Category | Machine | Started | Completed |
---|---|---|---|
FILE | s1_win7_x6403_us | July 8, 2024, 4:47 p.m. | July 8, 2024, 4:49 p.m. |
-
-
whoami.exe whoami
2132
-
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action |
---|---|---|
39.97.52.57 | Active | Moloch |
Suricata Alerts
No Suricata Alerts
Suricata TLS
No Suricata TLS
section | {u'size_of_data': u'0x005a9e00', u'virtual_address': u'0x00a7a000', u'entropy': 7.892104262441033, u'name': u'UPX1', u'virtual_size': u'0x005aa000'} | entropy | 7.89210426244 | description | A section with a high entropy has been found | |||||||||
entropy | 0.999913793103 | description | Overall entropy of this PE file is high |
section | UPX0 | description | Section name indicates UPX | ||||||
section | UPX1 | description | Section name indicates UPX | ||||||
section | UPX2 | description | Section name indicates UPX |
cmdline | whoami |
host | 39.97.52.57 |
Bkav | W64.AIDetectMalware |
Elastic | malicious (moderate confidence) |
Cynet | Malicious (score: 100) |
Skyhigh | BehavesLike.Win64.Generic.tc |
Cylance | Unsafe |
Sangfor | Trojan.Win32.Save.a |
ESET-NOD32 | a variant of WinGo/Kryptik.FF |
APEX | Malicious |
Kaspersky | VHO:Trojan.Win32.Eb.gen |
McAfeeD | ti!F0D300F5BDEE |
Sophos | CXrep/MalGo-B |
Ikarus | Trojan.WinGo.Injector |
Detected | |
Antiy-AVL | GrayWare/Win32.Kryptik.ffp |
Microsoft | Trojan:Win32/Wacatac.B!ml |
ZoneAlarm | VHO:Trojan.Win32.Eb.gen |
Varist | W64/Agent.FXW.gen!Eldorado |
DeepInstinct | MALICIOUS |
Malwarebytes | Malware.AI.3978387212 |
MaxSecure | Trojan.Malware.300983.susgen |