an.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | July 27, 2023, 10:28 a.m. | July 27, 2023, 10:39 a.m. |
-
-
ohcompetitive.exe C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ohcompetitive.exe
2596
-
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| files.catbox.moe | 108.181.20.35 |
Suricata Alerts
Suricata TLS
No Suricata TLS
| pdb_path | wextract.pdb |
| resource name | AVI |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ohcompettitive.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ohcompetitive.exe |
| file | C:\Users\test22\AppData\Local\Temp\IXP000.TMP\ohcompetitive.exe |
| section | {u'size_of_data': u'0x0001d800', u'virtual_address': u'0x0000f000', u'entropy': 7.073645927297428, u'name': u'.rsrc', u'virtual_size': u'0x0001e000'} | entropy | 7.0736459273 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.732919254658 | description | Overall entropy of this PE file is high | |||||||||||
| description | ohcompetitive.exe tried to sleep 5456486 seconds, actually delayed analysis time by 5456486 seconds | |||
| reg_key | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 | reg_value | rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\test22\AppData\Local\Temp\IXP000.TMP\" | ||||||
| Elastic | malicious (moderate confidence) |
| Cylance | unsafe |
| Cyren | W32/MSIL_Agent.FQK.gen!Eldorado |
| Cynet | Malicious (score: 100) |
| APEX | Malicious |
| Kaspersky | VHO:Trojan-Downloader.MSIL.Seraph.gen |
| SentinelOne | Static AI - Suspicious SFX |
| ZoneAlarm | VHO:Trojan-Downloader.MSIL.Seraph.gen |
| Detected | |
| MaxSecure | Trojan.Malware.300983.susgen |
| DeepInstinct | MALICIOUS |