Windows Analysis Report
SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe

Overview

General Information

Sample name: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe
Analysis ID: 1417537
MD5: aea72794061e7055003524c90109b369
SHA1: 2e21dd9cee8985d0d82cfc2a527d6ce6f830d971
SHA256: 3bac7343a0a848b51baf15fd2c7e9140a8d8f297a50e33fd204929be52617d3b
Tags: exe
Infos:

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
PE file contains sections with non-standard names
Program does not show much activity (idle)
Sample execution stops while process was sleeping (likely an evasion)
Tries to load missing DLLs
Uses 32bit PE files

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe ReversingLabs: Detection: 13%
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Virustotal: Detection: 9% Perma Link
Uses 32bit PE files
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: Binary string: C:\Users\sZeD\source\repos\bsd\Debug\walczy.pdb,, source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe
Source: Binary string: C:\Users\sZeD\source\repos\bsd\Debug\walczy.pdb source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe
Tries to load missing DLLs
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Section loaded: msvcp140d.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Section loaded: vcruntime140d.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Section loaded: ucrtbased.dll Jump to behavior
Uses 32bit PE files
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal48.winEXE@2/0@0/0
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3500:120:WilError_03
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe ReversingLabs: Detection: 13%
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Virustotal: Detection: 9%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe "C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: C:\Users\sZeD\source\repos\bsd\Debug\walczy.pdb,, source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe
Source: Binary string: C:\Users\sZeD\source\repos\bsd\Debug\walczy.pdb source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe
PE file contains sections with non-standard names
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: section name: .textbss
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: section name: .msvcjmc
Source: SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Static PE information: section name: .00cfg
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B6D1D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00B6D1D0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B617CB GetProcessHeap, 0_2_00B617CB
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B6D1D0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00B6D1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B61271 SetUnhandledExceptionFilter, 0_2_00B61271
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B6D480 SetUnhandledExceptionFilter, 0_2_00B6D480
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B6DEA0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 0_2_00B6DEA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe Code function: 0_2_00B61393 GetSystemTimeAsFileTime, 0_2_00B61393
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1417537 Sample: SecuriteInfo.com.BScope.Tro... Startdate: 29/03/2024 Architecture: WINDOWS Score: 48 10 Multi AV Scanner detection for submitted file 2->10 6 SecuriteInfo.com.BScope.Trojan.Swrort.25034.19636.exe 1 2->6         started        process3 process4 8 conhost.exe 6->8         started       
⊘No contacted IP infos