Summary

File 7d0cd34c2af9d6d911083c8fb878820e46e3a9dfdbc8c847838b18efc7c1a93b

Summary

Download Resubmit sample

Size	15.4MB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	bb6005ff351a73c26ee888252e42f278
SHA1	830037b7de3b6454f95a1ee0e81537d707094414
SHA256	7d0cd34c2af9d6d911083c8fb878820e46e3a9dfdbc8c847838b18efc7c1a93b
SHA512	Show SHA512 e509bf5978ebaca7de04958711858e0d3b8e277feeaa6c5b9004545633dd42fe86ce3085d5c6927a8b96a2b6b980219f5fad5632bd43aa9a614c9381db352929
CRC32	F35011E3
ssdeep	None
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6244032

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (2 events)

description	(no description)				rule	UPX
description	The packer/protector section names/keywords				rule	suspicious_packer_section

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA April 5, 2025, 6:53 a.m.	computer_name: GODGTWDVGVC	1	1	0

Command line console output was observed (2 events)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW April 5, 2025, 6:53 a.m.	buffer: ERROR: console_handle: 0x0000000b	1	1	0
WriteConsoleW April 5, 2025, 6:53 a.m.	buffer: Delete request is partially completed. console_handle: 0x0000000b	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 5, 2025, 6:53 a.m.		1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ April 5, 2025, 6:53 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xc41f exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 50207 exception.address: 0x751bc41f registers.esp: 1635516 registers.edi: 5049976 registers.eax: 1635516 registers.ebp: 1635596 registers.edx: 0 registers.ebx: 5049976 registers.esi: 5049976 registers.ecx: 2	1	0	0
__exception__ April 5, 2025, 6:53 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xc41f exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 50207 exception.address: 0x751bc41f registers.esp: 1635732 registers.edi: 5049976 registers.eax: 1635732 registers.ebp: 1635812 registers.edx: 0 registers.ebx: 5049976 registers.esi: 5049976 registers.ecx: 2	1	0	0
__exception__ April 5, 2025, 6:53 a.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xc41f exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 50207 exception.address: 0x751bc41f registers.esp: 1635732 registers.edi: 5049976 registers.eax: 1635732 registers.ebp: 1635812 registers.edx: 0 registers.ebx: 5049976 registers.esi: 5049976 registers.ecx: 2	1	0	0

Creates executable files on the filesystem (4 events)

file	C:\Windows\W_X_C.vbs
file	C:\Users\Administrator\AppData\Local\Temp\avscan.exe
file	C:\Windows\hosts.exe
file	c:\Windows\W_X_C.bat

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\avscan.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 5, 2025, 6:53 a.m.	process_identifier: 696 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003f0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00007000', u'virtual_address': u'0x00020000', u'entropy': 7.916214191388184, u'name': u'UPX1', u'virtual_size': u'0x00007000'}				entropy	7.91621419139				description	A section with a high entropy has been found
entropy	0.543689320388				description	Overall entropy of this PE file is high

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

REG DELETE HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot /f

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\avscan

reg_value

C:\Users\ADMINI~1\AppData\Local\Temp\avscan.exe

Attempts to modify Explorer settings to prevent file extensions from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt

Attempts to modify Explorer settings to prevent hidden files from being displayed (2 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\SuperHidden

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Dropped:Trojan.Script.418723 (Engine A)
Avast Core Security (Linux)	FileRepMalware [Misc]
C4S ClamAV (Linux)	Win.Malware.Generickdz-9939920-0
Trellix (Linux)	Generic VB.b trojan
WithSecure (Linux)	Trojan.TR/Dropper.Gen
eScan Antivirus (Linux)	Dropped:Trojan.Script.418723(DB)
ESET Security (Windows)	Win32/Otfrem.A virus
Sophos Anti-Virus (Linux)	Mal/SillyFDC-K
DrWeb Antivirus (Linux)	Trojan.PWS.Banker1.30100
ClamAV (Linux)	Win.Malware.Generickdz-9939920-0
Bitdefender Antivirus (Linux)	Dropped:Trojan.Script.418723
Kaspersky Standard (Windows)	Trojan.Win32.Lunam.a
Emsisoft Commandline Scanner (Windows)	Dropped:Trojan.Script.418723 (B)

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.wm
ALYac	Dropped:Trojan.Script.418723
Cylance	Unsafe
VIPRE	Dropped:Trojan.Script.418723
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Dropped:Trojan.Script.418723
K7GW	Trojan ( 0054dc901 )
K7AntiVirus	Trojan ( 0054dc901 )
Arcabit	Trojan.Script.D663A3
Baidu	Win32.Trojan.Otfrem.b
VirIT	Trojan.Win32.Genus.XLU
Symantec	W32.SillyFDC.BCR
Elastic	malicious (moderate confidence)
ESET-NOD32	Win32/Otfrem.A
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
ClamAV	Win.Malware.Generickdz-9939920-0
Kaspersky	Trojan.Win32.Lunam.a
NANO-Antivirus	Trojan.Win32.VB.mjwir
MicroWorld-eScan	Dropped:Trojan.Script.418723
Rising	Trojan.Lunam!1.B819 (CLASSIC)
Emsisoft	Dropped:Trojan.Script.418723 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.PWS.Banker1.30100
Zillya	Trojan.Lunam.Win32.1058
Trapmine	suspicious.low.ml.score
CTX	exe.trojan.dropped
Sophos	Mal/SillyFDC-K
SentinelOne	Static AI - Malicious PE
FireEye	Generic.mg.bb6005ff351a73c2
Jiangmin	Trojan/Lunam.b
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	GrayWare/Win32.Wacapew
Gridinsoft	Trojan.Win32.Gen.se!i
Xcitium	TrojWare.Win32.Spy.Agent.1396070@1qn3u3
Microsoft	Trojan:Win32/Lunam
ZoneAlarm	Mal/SillyFDC-K
GData	Dropped:Trojan.Script.418723
Varist	W32/VB.ACN.gen!Eldorado
AhnLab-V3	Trojan/Win.Lunam.R644500
Acronis	suspicious
McAfee	Generic VB.b
DeepInstinct	MALICIOUS
VBA32	Trojan.VBO.012939

Screenshots