popup

Report - ntvdm64.exe

PE64 PE File
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2023.04.02 08:54 Machine s1_win7_x6401
Filename ntvdm64.exe
Type PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
AI Score Not founds Behavior Score
2.4
ZERO API file : clean
VT API (file) 9 detected (malicious, high confidence, Artemis, Attribute, HighConfidence, score, Generic ML PUA)
md5 5d27d7c444aa9ac075cf892d70357e54
sha256 78b49f7d4523704579aa2c70ca8602317e347ec8b4884fc6f52a4b83d4258549
ssdeep 393216:AhrGShpkvUpER3ofFyj0EB6252X+c/uZxTR/R2cwxdoR3WFOFXt57h0QCjrddxuy:ApGShpm5bj1K/2lReQZWc5d0VdxAEMoR
imphash fd867d283c8335cc9c03060aaa4c760d
impfuzzy 3:ssD7SbolWxzvyLsBO7oAAJo1MO/OywWBJAEPwSx2AEZsS9KTXzW:pajtlJoZ/OiBJAEnERGDW
  Network IP location

Signature (6cnts)

Level Description
watch Detects the presence of Wine emulator
notice Allocates read-write-execute memory (usually to unpack itself)
notice Creates executable files on the filesystem
notice File has been identified by 9 AntiVirus engines on VirusTotal as malicious
notice The binary likely contains encrypted or compressed data indicative of a packer
info The executable contains unknown PE section names indicative of a packer (could be a false positive)

Rules (4cnts)

Level Name Description Collection
info IsPE64 (no description) binaries (download)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (download)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x148b000 WriteFile
kernel32.dll
 0x148b010 GetSystemTimeAsFileTime
kernel32.dll
 0x148b020 HeapAlloc
 0x148b028 HeapFree
 0x148b030 ExitProcess
 0x148b038 LoadLibraryA
 0x148b040 GetModuleHandleA
 0x148b048 GetProcAddress

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure