Summary

File 9bea8a848feba8aaf4309bcc03ebe15792a953e52018fa318f3abe50f9fcf6f9

Summary

Download Resubmit sample

Size	197.2KB
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	cdc87e63ae2662b91ac1a31e169daa07
SHA1	3ec733f108ec57a8b8a3f18b4b4dcfcc5ec8148f
SHA256	9bea8a848feba8aaf4309bcc03ebe15792a953e52018fa318f3abe50f9fcf6f9
SHA512	Show SHA512 ea645d74cca140a42014c40336af7213ab289b5876b842782d3cbfad2c0c0ca8bbea9da31eaf30ffab8d12a7ee2155e530e34fbe2db38f24c6422ab7727031a4
CRC32	1CA8AB4A
ssdeep	None
Yara	suspicious_packer_section - The packer/protector section names/keywords network_irc - Communications over IRC network network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket network_dns - Communications use DNS keylogger - Run a keylogger spreading_share - Malware can spread east-west using share drive win_mutex - Create or check mutex win_registry - Affect system registries win_private_profile - Affect private profile

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6631151

6631152

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (10 events)

description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	Communications over IRC network				rule	network_irc
description	File downloader/dropper				rule	network_dropper
description	Communications over RAW socket				rule	network_tcp_socket
description	Communications use DNS				rule	network_dns
description	Run a keylogger				rule	keylogger
description	Malware can spread east-west using share drive				rule	spreading_share
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect private profile				rule	win_private_profile

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.imports

Creates executable files on the filesystem (6 events)

file	C:\Windows\win32dc\Half-Life 2(serial).exe
file	C:\Windows\win32dc\Quake3 patch.exe
file	C:\Windows\win32dc\Silent Hill 4(codes).exe
file	C:\Windows\win32dc\Silent Hill 4 + cdfix.exe
file	C:\Windows\win32dc\Half-Life 2_fix.exe
file	C:\Windows\win32dc\UT2004 fix.exe

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Dropped:Generic.Malware.S!dld!.B44DDF53 (Engine A), Win32.Worm.MyDoom.B (Engine B)
Avast Core Security (Linux)	Win32:MalwareX-gen [Bot]
C4S ClamAV (Linux)	Win.Malware.Delf-6717516-0
Trellix (Linux)	Exploit-Mydoom virus
WithSecure (Linux)	Worm.WORM/Rbot.Gen
eScan Antivirus (Linux)	Dropped:Generic.Malware.S!dld!.B44DDF53(DB)
ESET Security (Windows)	a variant of Win32/IRCBot.AZV trojan
Sophos Anti-Virus (Linux)	Mal/Generic-S
DrWeb Antivirus (Linux)	Win32.HLLW.Siggen.10562
ClamAV (Linux)	Win.Malware.Delf-6717516-0
Bitdefender Antivirus (Linux)	Dropped:Generic.Malware.S!dld!.B44DDF53
Kaspersky Standard (Windows)	Backdoor.Win32.Delf.ars
Emsisoft Commandline Scanner (Windows)	Dropped:Generic.Malware.S!dld!.B44DDF53 (B)

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.ExploitMydoom.ch
Cylance	Unsafe
VIPRE	Dropped:Generic.Malware.S!dld!.B44DDF53
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Dropped:Generic.Malware.S!dld!.B44DDF53
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Arcabit	Generic.Malware.S!dld!.B44DDF53
Baidu	Win32.Trojan.Delf.j
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/IRCBot.AZV
APEX	Malicious
Avast	Win32:MalwareX-gen [Bot]
ClamAV	Win.Malware.Delf-6717516-0
Kaspersky	Backdoor.Win32.Delf.ars
MicroWorld-eScan	Dropped:Generic.Malware.S!dld!.B44DDF53
Rising	Backdoor.Delf!1.64C1 (CLASSIC)
Emsisoft	Dropped:Generic.Malware.S!dld!.B44DDF53 (B)
F-Secure	Worm.WORM/Rbot.Gen
DrWeb	Win32.HLLW.Siggen.10562
Zillya	Backdoor.Delf.Win32.23293
McAfeeD	Real Protect-LS!CDC87E63AE26
Trapmine	malicious.high.ml.score
CTX	exe.unknown.dropped
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor/Delf.hxo
Webroot	W32.Malware.Gen
Google	Detected
Avira	WORM/Rbot.Gen
Antiy-AVL	Virus/Win32.Expiro.imp
Kingsoft	malware.kb.a.1000
Gridinsoft	Malware.Win32.Gen.bot!se30272
Xcitium	TrojWare.Win32.TrojanDownloader.Delf.gen@1xqow5
Microsoft	Trojan:Win32/Sdum!pz
ZoneAlarm	Mal/MyDoom-B
GData	Win32.Worm.MyDoom.B
Varist	W32/Delfloader.B.gen!Eldorado
AhnLab-V3	Backdoor/Win.Mydoom.R698766
Acronis	suspicious
VBA32	BScope.Backdoor.Delf
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2105255800
Ikarus	Trojan.Crypt
Panda	Trj/Genetic.gen

Screenshots