Report #8429 check_circle

Binary
DLL
False cancel
Size
511.00KB
trid
32.5% Windows screen saver
24.8% DOS Borland compiled Executable
16.3% Win32 Dynamic Link Library
11.2% Win32 Executable
5.0% OS/2 Executable
type
PE
wordsize
32
Subsystem
Windows GUI
Hashes
md5
9f4f605251244bcb493a05a96f4ed3f3
sha1
8e03b13a2c494e406be81d8cf3ea54c7292ab4d1
crc32
0x90f37abb
sha224
f38d913b507512ec647df6b3cf17adae9fee5ce357795417add4b7e5
sha256
35ecd43c19fda210825f016ba204774f8fa71fe418e99af13f34302149663909
sha384
00ddaeba03b62defbe8f3e0c94e855df35ec1c7f715dac144d2cfdb6e70eef24431312ef7cbefcc832e9f99eb7f29bc9
sha512
d46ded68b92e78180d5925907679cd222372ca373281d6015adebab4097190ebbce83a84c669274445dcdbd744468d2b3eb8528ece241206f5c56fffdc21f74b
ssdeep
12288:8O/hghaFQT8fHhnfl2BmWx5AjGB69MAP:pSQ08fHGdx+2A
Community
Google
False cancel
HashLib
False cancel
YARA
Matches
domain, Borland, Borland_Delphi_30_, Delphi_DecodeDate, borland_delphi, Delphi_FormShow, BobSoftMiniDelphiBoBBobSoft, Microsoft_Visual_Cpp_v50v60_MFC, BobSoft_Mini_Delphi_BoB_BobSoft_additional, win_files_operation, IsPE32, win_hook, screenshot, Borland_Delphi_v40_v50, keylogger, contentis_base64, Borland_Delphi_40_additional, Borland_Delphi_40, Borland_Delphi_v60_v70, IsWindowsGUI, Delphi_Copy, Borland_Delphi_Setup_Module, Borland_Delphi_DLL, url, win_registry, Delphi_CompareCall, Delphi_StrToInt, Borland_Delphi_30_additional, Borland_Delphi_v30

Suspicious
True check_circle

Strings
List
http://www.vpublish.net/z.rar
t.Ht
Font.Style
Font.Name
%s.Seek not implemented$Operation not allowed on sorted list$%s not in a class registration group
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
\planilha.zlib
P.rsrc
SOFTWARE\Borland\Delphi\RTL
Delphi%.8X
Software\Borland\Locales
Software\Borland\Delphi\Locales
winspool.drv
winspool.drv
comctl32.dll
comctl32.dll
comctl32.dll
comctl32.dll
comctl32.dll
olepro32.dll
version.dll
vcltest3.dll
uxtheme.dll
wininet.dll
SHFolder.dll
\s9v8bt98trrqw.exe
OnIncludeItemH
Executive, 7 1/4- by 10 1/2-inches
11- by 17-inch sheet
ControlOfs%.8X%.8X
WndProcPtr%.8X%.8X
JumpID("","%s")
TIncludeItemEvent
Apartment
Sub-menu is not in menu
%s,Custom variant type (%s%.4x) is out of range/Custom variant type (%s%.4x) already used by %s*Custom variant type (%s%.4x) is not usable2Too many custom variant types have been registered5Could not convert variant of type (%s) into type (%s)=Overflow while converting variant of type (%s) into type (%s)
Division by zero
Rebuild
TaskbarCreated
bsSizeToolWin
Selected
ToolWin
Include
Too many open files
Assertion failed
%s (%s, line %d)
%s on %s
No help found for %s#No context-sensitive help installed$No topic-based help system installed
Privileged instruction(Exception %s in module %s at %p.
Error reading %s%s%s: %s
I/O error %d
List count out of bounds (%d)
Ancestor for '%s' not found
Cannot assign a %s to a %s
Class %s not found
OnHide`
Property %s does not exist
Resource %s not found
%s is not a valid BCD value$Could not parse SQL TimeStamp string
OnDestroy
ESafecallException
TInterfacedPersistent|
IPersistStreamp|
*ShellAPI
+Cannot focus a disabled or invisible window!Control '%s' has no parent window
IE(AL("%s",4),"AL(\"%0:s\",3)","JK(\"%1:s\",\"%0:s\")")
TSQLTimeStampData@
Tabloid, 11- by 17-inches
ssShift
Ledger, 17- by 11-inches
A4 Sheet, 210- by 297-millimeters
A4 small sheet, 210- by 297-millimeters
B5 sheet, 182- by 257-millimeter paper
A5 sheet, 148- by 210-millimeters
B4 sheet, 250- by 354-millimeters
A3 sheet, 297- by 420-millimeters
#9 Envelope, 3 7/8- by 8 7/8-inches
C65 Envelope, 114- by 229-millimeters
B5 Envelope, 176- by 250-millimeters
B4 Envelope, 250- by 353-millimeters
C5 Envelope, 162- by 229-millimeters
C3 Envelope, 324- by 458-millimeters
C6 Envelope, 114- by 162-millimeters
B6 Envelope, 176- by 125-millimeters
C4 Envelope, 229- by 324-millimeters
C Sheet, 17- by 22-inches
E Sheet, 34- by 44-inches
D Sheet, 22- by 34-inches
#14 Envelope, 5- by 11 1/2-inches
Monarch Envelope, 3 7/8- by 7 1/2-inches
6 3/4 Envelope, 3 5/8- by 6 1/2-inches
#12 Envelope, 4 3/4- by 11-inches
ssHotTrack
US Std Fanfold, 14 7/8- by 11-inches
Quarto, 215- by 275-millimeter paper
Invalid stream format$''%s'' is not a valid component name
DL Envelope, 110- by 220-millimeters
Invalid property element: %s
Italy Envelope, 110- by 230-millimeters
ssLeft

Foremost
Matches
0.exe, 511 KB
Suspicious
True check_circle
Heuristics
IPs
hasIPs: False cancel
Allowed
Suspicious
hasAllowed: False cancel
hasSuspicious: False cancel

URLs
Allowed
hasURLs: True check_circle
Suspicious: http://www.vpublish.net/z.rar
hasAllowed: False cancel
hasSuspicious: True check_circle

Files
Allowed: user32.dll, kernel32.dll, uxtheme.dll, oleaut32.dll, vcltest3.dll, comdlg32.dll, MAPI32.DLL, SHFolder.dll, gdi32.dll, version.dll, comctl32.dll, ole32.dll, imm32.dll, wininet.dll, advapi32.dll, olepro32.dll
hasFiles: True check_circle
Suspicious
hasAllowed: True check_circle
hasSuspicious: False cancel

Binary
Sizes
RVA
RVA: 16
Suspicious: False cancel
Code
Size: 72192
Suspicious: False cancel
Image
Address: 133300224
Suspicious: False cancel
Stack
Stack: 16384
Suspicious: False cancel
Headers
Headers: 1024
Suspicious: False cancel
Suspicious: False cancel

Symbols
Number
Number: 0
Suspicious: True check_circle
Pointer
Pointer: 0
Suspicious: True check_circle
Directories
Number: 16
Suspicious: False cancel

Checksum
Value: 0
Suspicous: True check_circle

Sections
Allowed: code, data, bss, .idata, .tls, .rdata, .reloc, .rsrc
Suspicious
hasAllowed: True check_circle
hasSections: True check_circle
hasSuspicious: False cancel

Versions
OS
Version: 4
Suspicious: False cancel
Image
Version: True check_circle
Suspicious: 4
Linker
Version: 2.25
Suspicious: False cancel
Subsystem
Version: 4.0
Suspicious: False cancel
Suspicious: False cancel

EntryPoint
Address: 453796
Suspicious: False cancel

Anomalies
Anomalies: The header checksum and the calculated checksum do not match.
hasAnomalies: True check_circle

