Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Aug. 24, 2023, 9:22 a.m. | Aug. 24, 2023, 9:27 a.m. |
-
datacas.exe "C:\Users\test22\AppData\Local\Temp\datacas.exe"
2548
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
47.111.23.242 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_ICON | language | LANG_PORTUGUESE | filetype | dBase III DBT, version number 0, next free block index 40 | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cec58 | size | 0x00000988 | ||||||||||||||||||
name | RT_STRING | language | LANG_PORTUGUESE | filetype | data | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cf8a0 | size | 0x00000372 | ||||||||||||||||||
name | RT_STRING | language | LANG_PORTUGUESE | filetype | data | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cf8a0 | size | 0x00000372 | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_PORTUGUESE | filetype | data | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cc650 | size | 0x0000005a | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_PORTUGUESE | filetype | data | sublanguage | SUBLANG_PORTUGUESE | offset | 0x022cc650 | size | 0x0000005a |
section | {u'size_of_data': u'0x003fc000', u'virtual_address': u'0x00027000', u'entropy': 7.997959405853937, u'name': u'.data', u'virtual_size': u'0x022a17c0'} | entropy | 7.99795940585 | description | A section with a high entropy has been found | |||||||||
entropy | 0.958534006813 | description | Overall entropy of this PE file is high |
host | 47.111.23.242 |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win32.Windigo.4!c |
Elastic | malicious (high confidence) |
MicroWorld-eScan | Trojan.GenericKD.68881667 |
FireEye | Generic.mg.772cc6d2ad8f559a |
Malwarebytes | Trojan.MalPack.GS |
Sangfor | Trojan.Win32.Save.a |
K7AntiVirus | Trojan ( 005a60081 ) |
Alibaba | TrojanSpy:Win32/Stealer.2a3e5ec3 |
K7GW | Trojan ( 005a60081 ) |
Cybereason | malicious.972406 |
Cyren | W32/Kryptik.KLR.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
tehtris | Generic.Malware |
ESET-NOD32 | a variant of Win32/Kryptik.HUKU |
TrendMicro-HouseCall | Trojan.Win32.AMADEY.YXDHWZ |
Avast | Win32:BotX-gen [Trj] |
Cynet | Malicious (score: 99) |
Kaspersky | HEUR:Trojan-Spy.Win32.Stealer.gen |
BitDefender | Trojan.GenericKD.68881667 |
Sophos | Mal/Generic-S |
F-Secure | Trojan.TR/AD.CloudGenRKIT.llbmh |
DrWeb | Trojan.PWS.Siggen3.32917 |
TrendMicro | Trojan.Win32.AMADEY.YXDHWZ |
McAfee-GW-Edition | Artemis!Trojan |
Trapmine | malicious.high.ml.score |
Emsisoft | Trojan.GenericKD.68881667 (B) |
Avira | TR/AD.CloudGenRKIT.llbmh |
MAX | malware (ai score=85) |
Gridinsoft | Trojan.Win32.Glupteba.bot |
Microsoft | Trojan:Win32/Redline.ASAC!MTB |
ViRobot | Trojan.Win.Z.Agent.4362624.C |
ZoneAlarm | HEUR:Trojan-Spy.Win32.Stealer.gen |
GData | Trojan.GenericKD.68881667 |
Detected | |
AhnLab-V3 | Trojan/Win.Generic.R584809 |
Acronis | suspicious |
VBA32 | BScope.TrojanPSW.RedLine |
Cylance | unsafe |
Panda | Trj/Genetic.gen |
APEX | Malicious |
Rising | Trojan.Generic@AI.100 (RDML:SklPF1ex9HqBQx/S8P4X8w) |
SentinelOne | Static AI - Malicious PE |
MaxSecure | Trojan.Malware.300983.susgen |
Fortinet | W32/GenKryptik.GNCH!tr |
AVG | Win32:BotX-gen [Trj] |
DeepInstinct | MALICIOUS |
CrowdStrike | win/malicious_confidence_100% (W) |