Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6402 | June 25, 2021, 10 a.m. | June 25, 2021, 10:56 a.m. |
-
9.83B.exe "C:\Users\test22\AppData\Local\Temp\9.83B.exe"
6240
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
172.217.25.14 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
packer | UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser |
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001ab4c | size | 0x00000162 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001ab4c | size | 0x00000162 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001ab4c | size | 0x00000162 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001ab4c | size | 0x00000162 | ||||||||||||||||||
name | RT_DIALOG | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001ab4c | size | 0x00000162 | ||||||||||||||||||
name | RT_STRING | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001b014 | size | 0x000000fe | ||||||||||||||||||
name | RT_STRING | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001b014 | size | 0x000000fe | ||||||||||||||||||
name | RT_STRING | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001b014 | size | 0x000000fe | ||||||||||||||||||
name | RT_STRING | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001b014 | size | 0x000000fe | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_CHINESE | filetype | data | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001f658 | size | 0x0000003e | ||||||||||||||||||
name | RT_MANIFEST | language | LANG_CHINESE | filetype | XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators | sublanguage | SUBLANG_CHINESE_SIMPLIFIED | offset | 0x0001f69c | size | 0x00000213 |
section | {u'size_of_data': u'0x00009800', u'virtual_address': u'0x00014000', u'entropy': 7.8843146453123385, u'name': u'UPX1', u'virtual_size': u'0x0000a000'} | entropy | 7.88431464531 | description | A section with a high entropy has been found | |||||||||
entropy | 0.844444444444 | description | Overall entropy of this PE file is high |
section | UPX0 | description | Section name indicates UPX | ||||||
section | UPX1 | description | Section name indicates UPX |
host | 172.217.25.14 |
MicroWorld-eScan | Gen:Variant.Johnnie.262101 |
McAfee | Artemis!358B9C802B3F |
K7AntiVirus | Riskware ( 0040eff71 ) |
K7GW | Riskware ( 0040eff71 ) |
Cybereason | malicious.02b3f1 |
APEX | Malicious |
Paloalto | generic.ml |
BitDefender | Gen:Variant.Johnnie.262101 |
McAfee-GW-Edition | BehavesLike.Win32.BadFile.vc |
FireEye | Gen:Variant.Johnnie.262101 |
Emsisoft | Gen:Variant.Johnnie.262101 (B) |
Ikarus | HackTool.Win32.VB |
GData | Gen:Variant.Bulz.488902 |
Jiangmin | Trojan.Pasta.dsg |
MAX | malware (ai score=86) |
Gridinsoft | Risk.Win32.RemoteAdmin.vb!s2 |
Microsoft | Trojan:Win32/Zpevdo.B |
VBA32 | suspected of Malware.VB.39 |
ALYac | Gen:Variant.Bulz.488902 |
Malwarebytes | Malware.AI.4264022839 |
SentinelOne | Static AI - Suspicious SFX |
Fortinet | W32/PossibleThreat |
AVG | Win32:Malware-gen |
Avast | Win32:Malware-gen |