Libraries
Allowed: user32.dll, kernel32.dll, uxtheme.dll, oleaut32.dll, comdlg32.dll, mapi32.dll, shfolder.dll, gdi32.dll, version.dll, comctl32.dll, ole32.dll, imm32.dll, wininet.dll, advapi32.dll, olepro32.dll
hasLibs: True check_circle
Suspicious: vcltest3.dll
hasAllowed: True check_circle
hasSuspicious: True check_circle

Timestamp
Past: True check_circle
Valid: True check_circle
Value: 1992-06-19 19:22:17
Future: False cancel

Compilation
Packed: True check_circle
Missing: False cancel
Packers: BobSoft Mini Delphi -> BoB / BobSoft
Compiled: True check_circle
Compilers: Borland Delphi 3.0 (???), Borland Delphi 4.0, Borland Delphi v3.0, Borland Delphi v6.0 - v7.0
MainPacker: BobSoft Mini Delphi -> BoB / BobSoft

Obfuscation
XOR: False cancel
Fuzzing: False cancel

PEDetector
Matches
None
Suspicious
False cancel
Disassembly
hasTricks
False cancel
Tricks
AVclass
banload
1
VirusTotal
md5
9f4f605251244bcb493a05a96f4ed3f3
sha1
8e03b13a2c494e406be81d8cf3ea54c7292ab4d1
SCANS (DETECTION RATE = 69.01%)
AVG
result: Win32:Banker-MNT [Trj]
update: 20190310
version: 18.4.3895.0
detected: True check_circle

CMC
update: 20190310
version: 1.1.0.977
detected: False cancel

MAX
result: malware (ai score=84)
update: 20190310
version: 2018.9.12.1
detected: True check_circle

Bkav
update: 20190308
version: 1.3.0.9899
detected: False cancel

K7GW
result: Trojan-Downloader ( 004cbd441 )
update: 20190310
version: 11.32.30234
detected: True check_circle

ALYac
result: Gen:Variant.Symmi.59289
update: 20190310
version: 1.1.1.5
detected: True check_circle

Avast
result: Win32:Banker-MNT [Trj]
update: 20190310
version: 18.4.3895.0
detected: True check_circle

Avira
result: TR/Dldr.Banload.523264.1
update: 20190310
version: 8.3.3.8
detected: True check_circle

Baidu
update: 20190306
version: 1.0.0.2
detected: False cancel

Cyren
result: W32/Banker.EP.gen!Eldorado
update: 20190310
version: 6.2.0.1
detected: True check_circle

DrWeb
result: Trojan.DownLoader17.48280
update: 20190310
version: 7.0.34.11020
detected: True check_circle

GData
result: Gen:Variant.Symmi.59289
update: 20190310
version: A:25.21044B:25.14573
detected: True check_circle

Panda
result: Trj/Genetic.gen
update: 20190310
version: 4.6.4.2
detected: True check_circle

VBA32
result: suspected of Trojan.Downloader.gen.h
update: 20190307
version: 4.0.0
detected: True check_circle

VIPRE
update: 20190310
version: 73644
detected: False cancel

Zoner
update: 20190310
version: 1.0
detected: False cancel

ClamAV
update: 20190310
version: 0.101.1.0
detected: False cancel

Comodo
result: Malware@#3up64qmls8u0h
update: 20190310
version: 30549
detected: True check_circle

F-Prot
result: W32/Banker.EP.gen!Eldorado
update: 20190310
version: 4.7.1.166
detected: True check_circle

Ikarus
result: Trojan-Downloader.Win32.Banload
update: 20190310
version: 0.1.5.2
detected: True check_circle

McAfee
result: RDN/Generic Downloader.x
update: 20190310
version: 6.0.6.653
detected: True check_circle

Rising
result: Backdoor.Androm!8.113/N3#86% (RDM+:cmRtazpt9rBcw//IvHB1qJcLMPke)
update: 20190310
version: 25.0.0.24
detected: True check_circle

Sophos
result: Troj/Banloa-CHW
update: 20190310
version: 4.98.0
detected: True check_circle

Yandex
result: Trojan.Agent!G5pNEwdwL5U
update: 20190310
version: 5.5.1.3
detected: True check_circle

Zillya
result: Downloader.Banload.Win32.71131
update: 20190307
version: 2.0.0.3768
detected: True check_circle

Acronis
result: suspicious
update: 20190222
version: 1.0.1.40
detected: True check_circle

Alibaba
update: 20190306
version: 0.2.0.3
detected: False cancel

Arcabit
result: Trojan.Symmi.DE799
update: 20190310
version: 1.0.0.837
detected: True check_circle

Babable
update: 20180918
version: 9107201
detected: False cancel

Cylance
result: Unsafe
update: 20190310
version: 2.3.1.101
detected: True check_circle

Endgame
result: malicious (high confidence)
update: 20190215
version: 3.0.3
detected: True check_circle

TACHYON
update: 20190310
version: 2019-03-10.02
detected: False cancel

Tencent
result: Win32.Trojan.Dldr.Hvtf
update: 20190310
version: 1.0.0.1
detected: True check_circle

ViRobot
update: 20190310
version: 2014.3.20.0
detected: False cancel

Webroot
result: W32.Trojan.Gen
update: 20190310
version: 1.0.0.403
detected: True check_circle

eGambit
update: 20190310
version: v4.3.6
detected: False cancel

Ad-Aware
result: Gen:Variant.Symmi.59289
update: 20190310
version: 3.0.5.370
detected: True check_circle

AegisLab
result: Trojan.Win32.Generic.4!c
update: 20190310
version: 4.2
detected: True check_circle

Emsisoft
result: Gen:Variant.Symmi.59289 (B)
update: 20190310
version: 2018.4.0.1029
detected: True check_circle

F-Secure
result: Trojan.TR/Dldr.Banload.523264.1
update: 20190310
version: 12.0.86.52
detected: True check_circle

Fortinet
result: W32/Banload.UKZ!tr.dldr
update: 20190310
version: 5.4.247.0
detected: True check_circle

Invincea
update: 20181128
version: 6.3.6.26157
detected: False cancel

Jiangmin
update: 20190310
version: 16.0.100
detected: False cancel

Kingsoft
update: 20190310
version: 2013.8.14.323
detected: False cancel

Paloalto
result: generic.ml
update: 20190310
version: 1.0
detected: True check_circle

Symantec
result: ML.Attribute.HighConfidence
update: 20190310
version: 1.8.0.0
detected: True check_circle

Trapmine
result: malicious.moderate.ml.score
update: 20190301
version: 3.1.48.748
detected: True check_circle

AhnLab-V3
result: Malware/Win32.Generic.C1262656
update: 20190310
version: 3.14.1.22785
detected: True check_circle

Antiy-AVL
result: Trojan/Win32.AGeneric
update: 20190310
version: 3.0.0.1
detected: True check_circle

Kaspersky
result: HEUR:Trojan.Win32.Generic
update: 20190310
version: 15.0.1.13
detected: True check_circle

Microsoft
result: TrojanDownloader:Win32/Banload.BCY
update: 20190307
version: 1.1.15700.9
detected: True check_circle

Qihoo-360
result: Win32/Trojan.6bf
update: 20190310
version: 1.0.0.1120
detected: True check_circle

TheHacker
result: Trojan/Downloader.Banload.weo
update: 20190308
version: 6.8.0.5.4056
detected: True check_circle

Trustlook
update: 20190310
version: 1.0
detected: False cancel

ZoneAlarm
result: HEUR:Trojan.Win32.Generic
update: 20190310
version: 1.0
detected: True check_circle

Cybereason
result: malicious.251244
update: 20190109
version: 1.2.27
detected: True check_circle

ESET-NOD32
result: a variant of Win32/TrojanDownloader.Banload.WTY
update: 20190310
version: 19004
detected: True check_circle

TrendMicro
update: 20190310
version: 10.0.0.1040
detected: False cancel

BitDefender
result: Gen:Variant.Symmi.59289
update: 20190310
version: 7.2
detected: True check_circle

CrowdStrike
result: win/malicious_confidence_60% (D)
update: 20190212
version: 1.0
detected: True check_circle

K7AntiVirus
result: Trojan-Downloader ( 004cbd441 )
update: 20190310
version: 11.32.30234
detected: True check_circle

SentinelOne
result: static engine - malicious
update: 20190203
version: 1.0.23.276
detected: True check_circle

Avast-Mobile
update: 20190310
version: 190310-00
detected: False cancel

Malwarebytes
update: 20190310
version: 2.1.1.1115
detected: False cancel

TotalDefense
update: 20190310
version: 37.1.62.1
detected: False cancel

CAT-QuickHeal
update: 20190310
version: 14.00
detected: False cancel

NANO-Antivirus
result: Trojan.Win32.Dwn.dyshlp
update: 20190310
version: 1.0.134.24576
detected: True check_circle

MicroWorld-eScan
result: Gen:Variant.Symmi.59289
update: 20190310
version: 14.0.297.0
detected: True check_circle

SUPERAntiSpyware
update: 20190307
version: 5.6.0.1032
detected: False cancel

McAfee-GW-Edition
result: BehavesLike.Win32.Worm.hh
update: 20190310
version: v2017.3010
detected: True check_circle

TrendMicro-HouseCall
update: 20190310
version: 10.0.0.1040
detected: False cancel

total
71
sha256
35ecd43c19fda210825f016ba204774f8fa71fe418e99af13f34302149663909
scan_id
35ecd43c19fda210825f016ba204774f8fa71fe418e99af13f34302149663909-1552253249
resource
9f4f605251244bcb493a05a96f4ed3f3
positives
49
scan_date
2019-03-10 21:27:29
verbose_msg
Scan finished, information embedded
response_code
1
File
Trace
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.606Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Secur32.dll
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Windows\SysWOW64\secur32.dll
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Windows\SysWOW64\secur32.dll
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
3/3/2020 - 19:46:1.606Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\api-ms-win-downlevel-advapi32-l2-1-0.dll
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
3/3/2020 - 19:46:1.606Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dllapi-ms-win-downlevel-advapi32-l2-1-0.dll
3/3/2020 - 19:46:1.606Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dll
3/3/2020 - 19:46:1.606Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-advapi32-l2-1-0.dllapi-ms-win-downlevel-advapi32-l2-1-0.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\winhttp.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\winhttp.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\webio.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\webio.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\IPHLPAPI.DLL
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\IPHLPAPI.DLL
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\IPHLPAPI.DLL
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\WINNSI.DLL
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\winnsi.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\winnsi.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\api-ms-win-downlevel-shlwapi-l2-1-0.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
3/3/2020 - 19:46:1.653Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dllapi-ms-win-downlevel-shlwapi-l2-1-0.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dll
3/3/2020 - 19:46:1.653Unknown1480C:\malware.exeC:\Windows\SysWOW64\api-ms-win-downlevel-shlwapi-l2-1-0.dllapi-ms-win-downlevel-shlwapi-l2-1-0.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\DNSAPI.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\dnsapi.dll
3/3/2020 - 19:46:1.653Open1480C:\malware.exeC:\Windows\SysWOW64\dnsapi.dll
3/3/2020 - 19:46:1.715Open1480C:\malware.exeC:\Windows\SysWOW64\mswsock.dll
3/3/2020 - 19:46:1.715Open1480C:\malware.exeC:\Windows\SysWOW64\mswsock.dll
3/3/2020 - 19:46:1.715Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
3/3/2020 - 19:46:1.715Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
3/3/2020 - 19:46:1.762Open1480C:\malware.exeC:\Windows\SysWOW64\rpcss.dll
3/3/2020 - 19:46:1.762Open1480C:\malware.exeC:\Windows\SysWOW64\rpcss.dll
3/3/2020 - 19:46:1.809Open1480C:\malware.exeC:\Windows\SysWOW64\netprofm.dll
3/3/2020 - 19:46:1.809Open1480C:\malware.exeC:\Windows\SysWOW64\netprofm.dll
3/3/2020 - 19:46:1.809Open1480C:\malware.exeC:\Windows\SysWOW64\nlaapi.dll
3/3/2020 - 19:46:1.809Open1480C:\malware.exeC:\Windows\SysWOW64\nlaapi.dll
3/3/2020 - 19:46:1.856Open1480C:\malware.exeC:\dhcpcsvc6.DLL
3/3/2020 - 19:46:1.856Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dll
3/3/2020 - 19:46:1.856Unknown1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dlldhcpcsvc6.dll
3/3/2020 - 19:46:1.856Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dll
3/3/2020 - 19:46:1.856Unknown1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc6.dlldhcpcsvc6.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Roaming\Microsoft\Windows\Cookies
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History\History.IE5
3/3/2020 - 19:46:1.903Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local\Microsoft\Windows\History\History.IE5
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\dhcpcsvc.DLL
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\dhcpcsvc.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\CRYPTSP.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\cryptsp.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\cryptsp.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.903Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.918Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.918Open1480C:\malware.exeC:\Windows\SysWOW64\rsaenh.dll
3/3/2020 - 19:46:1.918Open1480C:\malware.exeC:\RpcRtRemote.dll
3/3/2020 - 19:46:1.918Open1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dll
3/3/2020 - 19:46:1.918Unknown1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dllRpcRtRemote.dll
3/3/2020 - 19:46:1.918Open1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dll
3/3/2020 - 19:46:1.918Unknown1480C:\malware.exeC:\Windows\SysWOW64\RpcRtRemote.dllRpcRtRemote.dll
3/3/2020 - 19:46:1.965Open1480C:\malware.exeC:\rasadhlp.dll
3/3/2020 - 19:46:1.965Open1480C:\malware.exeC:\Windows\SysWOW64\rasadhlp.dll
3/3/2020 - 19:46:1.965Open1480C:\malware.exeC:\Windows\SysWOW64\rasadhlp.dll
3/3/2020 - 19:46:2.12Open1480C:\malware.exeC:\Windows\SysWOW64\npmproxy.dll
3/3/2020 - 19:46:2.12Open1480C:\malware.exeC:\Windows\SysWOW64\npmproxy.dll
3/3/2020 - 19:46:2.153Open1480C:\malware.exeC:\Windows\SysWOW64\FWPUCLNT.DLL
3/3/2020 - 19:46:2.153Open1480C:\malware.exeC:\Windows\SysWOW64\FWPUCLNT.DLL
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wininet.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\malware.exe.Local
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
3/3/2020 - 19:46:2.293Unknown1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\ws2_32.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\ws2_32.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\WSHTCPIP.DLL
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wship6.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:2.293Open1480C:\malware.exeC:\Windows\SysWOW64\wshqos.dll
3/3/2020 - 19:46:3.43Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\planilha.zlib
3/3/2020 - 19:46:3.43Write1480C:\malware.exeC:\Users\Behemot\AppData\Local\planilha.zlibplanilha.zlib
3/3/2020 - 19:46:3.43Write1480C:\malware.exeC:\Users\Behemot\AppData\Local\planilha.zlibplanilha.zlib
3/3/2020 - 19:46:3.137Open1480C:\malware.exeC:\Windows\SysWOW64\wininet.dll
3/3/2020 - 19:46:3.137Open1480C:\malware.exeC:\Windows\SysWOW64\wininet.dll
3/3/2020 - 19:46:9.43Open1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:9.43Unknown1480C:\malware.exeC:\Users\Behemot\AppData\Local
3/3/2020 - 19:46:9.43Open1480C:\malware.exeC:\Users\Behemot\AppData\Local\planilha.zlib
3/3/2020 - 19:46:9.43Read1480C:\malware.exeC:\Users\Behemot\AppData\Local\planilha.zlibplanilha.zlib
3/3/2020 - 19:46:9.43Read1480C:\malware.exeC:\Users\Behemot\AppData\Local\planilha.zlibplanilha.zlib
3/3/2020 - 19:46:9.184Open1480C:\malware.exeC:\Windows\SysWOW64\ole32.dll
3/3/2020 - 19:46:9.184Open1480C:\malware.exeC:\Windows\SysWOW64\ole32.dll

Process
Trace

Analysis
Reason
Timeout

Status
Sucessfully Executed

Results
1

Registry
Trace
3/3/2020 - 19:46:1.653Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnable
3/3/2020 - 19:46:1.653Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyServer
3/3/2020 - 19:46:1.653Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyOverride
3/3/2020 - 19:46:1.653Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsAutoConfigURL
3/3/2020 - 19:46:1.653Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet SettingsAutoDetect
3/3/2020 - 19:46:1.653Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectionsSavedLegacySettings
3/3/2020 - 19:46:1.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\ContentCachePrefix
3/3/2020 - 19:46:1.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\CookiesCachePrefix
3/3/2020 - 19:46:1.903Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\HistoryCachePrefix
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionReason
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionTime
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecision
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDetectedUrl
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapProxyBypass
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapIntranetName
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapUNCAsIntranet
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapAutoDetect
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapProxyBypass
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapIntranetName
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapUNCAsIntranet
3/3/2020 - 19:46:2.59Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapAutoDetect
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDecisionReason
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDecisionTime
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDecision
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadNetworkName
3/3/2020 - 19:46:3.387Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{D8C667F4-C62D-460A-82E2-EC8687C3DC60}WpadDetectedUrl
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionReason
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionTime
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecision
3/3/2020 - 19:46:3.387Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDetectedUrl
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionReason
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecisionTime
3/3/2020 - 19:46:3.387Write1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDecision
3/3/2020 - 19:46:3.387Delete1480C:\malware.exeHKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-54-00-83-08-f3WpadDetectedUrl

File Summary
Created
Identified: True check_circle

Deleted
Identified: False cancel

Process Summary
Created
Identified: False cancel

Deleted
Identified: False cancel

Registry Summary
Proxy
Identified: False cancel

AutoRun
Identified: False cancel

Created
Identified: True check_circle

Deleted
Identified: True check_circle

Browsers
Identified: False cancel

Internet
Identified: True check_circle

Loading...

DNS
Query
computer localhost arrow_forward computer gateway:50273 code www.vpublish.net.
computer localhost arrow_forward computer gateway:DNS code www.vpublish.net.

Response
computer gateway:DNS arrow_forward computer localhost code www.vpublish.net. reply_all 94.237.65.31


TCP
Info
94.237.65.31:80 arrow_forward computer localhost:65191
computer localhost:65191 arrow_forward 94.237.65.31:80

UDP
Info
computer localhost:67 arrow_forward computer localhost:68
computer localhost:50273 arrow_forward computer localhost:53
computer localhost:68 arrow_forward help_outline 255.255.255.255:67
computer localhost:53 arrow_forward computer localhost:50273

HTTP
Info
computer localhost send GET www.vpublish.net attach_file /z.rar

Summary
DNS
True check_circle

TCP
True check_circle

UDP
True check_circle

HTTP
True check_circle

Results
BINARY
KNN (K=3, NFS-BRMalware)
confidence: 100.00%
suspicious: True check_circle

Decision Tree (NFS-BRMalware)
confidence: 100.00%
suspicious: True check_circle

SVC (Kernel=Linear, NFS-BRMalware)
confidence: 71.03%
suspicious: False cancel

MalConv (Ember: Raw Bytes, Threshold=0.5)
confidence: 91.64%
suspicious: True check_circle

Random Forest (100 estimators, NFS-BRMalware)
confidence: 56.00%
suspicious: True check_circle

Non-Negative MalConv (Ember: Raw Bytes, Threshold=0.35)
confidence: 52.47%
suspicious: True check_circle

LightGDM (Ember: File Characteristics, Threshold=0.8336)
confidence: 98.36%
suspicious: True check_circle

Add to Collection
Download