popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

5ea275.exe

Generic Malware UPX Anti_VM PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 12, 2023, 7:42 a.m. Oct. 12, 2023, 7:48 a.m.
Size 2.2MB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 1c576ece1cb918832be3d9e5f665388b
SHA256 ca9a8dc4c6b60da3ac7b512dc2cc232ee5b09c2035eecf2185277442f884c432
CRC32 E22056DA
ssdeep 49152:6IGvbWIAw+DUeVbZKTGcuPjIdM4ehYLB52UACew:8bVUxZKTGb0dM4sYLb2UAi
Yara
  • UPX_Zero - UPX packed file
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • anti_vm_detect - Possibly employs anti-virtualization techniques
  • themida_packer - themida packer
  • Generic_Malware_Zero - Generic Malware

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp>
console_handle: 0x00000007
1 1 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section
section .themida
section .boot
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
5ea275+0x3058ea @ 0xcf58ea
5ea275+0x32c486 @ 0xd1c486

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xc000008e
exception.offset: 46887
exception.address: 0x7597b727
registers.esp: 4323084
registers.edi: 11276288
registers.eax: 4323084
registers.ebp: 4323164
registers.edx: 2130566132
registers.ebx: 0
registers.esi: 1995994155
registers.ecx: 1619263488
1 0 0

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 ee 19 fe ff c3 e9 b2 29 fc ff 40 b7 63 b0
        

      
        exception.symbol:
        5ea275+0x3898bb
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        5ea275.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3709115
        

      
        exception.address:
        0xd798bb
        

      
    
  
    
      
        registers.esp:
        4323204
        

      
        registers.edi:
        7482904
        

      
        registers.eax:
        1750617430
        

      
        registers.ebp:
        11276288
        

      
        registers.edx:
        7493718
        

      
        registers.ebx:
        1971716070
        

      
        registers.esi:
        13
        

      
        registers.ecx:
        20
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 a2 11 00 00 95 0a 32 68 0a 00 00 00 6d ed
        

      
        exception.symbol:
        5ea275+0x36b21b
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        5ea275.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3584539
        

      
        exception.address:
        0xd5b21b
        

      
    
  
    
      
        registers.esp:
        4323204
        

      
        registers.edi:
        7482904
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        11276288
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        13
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x76faf000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          8192
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x76f20000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a21000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a1a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a1a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          36864
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a1a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
NtProtectVirtualMemory

  
  
    
      
    
  


  
    
      process_identifier:
      
        
          2628
        
      
      
      

    
  
    
      stack_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      stack_pivoted:
      
        
          0
        
      
      
      

    
  
    
      heap_dep_bypass:
      
        
          0
        
      
      
      

    
  
    
      length:
      
        
          4096
        
      
      
      

    
  
    
      protection:
      
        
          64
        
      
      
        (PAGE_EXECUTE_READWRITE)
      
      

    
  
    
      base_address:
      
        
          0x00a1a000
        
      
      
      

    
  
    
      process_handle:
      
        
          0xffffffff
        
      
      
      

    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                            name
                                            RT_STRING
                                        
                                    
                                        
                                            language
                                            LANG_JAPANESE
                                        
                                    
                                        
                                            filetype
                                            data
                                        
                                    
                                        
                                            sublanguage
                                            SUBLANG_DEFAULT
                                        
                                    
                                        
                                            offset
                                            0x000cf368
                                        
                                    
                                        
                                    
                                        
                                            size
                                            0x000003c2
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                            name
                                            RT_VERSION
                                        
                                    
                                        
                                            language
                                            LANG_JAPANESE
                                        
                                    
                                        
                                            filetype
                                            data
                                        
                                    
                                        
                                            sublanguage
                                            SUBLANG_DEFAULT
                                        
                                    
                                        
                                            offset
                                            0x000cf770
                                        
                                    
                                        
                                    
                                        
                                            size
                                            0x00000314
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    cmdline
                                    "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
ShellExecuteExW

  
  
    
      
    
  


  
    
      show_type:
      
        
          0
        
      
      
      

    
  
    
      filepath_r:
      
        
          cmd
        
      
      
      

    
  
    
      parameters:
      
        
          /k shutdown -s -t 0
        
      
      
      

    
  
    
      filepath:
      
        
          cmd
        
      
      
      

    
  


    
        1
    

1

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00012a00', u'virtual_address': u'0x00001000', u'entropy': 7.977143640145685, u'name': u'        ', u'virtual_size': u'0x00028b4d'}
                                        
                                    
                                        
                                            entropy
                                            7.97714364015
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00003c00', u'virtual_address': u'0x0002a000', u'entropy': 7.936196679757506, u'name': u'        ', u'virtual_size': u'0x000087b2'}
                                        
                                    
                                        
