Windows Analysis Report
R7jeBjPJEV.exe

Overview

General Information

Sample name: R7jeBjPJEV.exe
renamed because original name is a hash value
Original sample name: 17a41e4c907f8ab4242371ae3c5927fb.exe
Analysis ID: 1521401
MD5: 17a41e4c907f8ab4242371ae3c5927fb
SHA1: e30cde19ab9c599f9a78f0e9ff426bd0f23379d0
SHA256: 7da01290aff61ca3f118b9e6684e80c1e505e5f3005b47606056603fc5c10fd8
Tags: exeuser-abuse_ch
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

Score: 56
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
AI detected suspicious sample
Machine Learning detection for sample
PE file does not import any functions
PE file overlay found
Uses 32bit PE files

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: R7jeBjPJEV.exe ReversingLabs: Detection: 28%
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 87.8% probability
Machine Learning detection for sample
Source: R7jeBjPJEV.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: R7jeBjPJEV.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: R7jeBjPJEV.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
PE file does not import any functions
Source: R7jeBjPJEV.exe Static PE information: No import functions for PE file found
PE file overlay found
Source: R7jeBjPJEV.exe Static PE information: Data appended to the last section found
Uses 32bit PE files
Source: R7jeBjPJEV.exe Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: R7jeBjPJEV.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal56.winEXE@0/0@0/0
Source: R7jeBjPJEV.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: R7jeBjPJEV.exe ReversingLabs: Detection: 28%
Source: R7jeBjPJEV.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: R7jeBjPJEV.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: R7jeBjPJEV.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: R7jeBjPJEV.exe Static PE information: section name: .text entropy: 7.756784615966468
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1521401 Sample: R7jeBjPJEV.exe Startdate: 28/09/2024 Architecture: WINDOWS Score: 56 5 Multi AV Scanner detection for submitted file 2->5 7 Machine Learning detection for sample 2->7 9 AI detected suspicious sample 2->9
⊘No contacted IP infos