file5.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | May 18, 2021, 8:56 a.m. | May 18, 2021, 9:04 a.m. |
-
file5.exe "C:\Users\test22\AppData\Local\Temp\file5.exe"
1016
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| api.faceit.com | 104.17.63.50 |
Suricata Alerts
| Flow | SID | Signature | Category |
|---|---|---|---|
| TCP 192.168.56.101:49199 -> 104.17.63.50:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
| TCP 192.168.56.101:49200 -> 104.17.63.50:443 | 906200056 | SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee) | undefined |
Suricata TLS
No Suricata TLS
| section | |
| section | .themida |
| section | .loadcon |
| section | Wb5BZ4Uq |
| section | {u'size_of_data': u'0x00045400', u'virtual_address': u'0x00001000', u'entropy': 7.999328424701181, u'name': u' ', u'virtual_size': u'0x0007d5b2'} | entropy | 7.9993284247 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00008200', u'virtual_address': u'0x0007f000', u'entropy': 7.98339332309402, u'name': u' ', u'virtual_size': u'0x00014dc0'} | entropy | 7.98339332309 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00000c00', u'virtual_address': u'0x00094000', u'entropy': 7.7460485237182155, u'name': u' ', u'virtual_size': u'0x00005824'} | entropy | 7.74604852372 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00000a00', u'virtual_address': u'0x0009a000', u'entropy': 7.444093416811098, u'name': u' ', u'virtual_size': u'0x00000a80'} | entropy | 7.44409341681 | description | A section with a high entropy has been found | |||||||||
| section | {u'size_of_data': u'0x00000a00', u'virtual_address': u'0x00359000', u'entropy': 7.300811618281613, u'name': u'Wb5BZ4Uq', u'virtual_size': u'0x000008d0'} | entropy | 7.30081161828 | description | A section with a high entropy has been found | |||||||||
| registry | HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion |
| registry | HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion |
| registry | HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__ |
| Bkav | W32.AIDetect.malware1 |
| Elastic | malicious (high confidence) |
| McAfee | Artemis!723A3FC8D6FA |
| Cylance | Unsafe |
| Sangfor | Trojan.Win32.Save.a |
| Cybereason | malicious.815051 |
| Symantec | ML.Attribute.HighConfidence |
| APEX | Malicious |
| Avast | FileRepMalware |
| Kaspersky | UDS:Trojan.Win32.Chapak |
| NANO-Antivirus | Virus.Win32.Gen.ccmw |
| F-Secure | Trojan.TR/Crypt.ZPACK.Gen |
| McAfee-GW-Edition | BehavesLike.Win32.Generic.wh |
| FireEye | Generic.mg.723a3fc8d6faeefe |
| Sophos | ML/PE-A |
| SentinelOne | Static AI - Malicious PE |
| eGambit | Unsafe.AI_Score_91% |
| Gridinsoft | Trojan.Heur!.030100A1 |
| Microsoft | Trojan:Win32/Sabsik.FL.A!ml |
| Cynet | Malicious (score: 100) |
| BitDefenderTheta | Gen:NN.ZexaF.34690.cJW@auBBBgp |
| VBA32 | BScope.Trojan.Occamy |
| Rising | Malware.Heuristic!ET#97% (RDMK:cmRtazq1lx8dc2jDmNufOjZow9DK) |
| AVG | FileRepMalware |
| CrowdStrike | win/malicious_confidence_60% (D) |