                                            entropy
                                            7.93619667976
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00000200', u'virtual_address': u'0x00033000', u'entropy': 7.5283354212755, u'name': u'        ', u'virtual_size': u'0x000024c0'}
                                        
                                    
                                        
                                            entropy
                                            7.52833542128
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00014600', u'virtual_address': u'0x00036000', u'entropy': 7.967505081502434, u'name': u'        ', u'virtual_size': u'0x0007b0bc'}
                                        
                                    
                                        
                                            entropy
                                            7.9675050815
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x00001e00', u'virtual_address': u'0x000b2000', u'entropy': 7.835646604699191, u'name': u'        ', u'virtual_size': u'0x000020e4'}
                                        
                                    
                                        
                                            entropy
                                            7.8356466047
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            section
                                            {u'size_of_data': u'0x001ef600', u'virtual_address': u'0x003f1000', u'entropy': 7.953323762586698, u'name': u'.boot', u'virtual_size': u'0x001ef600'}
                                        
                                    
                                        
                                            entropy
                                            7.95332376259
                                        
                                    
                                        
                                            description
                                            A section with a high entropy has been found
                                        
                                    
                                


                            

                        

                            

                                

                                    
                                        
                                    
                                        
                                            entropy
                                            0.955121607526
                                        
                                    
                                        
                                            description
                                            Overall entropy of this PE file is high
                                        
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    process
                                    system
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    cmdline
                                    "C:\Windows\System32\cmd.exe" /k shutdown -s -t 0
                                    
                                


                            

                        

                            

                                

                                    cmdline
                                    cmd /k shutdown -s -t 0
                                    
                                


                            

                        

                            

                                

                                    cmdline
                                    shutdown  -s -t 0
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          OLLYDBG
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          GBDYLLO
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          pediy06
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          RegmonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          Registry Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          18467-41
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          FilemonClass
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          File Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          PROCMON_WINDOW_CLASS
        
      
      
      

    
  
    
      window_name:
      
        
          
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                            

                                

                                

                                    

  
FindWindowA

  
  
    
      
    
  


  
    
      class_name:
      
        
          #0
        
      
      
      

    
  
    
      window_name:
      
        
          Process Monitor - Sysinternals: www.sysinternals.com
        
      
      
      

    
  


    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion
                                    
                                


                            

                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    registry
                                    HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
                                    
                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
NtQuerySystemInformation

  
  
    
      
    
  


  
    
      information_class:
      
        
          76
        
      
      
        (SystemFirmwareTableInformation)
      
      

    
  


    

3221225507

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    

                                    
                                        

                                            Time & API
                                            Arguments
                                            Status
                                            Return
                                            Repeated
                                        

                                    

                                

                                

                                    

  
__exception__

  
  
    
      
    
  


  
    
      stacktrace:
      
        
          

        
      
      
      

    
  
    
      
        exception.instruction_r:
        ed e9 a2 11 00 00 95 0a 32 68 0a 00 00 00 6d ed
        

      
        exception.symbol:
        5ea275+0x36b21b
        

      
        exception.instruction:
        in eax, dx
        

      
        exception.module:
        5ea275.exe
        

      
        exception.exception_code:
        0xc0000096
        

      
        exception.offset:
        3584539
        

      
        exception.address:
        0xd5b21b
        

      
    
  
    
      
        registers.esp:
        4323204
        

      
        registers.edi:
        7482904
        

      
        registers.eax:
        1447909480
        

      
        registers.ebp:
        11276288
        

      
        registers.edx:
        22104
        

      
        registers.ebx:
        2256917605
        

      
        registers.esi:
        13
        

      
        registers.ecx:
        10
        

      
    
  


    
        1
    

0

    
        0
    


                                


                            

                        

                    


                    

                

            
            
        
            


                

                
                

                    

                    

                        
                        

                            

                                

                                    Bkav
                                    W32.AIDetectMalware
                                    
                                


                            

                        

                            

                                

                                    Lionic
                                    Trojan.Win32.Convagent.trYj
                                    
                                


                            

                        

                            

                                

                                    tehtris
                                    Generic.Malware
                                    
                                


                            

                        

                            

                                

                                    MicroWorld-eScan
                                    Trojan.GenericKD.69201153
                                    
                                


                            

                        

                            

                                

                                    CAT-QuickHeal
                                    Trojan.IGENERIC
                                    
                                


                            

                        

                            

                                

                                    Skyhigh
                                    BehavesLike.Win32.Generic.vc
                                    
                                


                            

                        

                            

                                

                                    McAfee
                                    Artemis!1C576ECE1CB9
                                    
                                


                            

                        

                            

                                

                                    Malwarebytes
                                    Malware.Heuristic.1003
                                    
                                


                            

                        

                            

                                

                                    Sangfor
                                    Infostealer.Win32.Agent.Vyt3
                                    
                                


                            

                        

                            

                                

