Summary

File 186485a0b8f6ad4bc5ecb7246f53b91e009199be1b308450abee1a237a7327c8

Summary

Download Resubmit sample

Size	99.2KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
MD5	9e230b9066c3d84b8c2de50750f77c9d
SHA1	3b29c3f39f662e06c64079665566f9f8565aecbc
SHA256	186485a0b8f6ad4bc5ecb7246f53b91e009199be1b308450abee1a237a7327c8
SHA512	Show SHA512 53363c7316d42fa78446bb72c076ece6fd71a1f50bc7b2cdc1691cc1cda753d5e9b5192fa538af8ad17c23abb990cfde52d0b8e76d2f5c9034347beca5f31df3
CRC32	F4B66771
ssdeep	None
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords network_dropper - File downloader/dropper win_registry - Affect system registries

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6719676

6719677

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (4 events)

description	(no description)				rule	UPX
description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	File downloader/dropper				rule	network_dropper
description	Affect system registries				rule	win_registry

Creates executable files on the filesystem (7 events)

file	C:\Windows\win32dc\Half-Life 2 nocd.exe
file	C:\Windows\win32dc\Quake3_crack.exe
file	C:\Windows\win32dc\Sims 2(cheat).exe
file	C:\Windows\win32dc\Quake3 + cheat.exe
file	C:\Windows\win32dc\Half-Life 2_cheat.exe
file	C:\Windows\win32dc\BattleField 1942 trainer.exe
file	C:\Windows\win32dc\BattleField 1942_trainer.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00007c00', u'virtual_address': u'0x00018000', u'entropy': 7.872593531904389, u'name': u'UPX1', u'virtual_size': u'0x00008000'}				entropy	7.8725935319				description	A section with a high entropy has been found
entropy	0.939393939394				description	Overall entropy of this PE file is high

The executable is compressed using UPX (2 events)

section	UPX0				description	Section name indicates UPX
section	UPX1				description	Section name indicates UPX

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Generic.Malware.S!dld!.AF6ABF18 (Engine A)
Avast Core Security (Linux)	Win32:MalwareX-gen [Bot]
C4S ClamAV (Linux)	YARA.UPX.UNOFFICIAL
Trellix (Linux)	Exploit-Mydoom virus
WithSecure (Linux)	Trojan.TR/Dldr.Delphi.Gen
eScan Antivirus (Linux)	Generic.Malware.S!dld!.AF6ABF18(DB)
ESET Security (Windows)	a variant of Win32/IRCBot.AZV trojan
Sophos Anti-Virus (Linux)	Mal/Generic-S
DrWeb Antivirus (Linux)	Win32.HLLW.Siggen.10562
ClamAV (Linux)	Win.Trojan.Delf-6717398-0
Bitdefender Antivirus (Linux)	Generic.Malware.S!dld!.AF6ABF18
Kaspersky Standard (Windows)	Backdoor.Win32.Delf.ars
Emsisoft Commandline Scanner (Windows)	Generic.Malware.S!dld!.AF6ABF18 (B)

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.ExploitMydoom.nc
ALYac	Generic.Malware.S!dld!.AF6ABF18
Cylance	Unsafe
VIPRE	Generic.Malware.S!dld!.AF6ABF18
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Generic.Malware.S!dld!.AF6ABF18
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Arcabit	Generic.Malware.S!dld!.AF6ABF18
Baidu	Win32.Trojan.Delf.j
VirIT	Trojan.Win32.GenBoT.DIC
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of Win32/IRCBot.AZV
APEX	Malicious
Avast	Win32:MalwareX-gen [Bot]
ClamAV	Win.Trojan.Delf-6717398-0
Kaspersky	Backdoor.Win32.Delf.ars
MicroWorld-eScan	Generic.Malware.S!dld!.AF6ABF18
Rising	Backdoor.Delf!8.780 (TFE:5:HCAsfwPAUr)
Emsisoft	Generic.Malware.S!dld!.AF6ABF18 (B)
F-Secure	Trojan.TR/Dldr.Delphi.Gen
DrWeb	Win32.HLLW.Siggen.10562
Zillya	Backdoor.Delf.Win32.23289
TrendMicro	BKDR_MYDOOM.SMM
McAfeeD	Real Protect-LS!9E230B9066C3
Trapmine	malicious.moderate.ml.score
CTX	exe.unknown.generic
Sophos	ML/PE-A
SentinelOne	Static AI - Malicious PE
Jiangmin	Backdoor/Delf.hxo
Google	Detected
Avira	TR/Dldr.Delphi.Gen
Antiy-AVL	Trojan[Backdoor]/Win32.Delf
Kingsoft	malware.kb.b.1000
Gridinsoft	Ransom.Win32.Zbot.oa!s2
Xcitium	TrojWare.Win32.TrojanDownloader.Delf.gen@1xqow5
Microsoft	PWS:Win32/Zbot!ml
GData	Win32.Trojan.PSE.14ORHP5
Varist	W32/Delfloader.B.gen!Eldorado
AhnLab-V3	Backdoor/Win.Delf.R698830
Acronis	suspicious
VBA32	Backdoor.Delf
DeepInstinct	MALICIOUS
Malwarebytes	Malware.AI.2695501458
Ikarus	Backdoor.Win32.IRCBot
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	BKDR_MYDOOM.SMM

Screenshots