gfers.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.bore

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

WEXE

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory March 10, 2021, 4:06 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 159744 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00a0a000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory March 10, 2021, 4:06 p.m.	process_identifier: 1016 region_size: 217088 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00310000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x0004a200', u'virtual_address': u'0x00001000', u'entropy': 7.503650442092497, u'name': u'.text', u'virtual_size': u'0x0004a181'}				entropy	7.50365044209				description	A section with a high entropy has been found
entropy	0.742177722153				description	Overall entropy of this PE file is high

Yara rule detected in process memory (41 events)

description	Code injection with CreateRemoteThread in a remote process				rule	inject_thread
description	Create a windows service				rule	create_service
description	Communications over UDP network				rule	network_udp_sock
description	Listen for incoming communication				rule	network_tcp_listen
description	Communications over P2P network				rule	network_p2p_win
description	Communications over HTTP				rule	network_http
description	File downloader/dropper				rule	network_dropper
description	Communications over FTP				rule	network_ftp
description	Communications over RAW socket				rule	network_tcp_socket
description	Communications use DNS				rule	network_dns
description	Communication using dga				rule	network_dga
description	Escalade priviledges				rule	escalate_priv
description	Take screenshot				rule	screenshot
description	Run a keylogger				rule	keylogger
description	Steal credential				rule	cred_local
description	Record Audio				rule	sniff_audio
description	APC queue tasks migration				rule	migrate_apc
description	Malware can spread east-west using share drive				rule	spreading_share
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_private_profile
description	Affect private profile				rule	win_files_operation
description	Match Winsock 2 API library declaration				rule	Str_Win32_Winsock2_Library
description	Match Windows Inet API library declaration				rule	Str_Win32_Wininet_Library
description	Match Windows Inet API call				rule	Str_Win32_Internet_API
description	Match Windows Http API call				rule	Str_Win32_Http_API
description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerCheck__RemoteAPI
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	DebuggerException__ConsoleCtrl
description	(no description)				rule	DebuggerException__SetConsoleCtrl
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	(no description)				rule	Check_Dlls
description	Checks if being debugged				rule	anti_dbg
description	Anti-Sandbox checks for ThreatExpert				rule	antisb_threatExpert
description	Bypass DEP				rule	disable_dep
description	Affect hook table				rule	win_hook

File has been identified by 22 AntiVirus engines on VirusTotal as malicious (22 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.ae4ac666d4c6073f
McAfee	Packed-GBF!AE4AC666D4C6
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_70% (D)
BitDefenderTheta	Gen:NN.ZexaF.34608.zC0@auTGXshG
APEX	Malicious
Kaspersky	UDS:DangerousObject.Multi.Generic
Paloalto	generic.ml
Sophos	ML/PE-A
DrWeb	Trojan.PWS.Siggen2.62636
Microsoft	Trojan:Win32/Wacatac.B!ml
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Cynet	Malicious (score: 100)
Acronis	suspicious
Malwarebytes	Generic.Malware/Suspicious
Rising	Malware.Heuristic!ET#88% (RDMK:cmRtazqRJksiLJnFENI7oKEvepWh)
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_95%
Qihoo-360	HEUR/QVM10.1.CB87.Malware.Gen