Summary

File e93c71f61134ec0dabbc77322e118001fea8b24d8ce3147b09d53ee45ca7af46

Summary

Download Resubmit sample

Size	47.1KB
Type	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
MD5	2a4952c37cac544db204e38d25309db7
SHA1	1f724dfca1a0b266786c73e2689d46a548e4c46e
SHA256	e93c71f61134ec0dabbc77322e118001fea8b24d8ce3147b09d53ee45ca7af46
SHA512	Show SHA512 42d3f1876cab214a3f2f4eb4f65e431a6fe145725035e234d8db51681b847cd46523b251c8d5ad54b6855bb5c587053c31be62ac83d9af36e8ed77b690fb8994
CRC32	1A723469
ssdeep	None
Yara	suspicious_packer_section - The packer/protector section names/keywords

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6331004

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rule detected for file (1 event)

description

The packer/protector section names/keywords

rule

suspicious_packer_section

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

Creates executable files on the filesystem (1 event)

file	C:\Windows\microsofthelp.exe

Drops a binary and executes it (1 event)

file	C:\Windows\microsofthelp.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00005400', u'virtual_address': u'0x00001000', u'entropy': 7.840274488890553, u'name': u'.MPRESS1', u'virtual_size': u'0x0000b600'}				entropy	7.84027448889				description	A section with a high entropy has been found
entropy	0.954545454545				description	Overall entropy of this PE file is high

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp

reg_value

C:\Windows\microsofthelp.exe

Creates an executable file in a user folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\e93c71f61134ec0dabbc77322e118001fea8b24d8ce3147b09d53ee45ca7af46.exe

File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)

G Data Antivirus (Windows)	Virus: GenPack:Generic.Malware.SF!dld!.3154F137 (Engine A)
Avast Core Security (Linux)	FileRepMalware [Misc]
C4S ClamAV (Linux)	Win.Malware.Genpack-10033129-0
WithSecure (Linux)	Trojan.TR/Downloader.Gen
eScan Antivirus (Linux)	GenPack:Generic.Malware.SF!dld!.3154F137(DB)
ESET Security (Windows)	a variant of Win32/Agent.TLD trojan
Sophos Anti-Virus (Linux)	Troj/Blihan-Gen
DrWeb Antivirus (Linux)	Trojan.Siggen7.56291
Bitdefender Antivirus (Linux)	GenPack:Generic.Malware.SF!dld!.3154F137
Kaspersky Standard (Windows)	HEUR:Trojan-Dropper.Win32.Daws.gen
Emsisoft Commandline Scanner (Windows)	GenPack:Generic.Malware.SF!dld!.3154F137 (B)

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Msposer.7372
Skyhigh	BehavesLike.Win32.Agent.pm
ALYac	GenPack:Generic.Malware.SF!dld!.3154F137
Cylance	Unsafe
VIPRE	GenPack:Generic.Malware.SF!dld!.3154F137
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	GenPack:Generic.Malware.SF!dld!.3154F137
K7GW	Trojan ( 0047372f1 )
K7AntiVirus	Trojan ( 0047372f1 )
Arcabit	GenPack:Generic.Malware.SF!dld!.3154F137
Baidu	Win32.Trojan.Agent.el
VirIT	Trojan.Win32.Genus.WKV
Symantec	Backdoor.Trojan
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.TLD
APEX	Malicious
Avast	Win32:Dh-A [Heur]
ClamAV	Win.Malware.Genpack-10033129-0
Kaspersky	HEUR:Trojan-Dropper.Win32.Daws.gen
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan	GenPack:Generic.Malware.SF!dld!.3154F137
Rising	Downloader.Agent!8.B23 (TFE:5:QYwiwkqUWRV)
Emsisoft	GenPack:Generic.Malware.SF!dld!.3154F137 (B)
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.Siggen7.56291
Zillya	Dropper.Daws.Win32.32058
McAfeeD	Real Protect-LS!2A4952C37CAC
Trapmine	malicious.high.ml.score
CTX	exe.unknown.genpack
Sophos	Troj/Blihan-Gen
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDropper.Daws.kbg
Google	Detected
Avira	TR/Downloader.Gen
Antiy-AVL	Trojan/Win32.Blihan
Kingsoft	malware.kb.b.998
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Blihan!pz
ZoneAlarm	Troj/Blihan-Gen
GData	GenPack:Generic.Malware.SF!dld!.3154F137
Varist	W32/Agent.BRN.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R656602
Acronis	suspicious
DeepInstinct	MALICIOUS
VBA32	Trojan.Blihan
Malwarebytes	Generic.Malware.AI.DDS

Screenshots