Sending request to SiriusLLM Model 0...

Model 0 confidence (70% Not Safe) is below the 90% confidence threshold.
Sending request to Model 1...

Model 1 confidence (70% Not Safe) is below the 90% confidence threshold.
Sending request to Model 2...

Model 2 confidence (90% Not Safe).
Selected optimal result: Not Safe with 90% confidence from Model 2 (priority-based tie-break).

Database updated with result from Model 2.

Total tokens: 0 (0 request / 0 response)

File path: I:\AiDefender.exe
File hash: c6ae7fdcc3b2f282c775a13f7972de54158ae7754d4951846555668552fc7f06
File size: 4,08 MB
File publisher: This file is a signable file type but has not been digitally signed.

Final Verdict: Not Safe with 90% confidence.

## Analysis Summary  
The 4.3 MB native PE advertises itself as “Defender Hardening Console (AiDefend.exe)”, yet it is completely unsigned, demands Administrator rights at launch, and carries a very recent timestamp (30 Mar 2026).  
Its import set bundles high-impact NT API functions for cross-process code injection (VirtualAllocEx/WriteProcessMemory/CreateRemoteThread, NtCreateThreadEx, QueueUserAPC) together with Windows Filtering Platform, WinHTTP, crypto, and service-control routines.  
The string table contains hard-coded options that programmatically switch off every major Windows Defender/AMSI layer (real-time, behaviour, cloud, script-scanning, removable-drive scan, MAPS reporting, etc.) and change quarantine/remediation settings.  
No exports are present – normal for a utility, but the combination of full Defender kill-switches + privilege-level injection APIs is paradigmatic of Defender-bypass tooling used by ransomware or “EVA” (EVade-AV) loaders rather than a legitimate hardening utility.  
Entropy values (5–6.3) are consistent with large code sections, but there is no high-entropy overlay or packing anomaly.  
The file therefore exhibits strong behavioural indicators of malicious intent rather than security hardening.

## Detailed Analysis  

**Signer & Trust indicators**  
- CertificateTableSize = 0 → completely unsigned, removing trusted-author validation even though the filename mimics a Microsoft component.  

**Privilege & OS hardening flags**  
- RequestedExecutionLevel = requireAdministrator – grants the process SYSTEM-equivalent rights, maximising impact of any embedded payload.  
- ASLR/DEP enabled – compiler defaults, do not offset malicious capability.  

**Imports of interest (528 total)**  
- Injection/cavity-set: VirtualAllocEx, VirtualProtectEx, WriteProcessMemory, ReadProcessMemory, CreateRemoteThread, NtCreateThreadEx, RtlCreateUserThread, QueueUserAPC – full arsenal for remote thread hijack or reflective injection.  
- Service-manager + SCM: OpenSCManagerW, OpenServiceW, ControlService, DeleteService – permits stopping/removing security services.  
- Registry manipulation: RegCreateKeyExW, RegSetValueExW, RegDeleteTreeW – typical for persistence or policy sabotage.  
- Firewall re-configuration: entire Fwpm* suite (FwpmEngineOpen0/FwpmFilterAdd0 etc.) – can install low-level filtering rules to block AV cloud telemetry.  
- Crypto: CryptProtectData, CryptUnprotectData, BCrypt* – could harvest or encrypt local secrets; also imports used by AV kill-tools to tamper with Defender signatures.  
- WinHTTP stack for C2 or payload pull-down.  
All of the above are legitimate in isolation, but their simultaneous presence in one unsigned binary is highly suspicious and characteristic of AV-disabling droppers seen before ransomware deployment.  

**Strings assessment (top relevant)**  
- DisableRealtimeMonitoring  
- DisableBehaviorMonitoring  
- DisableIOAVProtection  
- DisableScriptScanning  
- DisableRemovableDriveScanning  
- CloudBlockLevel / MAPSReporting / SubmitSamplesConsent = NeverSend  
- ControlledFolderAccess=0, QuarantineDefaultAction turned to Remove or Quarantine disabled – shows intent to neuter every native ransom-protection mechanism.  
- VirtualAllocEx/CreateRemoteThread/NtCreateThreadEx embedded in the same module – not just policy settings but actual code-injection primitives.  
No legitimate enterprise “hardening” tool would embed hard-coded toggles to completely disable Microsoft’s security stack; professional utilities integrate via official Defender APIs and are digitally signed.  

## Likely Type / Purpose  
The binary is best characterised as a Defender-disabling loader or AV-killer (often termed “EVA” or “AMSI bypass tool”) designed to turn off every real-time protection component before installing secondary malware (frequently ransomware or info-stealers).

Malware type: AV-Killer / Defender-Disabler Loader  
Malware name: DefenderKiller.AiDefend  

Final verdict: Malicious with 90% confidence.