Malware

Valkyrie Final Verdict

File Name: 1064817724.exe

File Type: PE32 executable (GUI) Intel 80386, for MS Windows

SHA1: 5d6572665560b7352b3eb45d26e837cc1ab1691c

MD5: 8d01c393b5663644f7c787ca03662cd7

First Seen Date: 2017-04-24 10:18:20 ( 8 year(s) 2 month(s) 16 day(s) ago )

Number of Clients Seen: 17

Last Analysis Date: 2017-05-02 08:55:33 ( 8 year(s) 2 month(s) 8 day(s) ago )

Human Expert Analysis Date: 2017-06-08 08:18:20 ( 8 year(s) 1 month(s) 1 day(s) ago )

Human Expert Analysis Result: Malware

Verdict Source: Valkyrie Human Expert Analysis Overall Verdict

Analysis Summary

Analysis Type	Date	Verdict
Signature Based Detection	2017-05-02 08:55:33	Malware
Static Analysis Overall Verdict	2017-05-02 08:55:33	No Threat Found
Precise Detectors Overall Verdict	2017-05-02 08:55:33	No Match
Human Expert Analysis Overall Verdict	2017-06-08 08:18:20	Malware
File Certificate Validation	2017-05-02 08:55:33	Not Applicable

Static Analysis

Static Analysis Overall Verdict	Result
No Threat Found

Detector	Result
Optional Header LoaderFlags field is valued illegal	Clean
Non-ascii or empty section names detected	Clean
Illegal size of optional Header	Clean
Packer detection on signature database	Unknown
Based on the sections entropy check! file is possibly packed	Suspicious
Timestamp value suspicious	Clean
Header Checksum is zero!	Clean
Enrty point is outside the 1st(.code) section! Binary is possibly packed	Clean
Optional Header NumberOfRvaAndSizes field is valued illegal	Clean
Anti-vm present	Clean
The Size Of Raw data is valued illegal! Binary might crash your disassembler/debugger	Clean
TLS callback functions array detected	Clean

Dynamic Analysis

No Dynamic Analysis Result Received

Behavioral Information is not Available

Precise Detectors Analysis Results

Detector Name	Date	Verdict		Reason
Uninstaller FP Detector	2017-05-02 08:55:33	No Match		No match.
Yara Rule Static Malware Detector	2017-05-02 08:55:33	No Match		No match.
Static Precise PUA Detector 1	2017-05-02 08:55:33	No Match		NotDetected
Static Precise Virus Detector	2017-05-02 08:55:33	No Match		NotDetected
Static Precise Trojan Detector	2017-05-02 08:55:33	No Match		NotDetected
Malicious Url Detector	2017-05-02 08:55:43	No Match		No match.

Advance Heuristics

No Advanced Heuristic Analysis Result Received

Human Expert Analysis Results

Analysis Start Date: 2017-04-24 11:53:18 ( 8 year(s) 2 month(s) 16 day(s) ago )

Analysis End Date: 2017-06-08 08:18:20 ( 8 year(s) 1 month(s) 1 day(s) ago )

File Upload Date: 2017-05-27 08:05:59 ( 8 year(s) 1 month(s) 13 day(s) ago )

Update Date: 2017-06-08 08:18:20 ( 8 year(s) 1 month(s) 1 day(s) ago )

Human Expert Analyst Feedback: Malware

Verdict: Malware

Malware Family: Trojware.Win32.Agent

Malware Type: Trojan Generic

Additional File Information

Vendor Validation - Vendor Validation is not Applicable

Certificate Validation - Certificate Validation is not Applicable

PE Headers

Property	Value
compilation time stamp	0x58FD6E9C [Mon Apr 24 03:18:52 2017 UTC]
entry point	0x801262 (.text)
file size	218112
machine type	Intel 386 or later - 32Bit
mime type	application/x-dosexec
number of sections	4
sha256	190d5c8de27115b98484d653dff246fc05ce02ac69fedd009e469d7535f3faeb

PE Sections

Name	Virtual Address	Virtual Size	Raw Size	Entropy	MD5
.text	0x1000	0x6dfc	0x6e00	6.501365	-
.rdata	0x8000	0x24e0	0x2600	4.787947	-
.data	0xb000	0x3cac	0xe00	2.251052	-
.rsrc	0xf000	0x2ad24	0x2ae00	7.618512[SUSPICIOUS]	-

Loading...