Windows Analysis Report
SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe

Overview

General Information

Sample name: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe
Analysis ID: 1501354
MD5: eabff7dae883de9e09b5d6aa09e17c45
SHA1: 46de72f4c3fcbefdb8f8d0a21ae56f3f60bf56b3
SHA256: d0205b46514ea3f19b4fea79f9e897c3cf84c8775e9917c04dd41cb39a3ae06c
Tags: exe
Errors
  • Corrupt sample or wrongly selected analyzer. Details: The %1 application cannot be run in Win32 mode.

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to call native functions
PE / OLE file has an invalid certificate
Program does not show much activity (idle)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Source: Binary string: C:\Users\gg\Downloads\payson-ioctl-cheat-driver-main\build\driver\driver.pdb source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://certs.apple.com/wwdrg3.der01
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://crl.apple.com/root.crl0
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://ocsp.apple.com/ocsp03-applerootca0.
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://ocsp.apple.com/ocsp03-wwdrg3010
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://ocsp.digicert.com0A
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: http://ocsp.digicert.com0X
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe String found in binary or memory: https://www.apple.com/certificateauthority/0
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Code function: 1_2_00007FF71C821388 ExFreePoolWithTag,ExAllocatePool,ZwQuerySystemInformation,ExFreePoolWithTag, 1_2_00007FF71C821388
PE / OLE file has an invalid certificate
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Static PE information: invalid certificate
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Binary string: \Device\onkzaoobrabo
Source: classification engine Classification label: mal48.winEXE@1/0@0/0
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe ReversingLabs: Detection: 44%
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Static PE information: Image base 0x140000000 > 0x60000000
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, GUARD_CF
Source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\gg\Downloads\payson-ioctl-cheat-driver-main\build\driver\driver.pdb source: SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1501354 Sample: SecuriteInfo.com.Win64.Malw... Startdate: 29/08/2024 Architecture: WINDOWS Score: 48 7 Multi AV Scanner detection for submitted file 2->7 5 SecuriteInfo.com.Win64.MalwareX-gen.7830.14981.exe 2->5         started        process3
⊘No contacted IP infos