Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 6, 2023, 9:31 a.m.	Nov. 6, 2023, 9:35 a.m.

Size	553.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`f297b0f6ff8bace56e8bc669a63df2a7`
SHA256	`8ede431d0ad3096d50b23828dac3e43ac4c05f5154be8e7ccf33b45d7abb118f`
CRC32	`8B0E370D`
ssdeep	`12288:1K82RhwfoAZUk2BL00rX1odqMzFG0Y9O9Nlq07BHiBqi:1Kv4foAPEwpyO9+070Bq`
PDB Path	vbFX.pdb
Yara	PE_Header_Zero - PE File Signature Win_Trojan_Formbook_Zero - Used Formbook IsPE32 - (no description) Is_DotNET_EXE - (no description)

isbinzx.exe "C:\Users\test22\AppData\Local\Temp\isbinzx.exe"
660
- isbinzx.exe "C:\Users\test22\AppData\Local\Temp\isbinzx.exe"
  2448

Name	Response	Post-Analysis Lookup
www.vurporn.com
www.lambdasigmarho.com
www.tcbbuilds.com

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Nov. 6, 2023, 7:51 a.m.			0	0
IsDebuggerPresent Nov. 6, 2023, 7:51 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

vbFX.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 6, 2023, 7:51 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (32 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 458752 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00380000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f62000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x009a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00b30000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00422000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00455000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0045b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00457000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0044a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00447000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00446000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0213f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0042c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0043e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac8000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 660 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ac9000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 2448 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00860000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00089a00', u'virtual_address': u'0x00002000', u'entropy': 7.917980394551674, u'name': u'.text', u'virtual_size': u'0x00089860'}

entropy

7.91798039455

description

A section with a high entropy has been found

entropy

0.996380090498

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Nov. 6, 2023, 7:51 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Nov. 6, 2023, 7:51 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://fit.mta.edu.vn

Yara rule detected in process memory (9 events)

description	Used Formbook[m]	rule	Win_Trojan_Formbook_m_Zero
description	PWS Memory	rule	Generic_PWS_Memory_Zero
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Terminates another process (2 events)

Time & API	Arguments	Status	Return	Repeated
NtTerminateProcess Nov. 6, 2023, 7:51 a.m.	status_code: 0xffffffff process_identifier: 2412 process_handle: 0x0000025c		0	0
NtTerminateProcess Nov. 6, 2023, 7:51 a.m.	status_code: 0xffffffff process_identifier: 2412 process_handle: 0x0000025c	1	0	0

Allocates execute permission to another process indicative of possible code injection (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 2412 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000250		3221225496	0
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 2448 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000260	1	0	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 660 manipulating memory of non-child process 2412
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 2412 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000250		3221225496	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 6, 2023, 7:51 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL·N=à Òàðð@ð@.textDÑÒ ` base_address: 0x00400000 process_identifier: 2448 process_handle: 0x00000260	1	1	0
WriteProcessMemory Nov. 6, 2023, 7:51 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2448 process_handle: 0x00000260	1	1	0

Code injection by writing an executable or DLL to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory Nov. 6, 2023, 7:51 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL·N=à Òàðð@ð@.textDÑÒ ` base_address: 0x00400000 process_identifier: 2448 process_handle: 0x00000260	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 660 called NtSetContextThread to modify thread in remote process 2448
NtSetContextThread Nov. 6, 2023, 7:51 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4321504 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000025c process_identifier: 2448	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 660 resumed a thread in remote process 2448
NtResumeThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 2448	1	0	0

Executed a process and injected code into it, probably while unpacking (15 events)

Time & API	Arguments	Status	Return
NtResumeThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 660	1	0
NtResumeThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 660	1	0
NtResumeThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x00000194 suspend_count: 1 process_identifier: 660	1	0
NtResumeThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x00000244 suspend_count: 1 process_identifier: 660	1	0
CreateProcessInternalW Nov. 6, 2023, 7:51 a.m.	thread_identifier: 2416 thread_handle: 0x0000024c process_identifier: 2412 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\isbinzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\isbinzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000250	1	1
NtGetContextThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x0000024c	1	0
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 2412 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000250		3221225496
CreateProcessInternalW Nov. 6, 2023, 7:51 a.m.	thread_identifier: 2452 thread_handle: 0x0000025c process_identifier: 2448 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\isbinzx.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\isbinzx.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000260	1	1
NtGetContextThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x0000025c	1	0
NtAllocateVirtualMemory Nov. 6, 2023, 7:51 a.m.	process_identifier: 2448 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000260	1	0
WriteProcessMemory Nov. 6, 2023, 7:51 a.m.	buffer: MZERèXè ÈÀ<ÁÀ(ÿáÀº´ Í!¸LÍ!This program cannot be run in DOS mode. $«üêïf¹ïf¹ïf¹ôÍ¹©f¹ôø¹ìf¹ôû¹îf¹Richïf¹PEL·N=à Òàðð@ð@.textDÑÒ ` base_address: 0x00400000 process_identifier: 2448 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 6, 2023, 7:51 a.m.	buffer: base_address: 0x00401000 process_identifier: 2448 process_handle: 0x00000260	1	1
WriteProcessMemory Nov. 6, 2023, 7:51 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2448 process_handle: 0x00000260	1	1
NtSetContextThread Nov. 6, 2023, 7:51 a.m.	registers.eip: 0 registers.esp: 0 registers.edi: 0 registers.eax: 4321504 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000025c process_identifier: 2448	1	0
NtResumeThread Nov. 6, 2023, 7:51 a.m.	thread_handle: 0x0000025c suspend_count: 1 process_identifier: 2448	1	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Lionic	Trojan.Win32.Stealer.12!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ser.Lazy.5546
Skyhigh	BehavesLike.Win32.Generic.hc
McAfee	Artemis!F297B0F6FF8B
VIPRE	Gen:Variant.Ser.Lazy.5546
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005ad43d1 )
BitDefender	Gen:Variant.Ser.Lazy.5546
K7GW	Trojan ( 005ad43d1 )
Arcabit	Trojan.Ser.Lazy.D15AA
VirIT	Trojan.Win32.MSIL_Heur.A
Symantec	Scr.Malcode!gdn33
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Stealer.gen
Rising	Malware.Obfus/MSIL@AI.94 (RDM.MSIL2:JMdEtKJ5KI+8XaRXOwz+yQ)
Emsisoft	Gen:Variant.Ser.Lazy.5546 (B)
F-Secure	Trojan.TR/AD.Swotter.vbfsd
DrWeb	Trojan.Inject4.59820
FireEye	Gen:Variant.Ser.Lazy.5546
Sophos	Troj/Krypt-ABH
SentinelOne	Static AI - Malicious PE
MAX	malware (ai score=89)
Google	Detected
Avira	TR/AD.Swotter.vbfsd
Varist	W32/MSIL_Troj.CXU.gen!Eldorado
Kingsoft	malware.kb.c.886
Microsoft	Trojan:MSIL/Spynoon.AAUT!MTB
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Stealer.gen
GData	Gen:Variant.Ser.Lazy.5546
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.SpyNoon.C5537141
ALYac	Gen:Variant.Ser.Lazy.5546
DeepInstinct	MALICIOUS
Malwarebytes	Trojan.MalPack
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H01K423
Tencent	Msil.Trojan-QQPass.QQRob.Xdkl
Ikarus	Trojan.MSIL.SpyNoon
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GLXZ!tr
AVG	Win32:PWSX-gen [Trj]
Avast	Win32:PWSX-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

isbinzx.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All