Summary

File aad2bdb17f8cfd3a7cfeb83efd1c508f3a5e7e59fb7a88b8a987869a0074a392

Summary

Download Resubmit sample

Size	5.7MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	7b98afa76c8562140a02cb6eba1c32af
SHA1	2970e66467f4ad37c6f4a33beb37debe9aacb015
SHA256	aad2bdb17f8cfd3a7cfeb83efd1c508f3a5e7e59fb7a88b8a987869a0074a392
SHA512	Show SHA512 a8908c2cffcdab89a742f22ad61488922dbd5939ff2bf9fbc7ebde5950a30a4492964a69cf20d4267123190384eb2f30cd90c9e2628968b00b2055c073cc3227
CRC32	BA8BE5AB
ssdeep	None
Yara	screenshot - Take screenshot keylogger - Run a keylogger win_registry - Affect system registries win_files_operation - Affect private profile win_hook - Affect hook table

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6588614

6588615

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (5 events)

description	Take screenshot				rule	screenshot
description	Run a keylogger				rule	keylogger
description	Affect system registries				rule	win_registry
description	Affect private profile				rule	win_files_operation
description	Affect hook table				rule	win_hook

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory June 20, 2025, 4:40 p.m.	process_identifier: 2404 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory June 20, 2025, 4:41 p.m.	process_identifier: 2492 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 20, 2025, 4:41 p.m.	buffer: The operation completed successfully. console_handle: 0x00000007	1	1	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 20, 2025, 4:41 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (7 events)

section	CODE\x00U
section	DATA\x00s\x1dm
section	BSS\x00\xba\x7f
section	.data2
section	.tls\x00\x7f
section	.rdata\x00\
section	.reloc\x00h

Creates executable files on the filesystem (2 events)

file	C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe
file	C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe

Drops a binary and executes it (2 events)

file	C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe
file	C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\Administrator\AppData\Roaming\Scegli_nome_allegato.exe
file	C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW June 20, 2025, 4:41 p.m.	show_type: 0 filepath_r: reg.exe parameters: ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f filepath: reg.exe	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x001a3e00', u'virtual_address': u'0x0005d000', u'entropy': 7.97621457712309, u'name': u'.rsrc', u'virtual_size': u'0x001a3c78'}				entropy	7.97621457712				description	A section with a high entropy has been found
entropy	0.827543729983				description	Overall entropy of this PE file is high

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	"C:\Windows\System32\reg.exe" ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f
cmdline	reg.exe ADD HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "Windows Update" /t REG_SZ /d "C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe" /f

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update

reg_value

C:\Users\Administrator\AppData\Roaming\7D57AD13E21.exe

File has been identified by 12 AntiVirus engine on IRMA as malicious (12 events)

G Data Antivirus (Windows)	Virus: Gen:Variant.Genie.689 (Engine A)
Avast Core Security (Linux)	Win32:MBRlock-DV [Trj]
C4S ClamAV (Linux)	Win.Trojan.Mbrlock-9779766-0
Trellix (Linux)	GenericRXIP-BJ
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Gen:Variant.Genie.689(DB)
ESET Security (Windows)	a variant of Win32/Injector.ERFT trojan
Sophos Anti-Virus (Linux)	Troj/Inject-JDR
DrWeb Antivirus (Linux)	Trojan.DownLoader6.7779
ClamAV (Linux)	Win.Trojan.Mbrlock-9779766-0
Bitdefender Antivirus (Linux)	Gen:Variant.Genie.689
Emsisoft Commandline Scanner (Windows)	Gen:Variant.Genie.689 (B)

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.GimemPMF.S24870139
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Gen:Variant.Genie.689
Cylance	Unsafe
VIPRE	Gen:Variant.Genie.689
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Variant.Genie.689
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Trojan ( 00548e051 )
Arcabit	Trojan.Genie.689
VirIT	Trojan.Win32.GenHeur.C
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Injector.ERFT
APEX	Malicious
Avast	Win32:MBRlock-DV [Trj]
ClamAV	Win.Trojan.Mbrlock-9779766-0
Kaspersky	HEUR:Trojan-Ransom.Win32.Blocker.vho
NANO-Antivirus	Trojan.Win32.Dapato.bsjzfg
MicroWorld-eScan	Gen:Variant.Genie.689
Rising	Trojan.Injector!1.DA56 (CLASSIC)
Emsisoft	Gen:Variant.Genie.689 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	Trojan.DownLoader6.7779
McAfeeD	Real Protect-LS!7B98AFA76C85
Trapmine	malicious.high.ml.score
CTX	exe.unknown.genie
Sophos	Troj/Inject-JDR
SentinelOne	Static AI - Malicious PE
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	GrayWare/Win32.Kryptik.ahho
Kingsoft	malware.kb.a.998
Xcitium	TrojWare.Win32.Injector.HO@82j6jo
Microsoft	Trojan:Win32/Blocker.EM!MTB
ZoneAlarm	Troj/Inject-JDR
GData	Gen:Variant.Genie.689
Varist	W32/Injector.BVS.gen!Eldorado
AhnLab-V3	Dropper/Win32.Dapato.R83155
VBA32	TrojanRansom.Blocker
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Win32.Injector
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	Trojan.Win32.VSX.PE04C9Z

Screenshots