Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Overview

General Information

Sample name:	SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Analysis ID:	1521704
MD5:	8eb4565c6c7096c17ac94718b2a3724b
SHA1:	1bcec351f712f041e4b23545e9a14c421effcfd3
SHA256:	c700dc3bb675fb60dd69d26ed9628616c97b64af7faaeff92f6c65e7f4f2b8fe
Tags:	exe
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

AI detected suspicious sample

AV process strings found (often used to terminate AV products)

Checks if the current process is being debugged

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Found large amount of non-executed APIs

One or more processes crash

Sample file is different than original file name gathered from version info

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.9% probability

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D5790E0 FindFirstFileExW,

0_2_00007FF76D5790E0

Source: Amcache.hve.4.dr

String found in binary or memory: http://upx.sf.net

Detected potential crypto function

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D571290	0_2_00007FF76D571290
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D57F688	0_2_00007FF76D57F688
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D572130	0_2_00007FF76D572130
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D577894	0_2_00007FF76D577894
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D5790E0	0_2_00007FF76D5790E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D581010	0_2_00007FF76D581010

One or more processes crash

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 816 -s 344

Sample file is different than original file name gathered from version info

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe, 00000000.00000000.1256164830.00007FF76D594000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnyDeskCrashHandler.exe0 vs SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe, 00000000.00000002.1415625778.00007FF76D594000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAnyDeskCrashHandler.exe0 vs SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Binary or memory string: OriginalFilenameAnyDeskCrashHandler.exe0 vs SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Source: classification engine

Classification label: mal52.winEXE@2/5@0/0

Source: C:\Windows\System32\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess816

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\409e9443-5c1f-4b57-91a9-95832f5ff294

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

ReversingLabs: Detection: 28%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe "C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 816 -s 344

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Section loaded: apphelp.dll

Jump to behavior

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Static PE information: Image base 0x140000000 > 0x60000000

Source: SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D57CD54 pushfq ; retf 0000h		0_2_00007FF76D57CD55
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D58784D push rcx; retf 003Fh		0_2_00007FF76D58784E

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found large amount of non-executed APIs

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

API coverage: 2.5 %

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D5790E0 FindFirstFileExW,

0_2_00007FF76D5790E0

Source: Amcache.hve.4.dr	Binary or memory string: VMware
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.4.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.4.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.4.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.4.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.4.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.4.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.4.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.4.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.4.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.4.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.4.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.4.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.4.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.4.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.4.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.4.dr	Binary or memory string: VMware-42 27 88 19 56 cc 59 1a-97 79 fb 8c bf a1 e2 9d
Source: Amcache.hve.4.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Process queried: DebugPort			Jump to behavior

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D576964 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00007FF76D576964

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D57B9E0 GetProcessHeap,

0_2_00007FF76D57B9E0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D573194 SetUnhandledExceptionFilter,	0_2_00007FF76D573194
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D576964 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF76D576964
Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe	Code function: 0_2_00007FF76D572FB4 IsProcessorFeaturePresent,RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00007FF76D572FB4

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D57F4D0 cpuid

0_2_00007FF76D57F4D0

Source: C:\Users\user\Desktop\SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Code function: 0_2_00007FF76D572E74 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00007FF76D572E74

AV process strings found (often used to terminate AV products)

Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.4.dr	Binary or memory string: MsMpEng.exe

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	1521704
Product:	CloudBasic
Start time:	02:25:07
Start date:	29.09.2024
Sample:	SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	8eb4565c6c7096c17ac94718b2a3724b
SHA1:	1bcec351f712f041e4b23545e9a14c421effcfd3
SHA256:	c700dc3bb675fb60dd69d26ed9628616c97b64af7faaeff92f6c65e7f4f2b8fe
Filetype:	Win64 Executable GUI (202006/5) 81.26%

Name	Type	MD5	SHA1	SHA256
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_dc444aea7037bbc0cbafead427273f931b99d060_e02d979f_dca1e886-1d26-4919-a40e-4d7a4551cc84\Report.wer	Unicode text, UTF-16, little-endian text, with CRLF line terminators	EB260304C408225848BEB3A9C32B3C00	90B962F73580CDB877D5CF5B930A69A55ED7A239	179EF10ABA7055AF8C8125D91EB8B1F1328ABEFCDD802616632A1E3373C2EE93
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6D9A.tmp.dmp	Mini DuMP crash report, 14 streams, Sun Sep 29 00:26:04 2024, 0x1205a4 type	1862A05967E9B4B06749BFB2FFB64F96	02A035FFDFDDF178F622DF3920EF30B7222A7A19	A00F31DBC073ABB0962F9E8BE857236DE33A6392F9B2CC604F517F111DB6FCE8
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E27.tmp.WERInternalMetadata.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	F919EA89E221A3054331DE6F4B8B274F	5AC14F09F4408A1A0F8E288C255A4DAF11C202F1	C7ADF12225051C22416D74E7D4320657F35225D6D040494BBE860F3AED59BCE7
C:\ProgramData\Microsoft\Windows\WER\Temp\WER6E48.tmp.xml	XML 1.0 document, ASCII text, with CRLF line terminators	02D97637A84D426AF07B3705BB0E560D	10818A1EAE73B9B3C1CED90B2D988C575BDFC3E2	3066A7A00D3AC982EA7CAD40D586093BCC3C275AA1DF6BDB3DAB523D8A920A8A
C:\Windows\appcompat\Programs\Amcache.hve	MS Windows registry file, NT/2000 or above	B5F05DB2574BB9EE775B516C4431B7AE	DFC466CFA7B00954E7672B552A5DBBE50321E989	D67A04BFA81F7D394389AB935451549F767910BDDD0C6675D0B005923C234BA8

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
SecuriteInfo.com.W32.PossibleThreat.13484.6474.exe