po_6645.com

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 9, 2021, 1:37 p.m.	process_identifier: 656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 9, 2021, 1:38 p.m.	process_identifier: 656 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 9, 2021, 1:37 p.m.	process_identifier: 656 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003e0000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader37.22484
MicroWorld-eScan	Trojan.GenericKD.45836084
FireEye	Generic.mg.f0246040c945b8e7
ALYac	Trojan.GenericKD.45836084
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (W)
Alibaba	Trojan:Win32/Injector.df59a783
K7GW	Trojan ( 00578d121 )
K7AntiVirus	Trojan ( 00578d121 )
BitDefenderTheta	Gen:NN.ZevbaF.34608.hm0@aKEP!Ghi
Cyren	W32/VB.OLPI-3948
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Injector.EOTW
APEX	Malicious
ClamAV	Win.Malware.Generic-9839054-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Trojan.GenericKD.45836084
Avast	Win32:Malware-gen
Ad-Aware	Trojan.GenericKD.45836084
Emsisoft	Trojan.GenericKD.45836084 (B)
F-Secure	Trojan.TR/AD.VBCryptor.cnzao
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Fareit.cz
Sophos	Mal/Generic-S
Ikarus	Trojan.VB.Crypt
Webroot	W32.Trojan.TR.AD.VBCryptor.cnza
Avira	TR/AD.VBCryptor.cnzao
Microsoft	Trojan:MSIL/Cryptor
Arcabit	Trojan.Generic.D2BB6734
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Win32.Trojan-Downloader.GuLoader.3B6FP8
Cynet	Malicious (score: 90)
AhnLab-V3	Win-Trojan/VBKrand.Gen
McAfee	Artemis!F0246040C945
MAX	malware (ai score=80)
Malwarebytes	Trojan.Injector
TrendMicro-HouseCall	TROJ_GEN.F0D1C00C521
SentinelOne	Static AI - Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/EOTW!tr
AVG	Win32:Malware-gen
Panda	Trj/RnkBend.A
Qihoo-360	Win32/Heur.Generic.HwMAsaIA