Report - dll.jpg.exe

Generic Malware Antivirus PE32 PE File DLL .NET DLL
ScreenShot
Created 2023.12.07 17:10 Machine s1_win7_x6401
Filename dll.jpg.exe
Type PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
AI Score
4
Behavior Score
0.6
ZERO API file : clean
VT API (file) 8 detected (AIDetectMalware, malicious, confidence, high confidence, Static AI, Suspicious PE, score)
md5 c0b7ffa3b6b89673fab5638e395cd4f5
sha256 3676702ad2a49ab15bcf5b8b5e280cb6328d6a0c90b0b02df7034a963eeaa203
ssdeep 192:Tjs1xLb8LsGOszbkT1BZAuoIW1Pn/FMT6kIcZVU0zoFTpS2PO6Hfo:TjgxLoLtbzbuHZAuCn/FMT5Xbz0ZpS1R
imphash dae02f32a21e03ce65412f6e56942daa
impfuzzy 3:rGsKZK:2Y
  Network IP location

Signature (2cnts)

Level Description
notice File has been identified by 8 AntiVirus engines on VirusTotal as malicious
info This executable has a PDB path

Rules (6cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (upload)
watch Antivirus Contains references to security software binaries (upload)
info Is_DotNET_DLL (no description) binaries (upload)
info IsDLL (no description) binaries (upload)
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

mscoree.dll
 0x10002000 _CorDllMain

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure