Summary

File 0c7a7721b462f36baefda796aac1b05842e98257f00ed533cc4561a1275165dc

Summary

Download Resubmit sample

Size	127.0KB
Type	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
MD5	642a202e47b7b7c38b120406969add69
SHA1	b53fbbdb83e52d4c38be147a42ea947013763224
SHA256	0c7a7721b462f36baefda796aac1b05842e98257f00ed533cc4561a1275165dc
SHA512	Show SHA512 9f40f6f50e0d54bee28961cd429025a65aec348270c746ba5b4740f5899e2c134eaa2188d132b5a444a6459e7bbf741563ccde72d1a28958f8d62e7838ee0826
CRC32	1B7853F3
ssdeep	None
Yara	UPX - (no description) suspicious_packer_section - The packer/protector section names/keywords win_mutex - Create or check mutex win_registry - Affect system registries win_files_operation - Affect private profile

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6727536

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (5 events)

description	(no description)				rule	UPX
description	The packer/protector section names/keywords				rule	suspicious_packer_section
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect private profile				rule	win_files_operation

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.MPRESS1
section	.MPRESS2
section	.imports

Creates executable files on the filesystem (1 event)

file	C:\Windows\microsofthelp.exe

Drops a binary and executes it (1 event)

file	C:\Windows\microsofthelp.exe

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp

reg_value

C:\Windows\microsofthelp.exe

Creates an executable file in a user folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\0c7a7721b462f36baefda796aac1b05842e98257f00ed533cc4561a1275165dc.exe

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Generic.Malware.SF.0970E096 (Engine A)
Avast Core Security (Linux)	Win32:Evo-gen [Trj]
C4S ClamAV (Linux)	Win.Malware.7cbdf52c-10004103-0
Trellix (Linux)	Msposer
WithSecure (Linux)	Trojan.TR/Downloader.Gen
eScan Antivirus (Linux)	Generic.Malware.SF.0970E096(DB)
ESET Security (Windows)	a variant of Win32/Agent.TLD trojan
Sophos Anti-Virus (Linux)	Troj/Blihan-Gen
DrWeb Antivirus (Linux)	Trojan.Siggen7.56291
ClamAV (Linux)	Win.Malware.7cbdf52c-10004103-0
Bitdefender Antivirus (Linux)	Generic.Malware.SF.0970E096
Kaspersky Standard (Windows)	HEUR:Trojan-Dropper.Win32.Daws.gen
Emsisoft Commandline Scanner (Windows)	Generic.Malware.SF.0970E096 (B)

File has been identified by 59 AntiVirus engines on VirusTotal as malicious (50 out of 59 events)

tehtris	Generic.Malware
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Msposer.7372
Skyhigh	BehavesLike.Win32.Msposer.ct
ALYac	Generic.Malware.SF.0970E096
Cylance	Unsafe
VIPRE	Generic.Malware.SF.0970E096
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Generic.Malware.SF.0970E096
K7GW	Trojan ( 0052964f1 )
K7AntiVirus	Trojan ( 0052964f1 )
Arcabit	Generic.Malware.SF.0970E096
Baidu	Win32.Trojan.Agent.el
VirIT	Trojan.Win32.Genus.WKS
Symantec	Backdoor.Trojan
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.TLD
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
ClamAV	Win.Malware.7cbdf52c-10004103-0
Kaspersky	HEUR:Trojan-Dropper.Win32.Daws.gen
MicroWorld-eScan	Generic.Malware.SF.0970E096
Rising	Trojan.Agent!1.DC48 (CLASSIC)
Emsisoft	Generic.Malware.SF.0970E096 (B)
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.Siggen7.56291
Zillya	Trojan.Agent.Win32.3972007
McAfeeD	Real Protect-LS!642A202E47B7
Trapmine	malicious.high.ml.score
CTX	exe.unknown.generic
Sophos	Troj/Blihan-Gen
SentinelOne	Static AI - Malicious PE
Jiangmin	Trojan/Generic.uqin
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/Downloader.Gen
Antiy-AVL	Virus/Win32.Expiro.imp
Kingsoft	malware.kb.a.1000
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Blihan!pz
ZoneAlarm	Troj/Blihan-Gen
GData	Win32.Trojan.Bilhan.C
Varist	W32/Agent.BRN.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R656866
Acronis	suspicious
VBA32	Trojan.Blihan
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Win32.Blihan

Screenshots