Report - x75eie.ps1

Hide_EXE Generic Malware Antivirus
ScreenShot
Created 2024.12.06 09:48 Machine s1_win7_x6403
Filename x75eie.ps1
Type ASCII text, with very long lines, with no line terminators
AI Score Not founds Behavior Score
1.6
ZERO API file : clean
VT API (file) 15 detected (PowerShell, MulDrop, Detected, SpyNoon, AMAA, QQPass, QQRob, Mqil)
md5 25e1952efb3a1a45146c028117fd923c
sha256 74c3f8d065352120ccaa006d24e51bdd8508a4222e8e7ce30fd89c6e26b02480
ssdeep 49152:WY1wOeTfeinwRg0Yd0YtWdR2++BqkPiblNmBZOqsHtL3rdyW6JKHINYMpnkq/3+G:a
imphash
impfuzzy
  Network IP location

Signature (5cnts)

Level Description
watch File has been identified by 15 AntiVirus engines on VirusTotal as malicious
notice Allocates read-write-execute memory (usually to unpack itself)
info Checks amount of memory in system
info Command line console output was observed
info Uses Windows APIs to generate a cryptographic key

Rules (3cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
warning hide_executable_file Hide executable file binaries (upload)
watch Antivirus Contains references to security software binaries (download)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure