toolspub1.exe| Category | Machine | Started | Completed |
|---|---|---|---|
| FILE | s1_win7_x6401 | Oct. 3, 2023, 12:50 p.m. | Oct. 3, 2023, 1:04 p.m. |
-
toolspub1.exe "C:\Users\test22\AppData\Local\Temp\toolspub1.exe"
2228
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action |
|---|---|---|
| No hosts contacted. | ||
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
| pdb_path | C:\pexuvimogewoy\gid\nusonatazorewu\vun dotusuwobe\tiwogikuliw y.pdb |
| resource name | AFX_DIALOG_LAYOUT |
| resource name | NUNAFIHOMUFOBEGEXEHECOK |
| resource name | VELOHONEPOSICEFAB |
| resource name | None |
| section | {u'size_of_data': u'0x00025c00', u'virtual_address': u'0x00001000', u'entropy': 7.6278749936764525, u'name': u'.text', u'virtual_size': u'0x00025b4c'} | entropy | 7.62787499368 | description | A section with a high entropy has been found | |||||||||
| entropy | 0.665198237885 | description | Overall entropy of this PE file is high | |||||||||||
| description | (no description) | rule | DebuggerCheck__GlobalFlags | ||||||
| description | (no description) | rule | DebuggerCheck__QueryInfo | ||||||
| description | (no description) | rule | DebuggerHiding__Thread | ||||||
| description | (no description) | rule | DebuggerHiding__Active | ||||||
| description | (no description) | rule | ThreadControl__Context | ||||||
| description | (no description) | rule | SEH__vectored | ||||||
| description | Bypass DEP | rule | disable_dep | ||||||
| Bkav | W32.AIDetectMalware |
| Elastic | malicious (high confidence) |
| ClamAV | Win.Packer.pkr_ce1a-9980177-0 |
| FireEye | Generic.mg.607138573a8c8556 |
| CAT-QuickHeal | Ransom.Stop.P5 |
| Sangfor | Trojan.Win32.Save.a |
| K7AntiVirus | Trojan ( 005690671 ) |
| K7GW | Trojan ( 005690671 ) |
| CrowdStrike | win/malicious_confidence_100% (D) |
| Symantec | ML.Attribute.HighConfidence |
| tehtris | Generic.Malware |
| ESET-NOD32 | a variant of Win32/Kryptik.HUUU |
| APEX | Malicious |
| Cynet | Malicious (score: 100) |
| Kaspersky | HEUR:Trojan.Win32.Convagent.gen |
| Avast | TrojanX-gen [Trj] |
| Rising | Trojan.Generic@AI.100 (RDML:5eaZ/cUjBCyAKvEnOlWr5Q) |
| Sophos | ML/PE-A |
| McAfee-GW-Edition | BehavesLike.Win32.Lockbit.dh |
| Trapmine | malicious.moderate.ml.score |
| SentinelOne | Static AI - Malicious PE |
| Kingsoft | malware.kb.a.999 |
| Microsoft | Trojan:Script/Phonzy.B!ml |
| Gridinsoft | Ransom.Win32.STOP.bot!n |
| ZoneAlarm | HEUR:Trojan.Win32.Convagent.gen |
| Detected | |
| AhnLab-V3 | Trojan/Win.Generic.R609044 |
| Acronis | suspicious |
| Cylance | unsafe |
| Tencent | Trojan.Win32.Obfuscated.gen |
| Ikarus | Trojan.Win32.Crypt |
| MaxSecure | Trojan.Malware.300983.susgen |
| Fortinet | W32/Kryptik.HHTS!tr |
| AVG | TrojanX-gen [Trj] |
| Cybereason | malicious.b453f5 |
| DeepInstinct | MALICIOUS |