Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 25, 2023, 9:48 a.m.	Sept. 25, 2023, 9:50 a.m.

Size	53.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`a44cd9ea69e9e6ac198c56460cd912e9`
SHA256	`04a20893d103edf93385001262a5bd91799b3f46811e14e102b4eec8efffea3e`
CRC32	`C699ECE9`
ssdeep	`768:7zdQX6hMRKXqWob+dmt4GEUt3uEHSE1gSThvZ8bmLAw6cyKeCPLTItUpj1Ua44Zj:fdw4Edt4ABuEVP1xH/deuvu1I+w`
Yara	PE_Header_Zero - PE File Signature IsPE32 - (no description) Is_DotNET_EXE - (no description)

i.txt.exe "C:\Users\test22\AppData\Local\Temp\i.txt.exe"
3012
- RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2408

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
5.252.22.56	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 25, 2023, 9:48 a.m.			0	0
IsDebuggerPresent Sept. 25, 2023, 9:48 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 25, 2023, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f11c8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f1348 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey Sept. 25, 2023, 9:48 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x005f1348 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 25, 2023, 9:48 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (23 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 1114112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73d92000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x020f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02280000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003eb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003cc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008af000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 3012 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00541000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 25, 2023, 9:49 a.m.	process_identifier: 2408 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 process_handle: 0xffffffff	1

A process attempted to delay the analysis task. (1 event)

description

RegAsm.exe tried to sleep 375 seconds, actually delayed analysis time by 375 seconds

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0000ca00', u'virtual_address': u'0x00002000', u'entropy': 7.938619652912309, u'name': u'.text', u'virtual_size': u'0x0000c934'}

entropy

7.93861965291

description

A section with a high entropy has been found

entropy

0.961904761905

description

Overall entropy of this PE file is high

Yara rule detected in process memory (11 events)

description	Communications over RAW Socket	rule	Network_TCP_Socket
description	Match Windows Inet API call	rule	Str_Win32_Internet_API
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	File Downloader	rule	Network_Downloader

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 1fe4216471d272e6e446c88cc897d1e240ddaad5

Communicates with host for which no DNS query was performed (1 event)

host

5.252.22.56

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 2408 region_size: 118784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238	1	0	0

Checks for the presence of known windows from debuggers and forensic tools (50 out of 62 events)

Time & API	Arguments	Status	Return	Repeated
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:49 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCEXPL window_name:		0	0
FindWindowA Sept. 25, 2023, 9:50 a.m.	class_name: PROCMON_WINDOW_CLASS window_name:		0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Sept. 25, 2023, 9:48 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2408 process_handle: 0x00000238	1	1	0

Creates a windows hook that monitors keyboard input (keylogger) (1 event)

Time & API	Arguments	Status	Return	Repeated
SetWindowsHookExA Sept. 25, 2023, 9:49 a.m.	thread_identifier: 0 callback_function: 0x0040385c hook_identifier: 13 (WH_KEYBOARD_LL) module_address: 0x00400000	1	131421	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3012 called NtSetContextThread to modify thread in remote process 2408
NtSetContextThread Sept. 25, 2023, 9:48 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4302784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000234 process_identifier: 2408	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 3012 resumed a thread in remote process 2408
NtResumeThread Sept. 25, 2023, 9:48 a.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2408	1	0	0

Detects VirtualBox through the presence of a registry key (1 event)

registry

HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

5.252.22.56:2404

Executed a process and injected code into it, probably while unpacking (12 events)

Time & API	Arguments	Status	Return
NtResumeThread Sept. 25, 2023, 9:48 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 3012	1	0
NtResumeThread Sept. 25, 2023, 9:48 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 3012	1	0
NtResumeThread Sept. 25, 2023, 9:48 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 3012	1	0
CreateProcessInternalW Sept. 25, 2023, 9:48 a.m.	thread_identifier: 2416 thread_handle: 0x00000234 process_identifier: 2408 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000238	1	1
NtGetContextThread Sept. 25, 2023, 9:48 a.m.	thread_handle: 0x00000234	1	0
NtAllocateVirtualMemory Sept. 25, 2023, 9:48 a.m.	process_identifier: 2408 region_size: 118784 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000238	1	0
WriteProcessMemory Sept. 25, 2023, 9:48 a.m.	buffer: base_address: 0x00400000 process_identifier: 2408 process_handle: 0x00000238	1	1
WriteProcessMemory Sept. 25, 2023, 9:48 a.m.	buffer: base_address: 0x00413000 process_identifier: 2408 process_handle: 0x00000238	1	1
WriteProcessMemory Sept. 25, 2023, 9:48 a.m.	buffer: base_address: 0x0041b000 process_identifier: 2408 process_handle: 0x00000238	1	1
WriteProcessMemory Sept. 25, 2023, 9:48 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2408 process_handle: 0x00000238	1	1
NtSetContextThread Sept. 25, 2023, 9:48 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4302784 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x00000234 process_identifier: 2408	1	0
NtResumeThread Sept. 25, 2023, 9:48 a.m.	thread_handle: 0x00000234 suspend_count: 1 process_identifier: 2408	1	0

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.Common.B0F3B975
Lionic	Trojan.Win32.Azorult.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Nanocore
McAfee	PWS-FCUT!A44CD9EA69E9
Malwarebytes	Trojan.Agent.Gen
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0056052a1 )
Alibaba	TrojanPSW:MSIL/NanoCore.249c87bb
K7GW	Trojan ( 0056052a1 )
Cybereason	malicious.3e0ec3
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/Azorult.D.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.SZH
APEX	Malicious
ClamAV	Win.Packed.Razy-7334624-0
Kaspersky	HEUR:Trojan-PSW.MSIL.Azorult.gen
BitDefender	IL:Trojan.MSILZilla.Azorult.1690
NANO-Antivirus	Trojan.Win32.Azorult.kalrqu
MicroWorld-eScan	IL:Trojan.MSILZilla.Azorult.1690
Avast	Win32:CrypterX-gen [Trj]
Tencent	Trojan-Psw.Msil.Azorult.zb
Emsisoft	IL:Trojan.MSILZilla.Azorult.1690 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Inject3.26307
VIPRE	IL:Trojan.MSILZilla.Azorult.1690
TrendMicro	Backdoor.Win32.REMCOS.YXDIPZ
McAfee-GW-Edition	BehavesLike.Win32.Generic.qc
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.a44cd9ea69e9e6ac
Sophos	Troj/MSIL-RDY
SentinelOne	Static AI - Malicious PE
GData	IL:Trojan.MSILZilla.Azorult.1690
Avira	TR/Dropper.Gen
Gridinsoft	Ransom.Win32.AzorUlt.sa
Arcabit	IL:Trojan.MSILZilla.Azorult.D69A
ViRobot	Trojan.Win.Z.Kryptik.54272.B
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Azorult.gen
Microsoft	Trojan:MSIL/NanoCore.DHB!MTB
Google	Detected
AhnLab-V3	Trojan/Win32.RL_Generic.C3447461
BitDefenderTheta	Gen:NN.ZemsilF.36722.dm0@aSIAyro
ALYac	IL:Trojan.MSILZilla.Azorult.1690
MAX	malware (ai score=89)
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.YXDIPZ
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:PH+u1X+mhnaD3AJW15jXTw)

i.txt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All