popup

Report - kyjilsefqaw.exe

PE File PE32
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2025.02.19 12:03 Machine s1_win7_x6401
Filename kyjilsefqaw.exe
Type PE32 executable (GUI) Intel 80386, for MS Windows
AI Score
14
 Behavior Score
1.6
ZERO API
VT API (file)
md5 ef2bda68775f23bb79519049adfaa4e1
sha256 8825d7b1d64005759065ca7b04c6d29842adb768684e742ffbb92bd0568f2b4d
ssdeep 24576:tk0I9p07WZpnkWf1hgASJurpAfzBceQTlaYfGxsCdjQobKa88RiDa:2CW7n3f1h9NrczBc94Yux/9QoOaw
imphash 71cc5af9daad65e58c6f29c42cdf9201
impfuzzy 6:nERGDvZ/OiBJAEcXQwDLzRgSdn8BbMqtYbdowNbA:EcDvZGqA9AwDXRgKQcowxA
  Network IP location

Signature (6cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice The binary likely contains encrypted or compressed data indicative of a packer
info One or more processes crashed
info Queries for the computername
info The executable contains unknown PE section names indicative of a packer (could be a false positive)
info The executable uses a known packer

Rules (2cnts)

Level Name Description Collection
info IsPE32 (no description) binaries (upload)
info PE_Header_Zero PE File Signature binaries (upload)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids

PE API

IAT(Import Address Table) Library

kernel32.dll
 0x6dd0d4 GetModuleHandleA
 0x6dd0d8 GetProcAddress
 0x6dd0dc ExitProcess
 0x6dd0e0 LoadLibraryA
user32.dll
 0x6dd0e8 MessageBoxA
advapi32.dll
 0x6dd0f0 RegCloseKey
oleaut32.dll
 0x6dd0f8 SysFreeString
gdi32.dll
 0x6dd100 CreateFontA
shell32.dll
 0x6dd108 ShellExecuteA
version.dll
 0x6dd110 GetFileVersionInfoA
ole32.dll
 0x6dd118 CoCreateInstance

EAT(Export Address Table) is none


Similarity measure (PE file only) - Checking for service failure