                                    Alibaba
                                    TrojanSpy:Win32/Stealer.7a561349
                                    
                                


                            

                        

                            

                                

                                    Cybereason
                                    malicious.cb133a
                                    
                                


                            

                        

                            

                                

                                    Arcabit
                                    Trojan.Generic.D41FED01
                                    
                                


                            

                        

                            

                                

                                    Symantec
                                    ML.Attribute.HighConfidence
                                    
                                


                            

                        

                            

                                

                                    Elastic
                                    malicious (high confidence)
                                    
                                


                            

                        

                            

                                

                                    ESET-NOD32
                                    a variant of Generik.GHXLWDM
                                    
                                


                            

                        

                            

                                

                                    Cynet
                                    Malicious (score: 100)
                                    
                                


                            

                        

                            

                                

                                    APEX
                                    Malicious
                                    
                                


                            

                        

                            

                                

                                    Kaspersky
                                    Trojan-Spy.Win32.Stealer.etvw
                                    
                                


                            

                        

                            

                                

                                    BitDefender
                                    Trojan.GenericKD.69201153
                                    
                                


                            

                        

                            

                                

                                    NANO-Antivirus
                                    Virus.Win32.Gen-Crypt.ccnc
                                    
                                


                            

                        

                            

                                

                                    Avast
                                    Win32:BotX-gen [Trj]
                                    
                                


                            

                        

                            

                                

                                    Tencent
                                    Malware.Win32.Gencirc.13ef0cf2
                                    
                                


                            

                        

                            

                                

                                    Emsisoft
                                    Trojan.GenericKD.69201153 (B)
                                    
                                


                            

                        

                            

                                

                                    F-Secure
                                    Trojan.TR/Spy.Stealer.zbxji
                                    
                                


                            

                        

                            

                                

                                    DrWeb
                                    Trojan.DownLoader46.4223
                                    
                                


                            

                        

                            

                                

                                    VIPRE
                                    Trojan.GenericKD.69201153
                                    
                                


                            

                        

                            

                                

                                    TrendMicro
                                    Trojan.Win32.AMADEY.YXDIJZ
                                    
                                


                            

                        

                            

                                

                                    Trapmine
                                    malicious.high.ml.score
                                    
                                


                            

                        

                            

                                

                                    FireEye
                                    Generic.mg.1c576ece1cb91883
                                    
                                


                            

                        

                            

                                

                                    Sophos
                                    Mal/Generic-S
                                    
                                


                            

                        

                            

                                

                                    SentinelOne
                                    Static AI - Malicious PE
                                    
                                


                            

                        

                            

                                

                                    Webroot
                                    W32.Trojan.GenKD
                                    
                                


                            

                        

                            

                                

                                    Varist
                                    W32/ABRisk.QAYP-4728
                                    
                                


                            

                        

                            

                                

                                    Avira
                                    TR/Spy.Stealer.zbxji
                                    
                                


                            

                        

                            

                                

                                    MAX
                                    malware (ai score=89)
                                    
                                


                            

                        

                            

                                

                                    Antiy-AVL
                                    Trojan[Spy]/Win32.Stealer
                                    
                                


                            

                        

                            

                                

                                    Gridinsoft
                                    Ransom.Win32.Bladabindi.sa
                                    
                                


                            

                        

                            

                                

                                    Microsoft
                                    Trojan:Win32/Amadey.AY!MTB
                                    
                                


                            

                        

                            

                                

                                    ViRobot
                                    Trojan.Win.Z.Agent.2317328
                                    
                                


                            

                        

                            

                                

                                    ZoneAlarm
                                    Trojan-Spy.Win32.Stealer.etvw
                                    
                                


                            

                        

                            

                                

                                    GData
                                    Trojan.GenericKD.69201153
                                    
                                


                            

                        

                            

                                

                                    Google
                                    Detected
                                    
                                


                            

                        

                            

                                

                                    AhnLab-V3
                                    Trojan/Win.Generic.C5484992
                                    
                                


                            

                        

                            

                                

                                    BitDefenderTheta
                                    Gen:NN.ZexaF.36738.nU0@aOdEYHkO
                                    
                                


                            

                        

                            

                                

                                    ALYac
                                    Trojan.GenericKD.69201153
                                    
                                


                            

                        

                            

                                

                                    VBA32
                                    BScope.Backdoor.MSIL.Bladabindi
                                    
                                


                            

                        

                            

                                

                                    Cylance
                                    unsafe
                                    
                                


                            

                        

                            

                                

                                    Panda
                                    Trj/Agent.FUM
                                    
                                


                            

                        

                            

                                

                                    TrendMicro-HouseCall
                                    Trojan.Win32.AMADEY.YXDIJZ
                                    
                                


                            

                        

                            

                                

                                    Rising
                                    Stealer.Agent!8.C2 (TFE:5:jKUXB83mU0D)