32_64_ver_2_bit.exe

Classification: Malicious

32_64_ver_2_bit.exe is a trojan (Windows executable, 890.1 KB). Flagged by 15% of antivirus engines (42 detections). Linked to Certutil malware.

Detection summary

  • 42 antivirus detections (15% detection ratio)
  • 0 IDS alerts
  • 10 processes observed
  • 0 contacted hosts
  • 0 DNS requests

MITRE ATT&CK associations

Malware families: CERTUTIL (S0160)

Blacklist sightings

Description Source First seen Last seen Labels MITRE ATT&CK
Dropper.Certutil Hybrid-Analysis 2021-02-05 06:45:10 2021-02-05 06:45:10 S0160 certutil

Tags

apt

Sample information

Filenames
32_64_ver_2_bit.exe
File type
PE32 executable (GUI) Intel 80386, for MS Windows
Size
911432 bytes
MD5
33e2afde68efb767bccfc8cee98fdf5f
SHA-1
75b7d0e42bc38e541448042a90c6d1b6c562a718
SHA-256
c2d65103e0af5c4a51d5625fcc4d57359bd099755c11fa5a8eaf6a4265ce967d
First indexed
2021-02-05 06:45:10
Last updated
2026-09-15 08:30:34

Antivirus detections

EngineDetection
AVGWin32:Malware-gen
AhnLab-V3PUP/Win32.RL_Generic.R366062
AlibabaBackdoor:Win32/Convagent.1dfaa2fe
AvastWin32:Malware-gen
BkavW32.AIDetectMalware
CAT-QuickHealTrojan.Ghanarava.17381670868fdf5f
CTXexe.trojan.convagent
CrowdStrikewin/malicious_confidence_100% (W)
CylanceUnsafe
DeepInstinctMALICIOUS
ESET-NOD32a variant of Win32/Packed.CAB.V suspicious
Elasticmalicious (high confidence)
FortinetRiskware/Alien
GoogleDetected
IkarusMalware.Win32.AVEvader
K7AntiVirusTrojan ( 005776771 )
K7GWTrojan ( 005776771 )
KasperskyBackdoor.Win32.Convagent.d
LionicTrojan.Win32.Convagent.m!c
MalwarebytesNeshta.Virus.FileInfector.DDS
MaxSecureTrojan.Malware.110133250.susgen
McAfeeArtemis!33E2AFDE68EF
McAfeeDti!C2D65103E0AF
MicrosoftTrojan:Win32/Ymacco.AAC2
Paloaltogeneric.ml
PandaTrj/Agent.PM
RisingDropper.Certutil/SFX!1.D0D0 (CLASSIC)
SangforTrojan.Win32.Agent.A0jp
SkyhighArtemis!Trojan
SophosMal/Generic-S
SymantecML.Attribute.HighConfidence
TencentWin32.Backdoor.Convagent.Wylw
Trapminemalicious.high.ml.score
TrendMicroTROJ_FRS.0NA103C821
TrendMicro-HouseCallTROJ_FRS.0NA103C821
VIPREGen:Heur.PHS.1
VaristW32/ABTrojan.TWCQ-2188
WebrootW32.Trojan.Gen
XcitiumMalware@#2g2wxfw5nnjxv
ZillyaBackdoor.Convagent.Win32.130
alibabacloudBackdoor:Win/Convagent.d
huorongTrojan/BAT.Decertuil.a

Process list

NameCommand line
32_64_ver_2_bit.exe
cmd.execmd /c zlZQJiAKU
cmd.execmd /c certutil -decode Splendore.accde Busto.adts & cmd < Busto.adts
certutil.execertutil -decode Splendore.accde Busto.adts
cmd.exe
findstr.exefindstr /V /R "^VeihJdQncWAvzXHwrfqndRahdbOVmldozmfSmDpwPYxHmXxwJHcNBDzrJTXjCVZkFarUIPBAyYIabKNzeMkSODGPyjoFFXmTYoeiTAzTyVHCVqGYuEpPKibeLhOvHWUo$" Istinto.mpg
certutil.execertutil -decode Triste.jpeg M
Sembrano.comM
Sembrano.comM
PING.EXEping 127.0.0.1