Summary

File 04ad19ec4cca36d9a6684ea1e7f34a8a53599a27f2c8417c509464bc39b00f88

Summary

Download Resubmit sample

Size	137.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	590efac89c065e127ca7b4e131bd5177
SHA1	588ba161886dc57c903ea99a154051b0c7e9941b
SHA256	04ad19ec4cca36d9a6684ea1e7f34a8a53599a27f2c8417c509464bc39b00f88
SHA512	Show SHA512 efd2205789c1bc4be23fa6dcb3f78b7861ee0a52d025a058a289a7f8ad6a524d906e817ead091e06118b296039d8594d4d0b59b13089f3048b73f79a141a1287
CRC32	2480B4FC
ssdeep	None
Yara	SEH__vba - (no description)

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6588613

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rule detected for file (1 event)

description

(no description)

rule

SEH__vba

Command line console output was observed (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteConsoleW June 20, 2025, 4:40 p.m.	buffer: ERROR: The process "KSafeTray.exe" not found. console_handle: 0x0000000b	1	1	0

One or more processes crashed (3 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 20, 2025, 4:40 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xc41f exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 50207 exception.address: 0x7507c41f registers.esp: 1635416 registers.edi: 6033520 registers.eax: 1635416 registers.ebp: 1635496 registers.edx: 0 registers.ebx: 6033520 registers.esi: 6033520 registers.ecx: 2	1	0	0
__exception__ June 20, 2025, 4:40 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xc41f exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 50207 exception.address: 0x7507c41f registers.esp: 1634856 registers.edi: 5981240 registers.eax: 1634856 registers.ebp: 1634936 registers.edx: 0 registers.ebx: 5981240 registers.esi: 5981240 registers.ecx: 2	1	0	0
__exception__ June 20, 2025, 4:40 p.m.	stacktrace: EbGetHandleOfExecutingProject+0x22b3 rtcPackDate-0xba9 msvbvm60+0xd0dcf @ 0x72a10dcf rtcDoEvents+0x131 __vbaError-0x626 msvbvm60+0xce228 @ 0x72a0e228 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xc41f exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xc000008f exception.offset: 50207 exception.address: 0x7507c41f registers.esp: 1635072 registers.edi: 5981240 registers.eax: 1635072 registers.ebp: 1635152 registers.edx: 0 registers.ebx: 5981240 registers.esi: 5981240 registers.ecx: 2	1	0	0

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x0001b1e0

size

0x00000220

Creates executable files on the filesystem (2 events)

file	c:\sys.exe
file	C:\Windows\sys.exe

Executes one or more WMI queries (1 event)

wmi	SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( Caption = "KSafeTray.exe")

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (22 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: services.exe process_identifier: 500	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: svchost.exe process_identifier: 780	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: svchost.exe process_identifier: 836	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: spoolsv.exe process_identifier: 1076	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: svchost.exe process_identifier: 1104	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: taskhost.exe process_identifier: 1624	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: unsecapp.exe process_identifier: 1780	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: WmiPrvSE.exe process_identifier: 656	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: SearchIndexer.exe process_identifier: 2208	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: OSPPSVC.EXE process_identifier: 2988	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: mscorsvw.exe process_identifier: 2576	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: sppsvc.exe process_identifier: 2676	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: WmiPrvSE.exe process_identifier: 664	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: SearchProtocolHost.exe process_identifier: 1460	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: mobsync.exe process_identifier: 2476	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: pythonw.exe process_identifier: 1820	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: taskhost.exe process_identifier: 1120	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: sys.exe process_identifier: 2308	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: cmd.exe process_identifier: 2944	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: conhost.exe process_identifier: 1684	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: taskkill.exe process_identifier: 2952	1	1	0
Process32NextW June 20, 2025, 4:40 p.m.	snapshot_handle: 0x000000f8 process_name: conhost.exe process_identifier: 2056	1	1	0

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 20, 2025, 4:40 p.m.	process_identifier: 2740 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003e0000 process_handle: 0xffffffff	1	0	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW June 20, 2025, 4:40 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (2 events)

cmdline	taskkill.exe /im KSafeTray.exe /f
cmdline	cmd /c del 04ad19ec4cca36d9a6684ea1e7f34a8a53599a27f2c8417c509464bc39b00f88.exe

File has been identified by 12 AntiVirus engine on IRMA as malicious (12 events)

G Data Antivirus (Windows)	Virus: Generic.Dacic.76A3436A.A.0CD67633 (Engine A), Win32.Trojan.PSE.12470O7 (Engine B)
Avast Core Security (Linux)	Win32:MalwareX-gen [Drp]
C4S ClamAV (Linux)	Win.Malware.Cyns-7782618-0
Trellix (Linux)	GenericRXAE-GJ
WithSecure (Linux)	Trojan.TR/Dropper.Gen
eScan Antivirus (Linux)	Generic.Dacic.76A3436A.A.0CD67633(DB)
ESET Security (Windows)	Win32/VB.PRB trojan
Sophos Anti-Virus (Linux)	Mal/VB-WA
DrWeb Antivirus (Linux)	Trojan.Click1.60752
ClamAV (Linux)	Win.Malware.Cyns-7782618-0
Bitdefender Antivirus (Linux)	Generic.Dacic.76A3436A.A.0CD67633
Emsisoft Commandline Scanner (Windows)	Generic.Dacic.76A3436A.A.0CD67633 (B)

File has been identified by 63 AntiVirus engines on VirusTotal as malicious (50 out of 63 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.CynsVMF.S28095021
Skyhigh	BehavesLike.Win32.Generic.cm
ALYac	Generic.Dacic.76A3436A.A.0CD67633
Cylance	Unsafe
VIPRE	Generic.Dacic.76A3436A.A.0CD67633
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Generic.Dacic.76A3436A.A.0CD67633
K7GW	Trojan ( 0058d34b1 )
K7AntiVirus	Trojan ( 0058d34b1 )
Arcabit	Generic.Dacic.76A3436A.A.0CD67633
Baidu	Win32.Trojan.VB.fb
VirIT	Trojan.Win32.Click1.DLWQ
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/VB.PRB
APEX	Malicious
Avast	Win32:MalwareX-gen [Drp]
ClamAV	Win.Malware.Cyns-7782618-0
Kaspersky	Trojan-Dropper.Win32.Cyns.a
NANO-Antivirus	Trojan.Win32.Cyns.hivwdd
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
MicroWorld-eScan	Generic.Dacic.76A3436A.A.0CD67633
Rising	Trojan.DL.Win32.VBcode.ary (CLASSIC)
Emsisoft	Generic.Dacic.76A3436A.A.0CD67633 (B)
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Click1.60752
Zillya	Trojan.Agent.Win32.131109
McAfeeD	ti!04AD19EC4CCA
Trapmine	suspicious.low.ml.score
CTX	exe.unknown.dacic
Sophos	Mal/VB-WA
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDropper.Cyns.b
Google	Detected
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Win32.VB.prb
Kingsoft	malware.kb.a.986
Gridinsoft	Trojan.Win32.Wacatac.dd!n
Xcitium	TrojWare.Win32.Agent.hqvl@4j9rf1
Microsoft	Trojan:Win32/Sisproc!pz
ViRobot	Trojan.Win32.A.Agent.140804
ZoneAlarm	Mal/VB-WA
GData	Win32.Trojan.StartPage.AL
Varist	W32/StartPage.BD.gen!Eldorado
AhnLab-V3	Trojan/Win32.StartPage.R19634
Acronis	suspicious

Screenshots