Summary

File d678cd78e60c1aa24eba80944c2160fc64f1bb7e6b1ae2c479952afc567fa9a7

Summary

Download Resubmit sample

Size	89.8KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	62b1ee923978656b3ea5f8f5997bc57d
SHA1	faf395fd69579ef0967b6bf1eebc5b8fc4711d4d
SHA256	d678cd78e60c1aa24eba80944c2160fc64f1bb7e6b1ae2c479952afc567fa9a7
SHA512	Show SHA512 85fcb8cfd2aad6a4297be7c9ea2c8e71ccf0ed5db801b1b37893676c8ea14fab3120717cf165586c4145632db97aa831ff0f31b33bccba0ef04fd08566ce3327
CRC32	76258BA0
ssdeep	None
Yara	suspicious_packer_section - The packer/protector section names/keywords

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

7184562

7184563

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rule detected for file (1 event)

description

The packer/protector section names/keywords

rule

suspicious_packer_section

Creates executable files on the filesystem (5 events)

file	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
file	C:\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\9C7EA51D-B2B9-4ABB-A82F-1B32707A146E\backup.exe
file	C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\update.exe
file	C:\Users\Administrator\AppData\Local\Temp\backup.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 8, 2025, 1:44 p.m.	process_identifier: 2492 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x003e0000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00003e00', u'virtual_address': u'0x00011000', u'entropy': 7.804677160000422, u'name': u'.pdata', u'virtual_size': u'0x00004000'}				entropy	7.80467716				description	A section with a high entropy has been found
entropy	0.260504201681				description	Overall entropy of this PE file is high

Attempts to modify Explorer settings to prevent file extensions from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt

Attempts to modify Explorer settings to prevent hidden files from being displayed (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Hidden

File has been identified by 14 AntiVirus engine on IRMA as malicious (14 events)

G Data Antivirus (Windows)	Virus: Trojan.Generic.4385790 (Engine A), Win32.Trojan.Vilsel.B (Engine B)
Avast Core Security (Linux)	Win32:Evo-gen [Trj]
C4S ClamAV (Linux)	Win.Malware.Genpack-6989317-0
Trend Micro SProtect (Linux)	WORM_VILSEL.SMB
Trellix (Linux)	ACL/Generic.DRFB trojan
WithSecure (Linux)	Trojan.TR/Crypt.ULPM.Gen
eScan Antivirus (Linux)	Trojan.Generic.4385790(DB)
ESET Security (Windows)	Win32/VB.OZA trojan
Sophos Anti-Virus (Linux)	Troj/VB-LET
DrWeb Antivirus (Linux)	Trojan.Copyself.102
ClamAV (Linux)	Win.Malware.Genpack-6989317-0
Bitdefender Antivirus (Linux)	Trojan.Generic.4385790
Kaspersky Standard (Windows)	Trojan.Win32.Vilsel.loy
Emsisoft Commandline Scanner (Windows)	Trojan.Generic.4385790 (B)

File has been identified by 62 AntiVirus engines on VirusTotal as malicious (50 out of 62 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.mm
ALYac	Trojan.Generic.4385790
Cylance	Unsafe
VIPRE	Trojan.Generic.4385790
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Trojan.Generic.4385790
K7GW	EmailWorm ( 005d28e71 )
K7AntiVirus	EmailWorm ( 005d28e71 )
Arcabit	Trojan.Generic.D42EBFE
Baidu	Win32.Trojan.VB.x
VirIT	Trojan.Win32.Copyself.DY
Symantec	W32.Vilsel!gen1
Elastic	malicious (high confidence)
ESET-NOD32	Win32/VB.OZA
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
ClamAV	Win.Malware.Genpack-6989317-0
Kaspersky	Trojan.Win32.Vilsel.loy
NANO-Antivirus	Trojan.Win32.Vilsel.junlqn
SUPERAntiSpyware	Trojan.Agent/Gen-Dropper
MicroWorld-eScan	Trojan.Generic.4385790
Rising	Trojan.VB!8.B20 (TFE:1:KkuL1tevOqK)
Emsisoft	Trojan.Generic.4385790 (B)
F-Secure	Trojan.TR/Crypt.ULPM.Gen
DrWeb	Trojan.Copyself.102
Zillya	Trojan.GenericML.Win32.44574
TrendMicro	WORM_VILSEL.SMB
McAfeeD	Real Protect-LS!62B1EE923978
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.generic
Sophos	Troj/VB-LET
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan.Vilsel.cji
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Crypt.ULPM.Gen
Antiy-AVL	Trojan/Win32.VB
Kingsoft	malware.kb.a.1000
Gridinsoft	Trojan.Win32.Agent.bot!s2
Xcitium	TrojWare.Win32.Trojan.Vilsel.loy0@1qq4nk
Microsoft	Trojan:Win32/PlugX!rfn
ZoneAlarm	Troj/VB-LET
GData	Win32.Trojan.Vilsel.B
Varist	W32/Trojan.WKHH-0250
AhnLab-V3	Dropper/Win.Clons.R622460
VBA32	SScope.Trojan.VB

Screenshots