Exes_9f86afae88b2d807a71f442891dfe3d4_exe_2019-07-29_23_30.txt

* MalFamily: "Malicious"

* MalScore: 10.0

* File Name: "Exes_9f86afae88b2d807a71f442891dfe3d4.exe"
* File Size: 2241024
* File Type: "PE32 executable (GUI) Intel 80386, for MS Windows"
* SHA256: "a3bb132ab1ba3e706b90d6fb514504105f174c4e444e87be7bce1995f798044d"
* MD5: "9f86afae88b2d807a71f442891dfe3d4"
* SHA1: "d18188a5361f8525b85750dbe4b6a50eacf91073"
* SHA512: "230dc2a5c84bc1d85374135aa96cecda8d03b714ccb652d60355fabc3fa9d9e3abe65f7728a4126effdb9d8bee222a99f556a9d2426a7c9cb8250782a80dee10"
* CRC32: "9C3E3E23"
* SSDEEP: "49152:Hz7Cki6P9qOXXO9ptDwQwniDd/hbG8fd+VsGDW92:Hz7Ti6juPtDwQ6ih/hbVwSGDu"

* Process Execution:
    "Exes_9f86afae88b2d807a71f442891dfe3d4.exe"


* Executed Commands:

* Signatures Detected:

        "Description": "Creates RWX memory",
        "Details":


        "Description": "The binary likely contains encrypted or compressed data.",
        "Details":

                "section": "name: .vmp1, entropy: 7.99, characteristics: IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ, raw_size: 0x00220000, virtual_size: 0x0021fe90"




        "Description": "The executable is likely packed with VMProtect",
        "Details":

                "section":
                    "characteristics": "IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ",
                    "characteristics_raw": "0x60000060",
                    "entropy": "0.00",
                    "name": ".vmp0",
                    "raw_address": "0x00000000",
                    "size_of_data": "0x00000000",
                    "virtual_address": "0x000b1000",
                    "virtual_size": "0x001c9512"





        "Description": "Tries to suspend Cuckoo threads to prevent logging of malicious activity",
        "Details":

                "Process": "Exes_9f86afae88b2d807a71f442891dfe3d4.exe (940)"




        "Description": "Likely installs a bootkit via raw harddisk modifications",
        "Details":


        "Description": "File has been identified by 56 Antiviruses on VirusTotal as malicious",
        "Details":

                "Bkav": "HW32.Packed."


                "MicroWorld-eScan": "Gen:Variant.Symmi.89106"


                "CAT-QuickHeal": "Trojan.Generic"


                "McAfee": "Packed-GV!9F86AFAE88B2"


                "Cylance": "Unsafe"


                "SUPERAntiSpyware": "Trojan.Agent/Gen-OnlineGames"


                "BitDefender": "Gen:Variant.Symmi.89106"


                "K7GW": "Trojan ( 005087d61 )"


                "K7AntiVirus": "Trojan ( 005087d61 )"


                "Cyren": "W32/Trojan.TKIG-0504"


                "ESET-NOD32": "Win32/Rootkit.Agent.OCL"


                "APEX": "Malicious"


                "Paloalto": "generic.ml"


                "ClamAV": "Win.Packed.Vmprotect-6762068-1"


                "GData": "Win32.Application.PUPStudio.A"


                "Kaspersky": "HEUR:Trojan.Win32.Generic"


                "Alibaba": "Trojan:Win32/Tiggre.3c6020ec"


                "NANO-Antivirus": "Trojan.Win32.NtRootKit.foyoxf"


                "AegisLab": "Trojan.Win32.Malicious.4!c"


                "Avast": "Win32:Trojan-gen"


                "Rising": "[email protected] (RDML:o2PHRUvQA1j6ZpJIVRcqYw)"


                "Endgame": "malicious (high confidence)"


                "Sophos": "Troj/Agent-BBRL"


                "Comodo": "Malware@#3mwtn2l0c098e"


                "F-Secure": "Trojan.TR/Black.Gen2"


                "DrWeb": "Trojan.NtRootKit.19689"


                "Qihoo-360": "Win32/Trojan.f26"


                "Invincea": "heuristic"


                "McAfee-GW-Edition": "Packed-GV!9F86AFAE88B2"


                "Trapmine": "malicious.high.ml.score"


                "FireEye": "Generic.mg.9f86afae88b2d807"


                "Emsisoft": "Gen:Variant.Symmi.89106 (B)"


                "Ikarus": "PUA.VMProtect"


                "Jiangmin": "Trojan.DarkGalaxy.b"


                "Webroot": "W32.Trojan.Gen"


                "Arcabit": "Trojan.Symmi.D15C12"


                "ViRobot": "Trojan.Win32.Z.Vmprotect.2241024"


                "ZoneAlarm": "HEUR:Trojan.Win32.Generic"


                "Microsoft": "Trojan:Win32/Skeeyah.A!bit"


                "AhnLab-V3": "Trojan/Win32.Agent.C3143444"


                "Acronis": "suspicious"


                "VBA32": "TScope.Malware-Cryptor.SB"


                "ALYac": "Backdoor.Agent.DarkGalaxy"


                "MAX": "malware (ai score=100)"


                "Ad-Aware": "Gen:Variant.Symmi.89106"


                "Malwarebytes": "RiskWare.Agent.VMP"


                "Tencent": "Win32.Trojan.Fakedoc.Auto"


                "Yandex": "Trojan.Agent!PjEW5VgapFc"


                "SentinelOne": "DFI - Malicious PE"


                "eGambit": "Unsafe.AI_Score_86%"


                "Fortinet": "W32/Packed.GV!tr"


                "AVG": "Win32:Trojan-gen"


                "Cybereason": "malicious.e88b2d"


                "Panda": "Trj/CI.A"


                "CrowdStrike": "win/malicious_confidence_100% (W)"


                "MaxSecure": "Trojan.Malware.7164915.susgen"




        "Description": "Clamav Hits in Target/Dropped/SuriExtracted",
        "Details":

                "target": "clamav:Win.Packed.Vmprotect-6762068-1, sha256:a3bb132ab1ba3e706b90d6fb514504105f174c4e444e87be7bce1995f798044d, type:PE32 executable (GUI) Intel 80386, for MS Windows"





* Started Service:

* Mutexes:

* Modified Files:
    "C:",
    "\\??\\PhysicalDrive0",
    "C:\\Users\\user\\AppData\\Local\\Temp\\01.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\02.dat"


* Deleted Files:
    "C:\\Users\\user\\AppData\\Local\\Temp\\01.dat",
    "C:\\Users\\user\\AppData\\Local\\Temp\\02.dat"


* Modified Registry Keys:

* Deleted Registry Keys:

* DNS Communications:

* Domains:

* Network Communication - ICMP:

* Network Communication - HTTP:

* Network Communication - SMTP:

* Network Communication - Hosts:

* Network Communication - IRC: