Windows Analysis Report
D7M4c24p9T.exe

Overview

General Information

Sample name: D7M4c24p9T.exe
renamed because original name is a hash value
Original sample name: d674507093d1535d87c99fb58b3d590d.exe
Analysis ID: 1579672
MD5: d674507093d1535d87c99fb58b3d590d
SHA1: 8085a0a1afff596e718de99ec58416d86c824057
SHA256: f3695d39b7062d21abdfed9217801e61dcb143d33a356b273dcae40edc85dc1c
Tags: exeuser-abuse_ch
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
PE file contains an invalid checksum
PE file does not import any functions
PE file overlay found
Uses 32bit PE files

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: D7M4c24p9T.exe Virustotal: Detection: 9% Perma Link
Uses 32bit PE files
Source: D7M4c24p9T.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
PE file does not import any functions
Source: D7M4c24p9T.exe Static PE information: No import functions for PE file found
PE file overlay found
Source: D7M4c24p9T.exe Static PE information: Data appended to the last section found
Uses 32bit PE files
Source: D7M4c24p9T.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
Source: classification engine Classification label: mal48.winEXE@0/0@0/0
Source: D7M4c24p9T.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: D7M4c24p9T.exe Virustotal: Detection: 9%
Source: D7M4c24p9T.exe Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x3a8600
Source: D7M4c24p9T.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
PE file contains an invalid checksum
Source: D7M4c24p9T.exe Static PE information: real checksum: 0x23bfb should be: 0x20a40
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1579672 Sample: D7M4c24p9T.exe Startdate: 23/12/2024 Architecture: WINDOWS Score: 48 5 Multi AV Scanner detection for submitted file 2->5
⊘No contacted IP infos

Contacted Domains

Name IP Active
s-part-0035.t-0009.t-msedge.net 13.107.246.63 true