Summary

File 63d7a5f1d767619ac4ad8ca32af1e7965b585b2c3e5178976398473aeaff64f9

Summary

Download Resubmit sample

Size	105.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	f0fcb890d9d6b2eb30c179461b23d060
SHA1	0f7b9cb9d440e11a37a31746536127c6b1393439
SHA256	63d7a5f1d767619ac4ad8ca32af1e7965b585b2c3e5178976398473aeaff64f9
SHA512	Show SHA512 cbcad294a9b7d662352ede4a4436e3f912f46a8a40b1c2fde739a3ce064733199894192241144c98bf8345747a387cb6713ed471a25305080c56a542beed1f25
CRC32	00A4C95D
ssdeep	None
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords network_dropper - File downloader/dropper win_registry - Affect system registries

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6600727

6600728

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (4 events)

description	(no description)				rule	UPX
description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	File downloader/dropper				rule	network_dropper
description	Affect system registries				rule	win_registry

Creates executable files on the filesystem (9 events)

file	C:\Windows\win32dc\Sims 2 fix.exe
file	C:\Windows\win32dc\Half-Life 2 + hack.exe
file	C:\Windows\win32dc\FlatOut patch.exe
file	C:\Windows\win32dc\Counter-Strike(hack).exe
file	C:\Windows\win32dc\Silent Hill 4 crack.exe
file	C:\Windows\win32dc\FlatOut cdfix.exe
file	C:\Windows\win32dc\Doom 3_crack.exe
file	C:\Windows\win32dc\FlatOut_hack.exe
file	C:\Windows\win32dc\Silent Hill 4(hack).exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00007c00', u'virtual_address': u'0x00018000', u'entropy': 7.872593531904389, u'name': u'UPX1', u'virtual_size': u'0x00008000'}				entropy	7.8725935319				description	A section with a high entropy has been found
entropy	0.939393939394				description	Overall entropy of this PE file is high

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

Raised Snort alerts (2 events)

snort	ET CHAT IRC PONG response
snort	ETPRO POLICY Possible IRC Botnet Activity - Throttled Connection

Raised Suricata alerts (5 events)

suricata	ETPRO MALWARE Backdoor.Win32.Delf.ars IRC Checkin
suricata	ET CHAT IRC PONG response
suricata	ET CHAT IRC NICK command
suricata	ETPRO INFO Possible IRC Botnet Activity - Throttled Connection
suricata	ET CHAT IRC PING command

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Generic.Malware.S!dld!.AF6ABF18 (Engine A)
Avast Core Security (Linux)	Win32:MalwareX-gen [Bot]
C4S ClamAV (Linux)	YARA.UPX.UNOFFICIAL
Trend Micro SProtect (Linux)	BKDR_MYDOOM.SMM
Trellix (Linux)	Exploit-Mydoom virus
WithSecure (Linux)	Trojan.TR/Dldr.Delphi.Gen
eScan Antivirus (Linux)	Generic.Malware.S!dld!.AF6ABF18(DB)
ESET Security (Windows)	a variant of Win32/IRCBot.AZV trojan
Sophos Anti-Virus (Linux)	Mal/Generic-S
DrWeb Antivirus (Linux)	Win32.HLLW.Siggen.10562
ClamAV (Linux)	Win.Trojan.Delf-6717398-0
Bitdefender Antivirus (Linux)	Generic.Malware.S!dld!.AF6ABF18
Emsisoft Commandline Scanner (Windows)	Generic.Malware.S!dld!.AF6ABF18 (B)

File has been identified by 58 AntiVirus engines on VirusTotal as malicious (50 out of 58 events)

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.ExploitMydoom.cc
ALYac	Generic.Malware.S!dld!.AF6ABF18
Cylance	Unsafe
VIPRE	Generic.Malware.S!dld!.AF6ABF18
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Generic.Malware.S!dld!.AF6ABF18
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Arcabit	Generic.Malware.S!dld!.AF6ABF18
Baidu	Win32.Trojan.Delf.j
VirIT	Trojan.Win32.GenBoT.DIC
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/IRCBot.AZV
APEX	Malicious
Avast	Win32:MalwareX-gen [Bot]
ClamAV	Win.Trojan.Delf-6717398-0
Kaspersky	Backdoor.Win32.Delf.ars
MicroWorld-eScan	Generic.Malware.S!dld!.AF6ABF18
Rising	Backdoor.Delf!8.780 (TFE:5:HCAsfwPAUr)
Emsisoft	Generic.Malware.S!dld!.AF6ABF18 (B)
F-Secure	Trojan.TR/Dldr.Delphi.Gen
DrWeb	Win32.HLLW.Siggen.10562
Zillya	Backdoor.Delf.Win32.23289
TrendMicro	BKDR_MYDOOM.SMM
McAfeeD	Real Protect-LS!F0FCB890D9D6
Trapmine	malicious.moderate.ml.score
CTX	exe.unknown.generic
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor/Delf.hxo
Google	Detected
Avira	TR/Dldr.Delphi.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Delf
Kingsoft	malware.kb.b.1000
Gridinsoft	Ransom.Win32.Zbot.oa!s2
Xcitium	TrojWare.Win32.TrojanDownloader.Delf.gen@1xqow5
Microsoft	PWS:Win32/Zbot!ml
GData	Win32.Trojan.PSE.14ORHP5
Varist	W32/Delfloader.B.gen!Eldorado
AhnLab-V3	Backdoor/Win.Delf.R698830
Acronis	suspicious
VBA32	BScope.Backdoor.Delf
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2695501458
Ikarus	Backdoor.Win32.IRCBot
Panda	Trj/Genetic.gen

Screenshots