Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6401 | Sept. 4, 2023, 6:13 p.m. | Sept. 4, 2023, 6:16 p.m. |
-
4500167469.exe "C:\Users\test22\AppData\Local\Temp\4500167469.exe"
2564
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
No hosts contacted. |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
name | RT_ICON | language | LANG_SAAMI | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd128 | size | 0x00000468 | ||||||||||||||||||
name | RT_ICON | language | LANG_SAAMI | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd128 | size | 0x00000468 | ||||||||||||||||||
name | RT_ICON | language | LANG_SAAMI | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd128 | size | 0x00000468 | ||||||||||||||||||
name | RT_ICON | language | LANG_SAAMI | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd128 | size | 0x00000468 | ||||||||||||||||||
name | RT_ICON | language | LANG_SAAMI | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd128 | size | 0x00000468 | ||||||||||||||||||
name | RT_ICON | language | LANG_SAAMI | filetype | GLS_BINARY_LSB_FIRST | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd128 | size | 0x00000468 | ||||||||||||||||||
name | RT_STRING | language | LANG_SAAMI | filetype | data | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd838 | size | 0x000001d4 | ||||||||||||||||||
name | RT_GROUP_ICON | language | LANG_SAAMI | filetype | data | sublanguage | SUBLANG_ARABIC_TUNISIA | offset | 0x00fcd590 | size | 0x0000005a |
section | {u'size_of_data': u'0x0004ae00', u'virtual_address': u'0x0001c000', u'entropy': 7.8577394504482525, u'name': u'.data', u'virtual_size': u'0x00fade08'} | entropy | 7.85773945045 | description | A section with a high entropy has been found | |||||||||
entropy | 0.711401425178 | description | Overall entropy of this PE file is high |
Bkav | W32.AIDetectMalware |
Lionic | Trojan.Win32.Remcos.4!c |
Elastic | malicious (high confidence) |
FireEye | Generic.mg.fbbaf2b90ebad84e |
CAT-QuickHeal | Ransom.Stop.P5 |
Malwarebytes | Generic.Malware/Suspicious |
Sangfor | Trojan.Win32.Save.a |
K7AntiVirus | Trojan ( 005a60081 ) |
K7GW | Trojan ( 005a60081 ) |
Cybereason | malicious.ed8a64 |
Cyren | W32/Kryptik.KMY.gen!Eldorado |
Symantec | ML.Attribute.HighConfidence |
Kaspersky | UDS:Backdoor.Win32.Remcos.gen |
Avast | DropperX-gen [Drp] |
Sophos | Troj/Krypt-VK |
McAfee-GW-Edition | BehavesLike.Win32.Lockbit.gc |
Trapmine | malicious.high.ml.score |
SentinelOne | Static AI - Malicious PE |
Webroot | W32.Dropper.Gen |
Detected | |
Gridinsoft | Ransom.Win32.STOP.bot!n |
Microsoft | Trojan:Win32/Leonem |
ZoneAlarm | UDS:Backdoor.Win32.Remcos.gen |
Cynet | Malicious (score: 100) |
VBA32 | BScope.TrojanDownloader.Smoke |
Cylance | unsafe |
APEX | Malicious |
Rising | Trojan.Generic@AI.100 (RDML:1Lzf7QVv4hdv+pa3r6bVCw) |
Ikarus | Trojan.Win32.Glupteba |
MaxSecure | Trojan.Malware.300983.susgen |
AVG | DropperX-gen [Drp] |
DeepInstinct | MALICIOUS |
CrowdStrike | win/malicious_confidence_100% (D) |