Report - Milieuskadeligst.exe

Malicious Library PE File PE64
ScreenShot
Created 2024.07.15 09:38 Machine s1_win7_x6401
Filename Milieuskadeligst.exe
Type PE32+ executable (console) x86-64 Mono/.Net assembly, for MS Windows
AI Score
2
Behavior Score
2.6
ZERO API file : malware
VT API (file) 50 detected (AIDetectMalware, malicious, high confidence, score, Artemis, MSILHeracles, Unsafe, Save, GenericKD, Kryptik, ALYC, PWSX, Powershell, TrojanPSW, MSIL@AI, MSIL2, 5+5KUCEChdnniXTZyd, GenSteal, usvyw, Packed2, NEGASTEAL, YXEGMZ, Detected, ai score=86, AgentTesla, PSYL, Wacatac, ABTrojan, TWAY, confidence)
md5 99af50ba5059f85a1c8bd15ecf23fb3b
sha256 3d810a66571a39b04a58bb86fda156681dee8db541c9941106d1abce59c92602
ssdeep 12288:PaCIgcZcoaREnONS7zCm4ry3tr/QUC7z46a3c:ygec+OeuO9r4UiO3c
imphash
impfuzzy 3::
  Network IP location

Signature (6cnts)

Level Description
danger File has been identified by 50 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
info Checks amount of memory in system
info Checks if process is being debugged by a debugger
info Collects information to fingerprint the system (MachineGuid

Rules (3cnts)

Level Name Description Collection
watch Malicious_Library_Zero Malicious_Library binaries (upload)
info IsPE64 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) is none

EAT(Export Address Table) is none



Similarity measure (PE file only) - Checking for service failure