Windows Analysis Report
PC-SOFT_Set-Up.exe

Overview

General Information

Sample Name: PC-SOFT_Set-Up.exe
Analysis ID: 831158
MD5: f448d2bbece9ffca6d35b72ad699c545
SHA1: acab3e78eb72b8cde7f686a7adce243e819fa5ed
SHA256: bf83c57f5b1ae62b3a671d93d263d9704c4e5dc82a4b381b216afd7b1d4764aa
Tags: exeexpert-topcommalwarepass-1212stealer
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: C000007B

Detection

Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Machine Learning detection for sample
PE file contains section with special chars
PE file overlay found
Uses 32bit PE files
Entry point lies outside standard sections
PE file contains sections with non-standard names

Classification

AV Detection
barindex
Machine Learning detection for sample
Source: PC-SOFT_Set-Up.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: PC-SOFT_Set-Up.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

System Summary
barindex
PE file contains section with special chars
Source: PC-SOFT_Set-Up.exe Static PE information: section name: .Y :
Source: PC-SOFT_Set-Up.exe Static PE information: section name: .(Y,
PE file overlay found
Source: PC-SOFT_Set-Up.exe Static PE information: Data appended to the last section found
Uses 32bit PE files
Source: PC-SOFT_Set-Up.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal48.winEXE@0/0@0/0
Source: PC-SOFT_Set-Up.exe Static file information: File size 10371193 > 1048576
Source: PC-SOFT_Set-Up.exe Static PE information: Raw size of .tve is bigger than: 0x100000 < 0x997400
Source: PC-SOFT_Set-Up.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Entry point lies outside standard sections
Source: initial sample Static PE information: section where entry point is pointing to: .tve
PE file contains sections with non-standard names
Source: PC-SOFT_Set-Up.exe Static PE information: section name: .Y :
Source: PC-SOFT_Set-Up.exe Static PE information: section name: .(Y,
Source: PC-SOFT_Set-Up.exe Static PE information: section name: .tve

No Screenshots

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 831158 Sample: PC-SOFT_Set-Up.exe Startdate: 21/03/2023 Architecture: WINDOWS Score: 48 5 Machine Learning detection for sample 2->5 7 PE file contains section with special chars 2->7
⊘No contacted IP infos