popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

SFT.zip

ZIP Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 7, 2023, 9:49 a.m. Nov. 7, 2023, 9:52 a.m.
Size 77.2KB
Type Zip archive data, at least v1.0 to extract
MD5 882e1e40bd642dac255ec144e37e06d0
SHA256 4223c5f9670a7015c6f791a03448e206a3f3021ed8d0fac75bba9b9fabe23556
CRC32 34834CAD
ssdeep 1536:m5famFENSxT/nIf38fgNXlVSSESOBA3FEE7etV5hFwrsT2q7:wS6ENS5IfbXlQSJsA36EuYAKq7
Yara
  • zip_file_format - ZIP file format

Name Response Post-Analysis Lookup
www.ssl.com
A 3.213.199.135
A 3.209.197.161
3.209.197.161
IP Address Status Action
157.90.147.198 Active Moloch
164.124.101.2 Active Moloch
3.209.197.161 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49170 -> 157.90.147.198:80 2013028 ET POLICY curl User-Agent Outbound Attempted Information Leak
TCP 192.168.56.102:49170 -> 157.90.147.198:80 2034567 ET HUNTING curl User-Agent to Dotted Quad Potentially Bad Traffic

Suricata TLS

No Suricata TLS

suspicious_features Connection to IP address suspicious_request GET http://157.90.147.198/NkE/evoca
request GET http://www.ssl.com/repository/SSLcomRootCertificationAuthorityRSA.crt
request GET http://157.90.147.198/NkE/evoca
host 157.90.147.198