Summary

File f335f936e403d368d8d8807de5f9f413fd348c67e53f6253a080beef74558f64

Summary

Download Resubmit sample

Size	52.1KB
Type	MS-DOS executable PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, MZ for MS-DOS
MD5	e9f7de00ec9450bde3ec3153ef4503b8
SHA1	758c00398b7d704928d1f985d04a261305f49a6b
SHA256	f335f936e403d368d8d8807de5f9f413fd348c67e53f6253a080beef74558f64
SHA512	Show SHA512 655cd0f16170068bd2de27e6a7dcb63920577eb6af52d40274fe70474202e9e41c421da0fefdb820aeec9782d81bfa69ec5fb2df95a4655ef297b0597267803e
CRC32	2D960A83
ssdeep	None
Yara	suspicious_packer_section - The packer/protector section names/keywords

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6641968

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rule detected for file (1 event)

description

The packer/protector section names/keywords

rule

suspicious_packer_section

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.MPRESS1
section	.MPRESS2

Creates executable files on the filesystem (1 event)

file	C:\Windows\microsofthelp.exe

Drops a binary and executes it (1 event)

file	C:\Windows\microsofthelp.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00005400', u'virtual_address': u'0x00001000', u'entropy': 7.840274488890553, u'name': u'.MPRESS1', u'virtual_size': u'0x0000b600'}				entropy	7.84027448889				description	A section with a high entropy has been found
entropy	0.954545454545				description	Overall entropy of this PE file is high

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp

reg_value

C:\Windows\microsofthelp.exe

Creates an executable file in a user folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\f335f936e403d368d8d8807de5f9f413fd348c67e53f6253a080beef74558f64.exe

File has been identified by 11 AntiVirus engine on IRMA as malicious (11 events)

G Data Antivirus (Windows)	Virus: GenPack:Generic.Malware.SF!dld!.3154F137 (Engine A)
Avast Core Security (Linux)	Win32:Dh-A [Heur]
C4S ClamAV (Linux)	Win.Malware.Genpack-10033129-0
WithSecure (Linux)	Trojan.TR/Downloader.Gen
eScan Antivirus (Linux)	GenPack:Generic.Malware.SF!dld!.3154F137(DB)
ESET Security (Windows)	a variant of Win32/Agent.TLD trojan
Sophos Anti-Virus (Linux)	Troj/Blihan-Gen
DrWeb Antivirus (Linux)	Trojan.Siggen7.56291
ClamAV (Linux)	Win.Malware.Genpack-10033129-0
Bitdefender Antivirus (Linux)	GenPack:Generic.Malware.SF!dld!.3154F137
Emsisoft Commandline Scanner (Windows)	GenPack:Generic.Malware.SF!dld!.3154F137 (B)

File has been identified by 56 AntiVirus engines on VirusTotal as malicious (50 out of 56 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
MicroWorld-eScan	GenPack:Generic.Malware.SF!dld!.3154F137
CAT-QuickHeal	Trojan.Msposer.7372
Skyhigh	BehavesLike.Win32.Generic.qt
ALYac	GenPack:Generic.Malware.SF!dld!.3154F137
Cylance	Unsafe
VIPRE	GenPack:Generic.Malware.SF!dld!.3154F137
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	GenPack:Generic.Malware.SF!dld!.3154F137
K7GW	Trojan ( 0047372f1 )
K7AntiVirus	Trojan ( 0047372f1 )
Arcabit	GenPack:Generic.Malware.SF!dld!.3154F137
Baidu	Win32.Trojan.Agent.el
VirIT	Trojan.Win32.Genus.WKV
Symantec	Backdoor.Trojan
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.TLD
APEX	Malicious
Avast	Win32:Dh-A [Heur]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Dropper.Win32.Daws.gen
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
Rising	Downloader.Agent!8.B23 (TFE:5:QYwiwkqUWRV)
Emsisoft	GenPack:Generic.Malware.SF!dld!.3154F137 (B)
F-Secure	Trojan.TR/Downloader.Gen
DrWeb	Trojan.Siggen7.56291
Zillya	Dropper.Daws.Win32.32058
McAfeeD	Real Protect-LS!E9F7DE00EC94
Trapmine	malicious.high.ml.score
CTX	exe.unknown.genpack
Sophos	Troj/Blihan-Gen
SentinelOne	Static AI - Malicious PE
Jiangmin	TrojanDropper.Daws.kbg
Google	Detected
Avira	TR/Downloader.Gen
Antiy-AVL	Trojan/Win32.Blihan
Kingsoft	malware.kb.b.998
Gridinsoft	Trojan.Win32.Agent.oa!s1
Microsoft	Trojan:Win32/Blihan!pz
ZoneAlarm	Troj/Blihan-Gen
GData	GenPack:Generic.Malware.SF!dld!.3154F137
Varist	W32/Agent.BRN.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.R656602
Acronis	suspicious
VBA32	Trojan.Blihan
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Trojan.Win32.Blihan

Screenshots