 2480	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: mscorsvw.exe process_identifier: 2548	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: WmiPrvSE.exe process_identifier: 2684	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: mscorsvw.exe process_identifier: 2812	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: sppsvc.exe process_identifier: 2848	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: Calculator.exe process_identifier: 2968	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: dllhost.exe process_identifier: 3064	1	1
Process32NextW April 27, 2023, 9:45 a.m.	snapshot_handle: 0x0000091c process_name: Calculator.exe process_identifier: 2144	1	1

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses April 27, 2023, 9:45 a.m.	flags: 15 family: 0		111	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 27, 2023, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW April 27, 2023, 9:45 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Queries for potentially installed applications (3 events)

Time & API	Arguments	Return
RegOpenKeyExW April 27, 2023, 9:45 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{28C03FE7-5479-424F-A3A9-E2C470A11798}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{28C03FE7-5479-424F-A3A9-E2C470A11798}_is1	2
RegOpenKeyExW April 27, 2023, 9:45 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{28C03FE7-5479-424F-A3A9-E2C470A11798}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{28C03FE7-5479-424F-A3A9-E2C470A11798}_is1	2
RegOpenKeyExW April 27, 2023, 9:45 a.m.	regkey_r: Software\Microsoft\Windows\CurrentVersion\Uninstall\{28C03FE7-5479-424F-A3A9-E2C470A11798}_is1 base_handle: 0x80000001 key_handle: 0x00000000 options: 0 access: 0x00000001 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\{28C03FE7-5479-424F-A3A9-E2C470A11798}_is1	2

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"taskkill.exe" /f /im "Calculator.exe"
cmdline	C:\Windows\system32\reg.exe QUERY HKCU\Software\SmartTools\Calculator /v channel

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 9af3e5be20be93479f88fcabfc4126827c650930

A process attempted to delay the analysis task. (1 event)

description

calcinstall.exe tried to sleep 2728163 seconds, actually delayed analysis time by 2728163 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\SmartTool Calculator

reg_value

C:\Users\test22\AppData\Local\SmartTool Calculator\Calculator.exe minimized

Deletes executed files from disk (1 event)

file	C:\Users\test22\AppData\Local\Temp\is-JENHH.tmp\smcalc.tmp

Attempts to create or modify system certificates (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F81F111D0E5AB58D396F7BF525577FD30FDC95AA\Blob

Drops 66 unknown file mime types indicative of ransomware writing encrypted files back to disk (50 out of 66 events)

file	c:\users\test22\appdata\local\smarttool calculator\content_resources_200_percent.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\gu.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\lv.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\ar.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\hu.pak
file	c:\users\test22\appdata\local\smarttool calculator\views_resources_200_percent.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\pt-br.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\ru.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\pt-pt.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\bg.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\fa.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\tr.pak
file	c:\users\test22\appdata\local\smarttool calculator\blink_image_resources_200_percent.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\et.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\cs.pak
file	c:\users\test22\appdata\local\smarttool calculator\resources\app.asar
file	c:\users\test22\appdata\local\smarttool calculator\locales\it.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\he.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\zh-tw.pak
file	c:\users\test22\appdata\local\smarttool calculator\pdf_viewer_resources.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\nl.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\es-419.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\ms.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\sv.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\de.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\sr.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\ta.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\pl.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\es.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\mr.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\en-gb.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\fil.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\lt.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\th.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\ro.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\fake-bidi.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\uk.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\fi.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\vi.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\nb.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\sw.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\hi.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\te.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\el.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\kn.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\sl.pak
file	c:\users\test22\appdata\local\smarttool calculator\icudtl.dat
file	c:\users\test22\appdata\local\smarttool calculator\locales\ko.pak
file	c:\users\test22\appdata\local\smarttool calculator\locales\hr.pak
file	c:\users\test22\appdata\local\smarttool calculator\resources\electron.asar

File has been identified by 34 AntiVirus engines on VirusTotal as malicious (34 events)

Lionic	Adware.Win32.ConvertAd.2!c
MicroWorld-eScan	IL:Trojan.MSILZilla.26047
FireEye	IL:Trojan.MSILZilla.26047
ALYac	IL:Trojan.MSILZilla.26047
Malwarebytes	Generic.Malware/Suspicious
Zillya	Adware.ConvertAD.Win32.89548
K7GW	Trojan ( 005a1d781 )
K7AntiVirus	Trojan ( 005a1d781 )
Arcabit	IL:Trojan.MSILZilla.D65BF
Cyren	W32/ABRisk.BCMB-8741
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Agent_AGen.ARN
Paloalto	generic.ml
Kaspersky	not-a-virus:HEUR:AdWare.MSIL.ConvertAd.gen
BitDefender	IL:Trojan.MSILZilla.26047
NANO-Antivirus	Riskware.Win32.AgentAGen.jvlzlk
Emsisoft	IL:Trojan.MSILZilla.26047 (B)
DrWeb	Trojan.Siggen20.33167
VIPRE	IL:Trojan.MSILZilla.26047
McAfee-GW-Edition	Artemis!PUP
Sophos	Generic Reputation PUA (PUA)
Jiangmin	AdWare.MSIL.odke
MAX	malware (ai score=80)
Antiy-AVL	GrayWare[AdWare]/MSIL.ConvertAd
ZoneAlarm	not-a-virus:HEUR:AdWare.MSIL.ConvertAd.gen
GData	IL:Trojan.MSILZilla.26047
Google	Detected
McAfee	Artemis!881BEF8377F4
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0DD323
Rising	Adware.ConvertAd!8.BA (CLOUD)
Ikarus	Trojan.MSIL.Agent
Fortinet	PossibleThreat
DeepInstinct	MALICIOUS

calcinstall.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All