Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | June 24, 2021, 7:29 p.m. | June 24, 2021, 8:41 p.m. |
-
mam.exe "C:\Users\test22\AppData\Local\Temp\mam.exe"
2216
Name | Response | Post-Analysis Lookup |
---|---|---|
www.nationalcoinshortage.com | ||
www.mvdbr.com |
CNAME
mvdbr.com
|
60.241.27.76 |
www.thesmileresidents.com |
CNAME
thesmileresidents.com
|
206.17.147.207 |
www.jetfuels.info |
CNAME
jetfuels.info
|
34.102.136.180 |
Suricata Alerts
Suricata TLS
No Suricata TLS
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.mvdbr.com/ffmi/?J2JDYR=amofOv4yX1iotyGi+sQOv/16D2mHPYDgYXuSvLbk2GCDXsp8bztb1FMcheYsggIMDO8fbI6w&BXEDF=Z0GD1V0hqLv | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.thesmileresidents.com/ffmi/?J2JDYR=pvyoAQMrZq8IIYqdiVFauXKb9dFvuJjEqbdG+MFyx4nLeFJbOcZVzLyC2PgLrkQOmQcX4svy&BXEDF=Z0GD1V0hqLv | ||||||
suspicious_features | GET method with no useragent header | suspicious_request | GET http://www.jetfuels.info/ffmi/?J2JDYR=nAye7+VKj4umTRLWZtYhZdlE5jWuhy6CeliaDW7ZnB9bA+AC3hjx/7NKkFVqlVYemT9YIS3X&BXEDF=Z0GD1V0hqLv |
request | GET http://www.mvdbr.com/ffmi/?J2JDYR=amofOv4yX1iotyGi+sQOv/16D2mHPYDgYXuSvLbk2GCDXsp8bztb1FMcheYsggIMDO8fbI6w&BXEDF=Z0GD1V0hqLv |
request | GET http://www.thesmileresidents.com/ffmi/?J2JDYR=pvyoAQMrZq8IIYqdiVFauXKb9dFvuJjEqbdG+MFyx4nLeFJbOcZVzLyC2PgLrkQOmQcX4svy&BXEDF=Z0GD1V0hqLv |
request | GET http://www.jetfuels.info/ffmi/?J2JDYR=nAye7+VKj4umTRLWZtYhZdlE5jWuhy6CeliaDW7ZnB9bA+AC3hjx/7NKkFVqlVYemT9YIS3X&BXEDF=Z0GD1V0hqLv |
section | {u'size_of_data': u'0x0006ae00', u'virtual_address': u'0x0000f000', u'entropy': 7.671776097251509, u'name': u'.data', u'virtual_size': u'0x0006cdbc'} | entropy | 7.67177609725 | description | A section with a high entropy has been found | |||||||||
entropy | 0.852442671984 | description | Overall entropy of this PE file is high |
Bkav | W32.AIDetect.malware1 |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Trojan.GenericKD.37104356 |
FireEye | Generic.mg.17b10bd28b01f810 |
CAT-QuickHeal | Trojanspy.Noon |
ALYac | Trojan.GenericKD.37104356 |
Cylance | Unsafe |
Sangfor | Trojan.Win32.Save.a |
K7AntiVirus | Trojan ( 003c36381 ) |
Alibaba | TrojanSpy:Win32/Kryptik.95f2dfad |
K7GW | Trojan ( 003c36381 ) |
Cybereason | malicious.1e04be |
Arcabit | Trojan.Generic.D2362AE4 |
BitDefenderTheta | Gen:NN.ZexaF.34758.FuW@aax389ii |
Cyren | W32/Kryptik.EIF.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
ESET-NOD32 | a variant of Win32/Kryptik.HLJA |
APEX | Malicious |
Avast | Win32:Malware-gen |
Kaspersky | HEUR:Trojan-Spy.Win32.Noon.gen |
BitDefender | Trojan.GenericKD.37104356 |
Paloalto | generic.ml |
AegisLab | Trojan.Win32.Noon.l!c |
Ad-Aware | Trojan.GenericKD.37104356 |
Sophos | ML/PE-A |
VIPRE | Trojan.Win32.Generic!BT |
TrendMicro | TROJ_GEN.R002C0PFH21 |
McAfee-GW-Edition | BehavesLike.Win32.Emotet.hc |
Emsisoft | Trojan.GenericKD.37104356 (B) |
SentinelOne | Static AI - Malicious PE |
Jiangmin | TrojanSpy.Noon.rkf |
MaxSecure | Trojan.Malware.300983.susgen |
Avira | TR/Crypt.Agent.xbvuv |
Antiy-AVL | Trojan/Generic.ASMalwS.3387AE4 |
Microsoft | Trojan:Win32/Glupteba!ml |
GData | Trojan.GenericKD.37104356 |
Cynet | Malicious (score: 100) |
AhnLab-V3 | Malware/Win.Generic.C4528172 |
Acronis | suspicious |
McAfee | RDN/Generic.grp |
MAX | malware (ai score=89) |
VBA32 | TrojanSpy.Noon |
Malwarebytes | Malware.AI.1850730742 |
TrendMicro-HouseCall | TROJ_GEN.R002C0PFH21 |
Rising | Trojan.Kryptik!1.D6EE (CLASSIC) |
Yandex | Trojan.Kryptik!BQS2VC1mgIA |
Ikarus | Trojan.Inject |
eGambit | Unsafe.AI_Score_99% |
Fortinet | W32/PossibleThreat |
AVG | Win32:Malware-gen |