MALICIOUS — PVEZTDX.exe
MALICIOUS — PVEZTDX.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Razy family. 6 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
8fc4d218793c4eee9f38a8e4606166d7345bb1eb8f3d9187b8db9a4a51596d47 - SHA-1:
904bed13e9adbc22ca43180f48b554e2d0483524 - MD5:
c73b76760404ddc732040356075e57ff - imphash:
8c235e3a9d7f61224225c532f7c9583a - ssdeep:
3072:di81oGuAk+KUvhyYDwtT81ANfSxj7+3Oaxv9jMc9S9AFk4NLthEjQT6j:o81sAkZjT8SFmH+3hV9P96QEj1 - TLSH:
T11F429D898DBB681BCDB2D6556C13D41FA211F026907DAD8D82A3127DCDE702FB4E508E - Submitted as: PVEZTDX.exe
- File type: pe · Size: 212992 bytes
- Verdict: malicious (93/100) · Family: Razy
Detections (6 of 55 engines)
- capa (capabilities): capability:collection/keylog
- ClamAV (daily): Win.Malware.Razy-9759519-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
- Emsisoft (Emergency Kit): Trojan.Agent.DCBC
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 93/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule
Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dynamic analysis
No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.
File paths
- f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
- C:\windows\%s
- C:\windows\system32\%s
- C:\windows\system\%s
- c:\stop-adw.txt
More Razy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report