popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
12766 2021-09-24 12:00 0923_193403215579.doc  

b1c839e4851a11464066e93937199d11


VBA_macro Generic Malware MSOffice File GIF Format VirusTotal Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Check virtual network interfaces IP Check ComputerName 		2 4 1 8.8 M 14 ZeroCERT

12767 2021-09-24 12:02 0923_1108167054640.doc  

d997cf0c333f156e501aef7d5f2409ae


hancitor VBA_macro Generic Malware MSOffice File GIF Format VirusTotal Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Check virtual network interfaces IP Check ComputerName 		2 4 1 1 8.0 M 15 ZeroCERT

12768 2021-09-24 12:05 0923_690278402563.doc  

e8e1dde40267664d096d602fcf1fb785


hancitor VBA_macro Generic Malware MSOffice File GIF Format VirusTotal Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files ICMP traffic RWX flags setting unpack itself Check virtual network interfaces IP Check ComputerName 		2 4 1 1 8.8 M 16 guest

12769 2021-09-24 12:07 0923_4173005610193.doc  

37ff685c5b4f85962cdf1867a24c1ecc


hancitor VBA_macro Generic Malware MSOffice File GIF Format Malware Malicious Traffic Checks debugger buffers extracted Creates shortcut Creates executable files RWX flags setting unpack itself Check virtual network interfaces IP Check ComputerName 		2 4 1 1 7.4 M guest

12770 2021-09-24 12:10 specification-1210302809.xls  

030db7c607937a266f322e1a075f63d8


MSOffice File VirusTotal Malware RWX flags setting unpack itself suspicious process Tofsee 		3 6 4 4.0 9 guest

12771 2021-09-24 12:12 specification-1216995372.xls  

1792fb151473098d01ac9989ac7c0040


MSOffice File VirusTotal Malware ICMP traffic RWX flags setting unpack itself suspicious process Tofsee 		3 6 4 4.8 9 guest

12772 2021-09-24 16:45 specification-1696062090.xls  

b18faf6bc59505ac36fb11d6ce6131d2


MSOffice File VirusTotal Malware RWX flags setting unpack itself suspicious process Tofsee 		3 6 4 4.2 12 guest

12773 2021-09-24 17:06 eresizebar.png  

544c2478d26f9c59a9d371efe305ebf9


Malicious Library PE File PE32 Dridex TrickBot Malware Report suspicious privilege Malicious Traffic buffers extracted unpack itself Check virtual network interfaces suspicious process Kovter ComputerName DNS crashed 		1 5 3 6.6 M ZeroCERT

12774 2021-09-24 17:07 escrow.exe  

4568267da235d998580cfd9d8b828715


UPX Admin Tool (Sysinternals etc ...) Malicious Library DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Internet API FTP ScreenShot Http API Steal credential Downloader P2P AntiDebug AntiVM PE File PE32 Emotet VirusTotal Malware Buffer PE AutoRuns Code Injection buffers extracted Creates executable files RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW Tofsee Windows ComputerName crashed 		3 6 1 10.6 M 33 ZeroCERT

12775 2021-09-24 17:08 esmallruby.png  

33e5dbee2d872b34c54665cf0404520e


Malicious Library PE File PE32 Dridex TrickBot Malware Report suspicious privilege MachineGuid Malicious Traffic buffers extracted ICMP traffic unpack itself Check virtual network interfaces suspicious process Kovter ComputerName DNS crashed 		1 3 3 6.2 M ZeroCERT

12776 2021-09-24 17:08 nscvhost.exe  

341e63d0f0934ba186bd27a5e43ede35


Generic Malware Malicious Library PE File OS Processor Check PE32 VirusTotal Malware PDB unpack itself Remote Code Execution 		2.0 M 20 ZeroCERT

12777 2021-09-24 17:10 eflyairplane.png  

b164522e8070207393f280857dcc06f4


Malicious Library PE File PE32 suspicious privilege buffers extracted ICMP traffic unpack itself Check virtual network interfaces suspicious process ComputerName DNS crashed 		4 6.8 M ZeroCERT

12778 2021-09-24 17:11 i8u7hjdc.exe  

61d5e32562d1c70daf0a3112f7888258


NPKI Generic Malware Malicious Packer UPX Anti_VM Malicious Library Antivirus PE64 PE File VirusTotal Malware powershell suspicious privilege MachineGuid Check memory Checks debugger Creates shortcut Creates executable files unpack itself Windows utilities powershell.exe wrote suspicious process Windows ComputerName Cryptographic key 		8.4 M 37 ZeroCERT

12779 2021-09-24 17:14 lv.exe  

e154389e7b2797d043b65d94a6ff9889


NPKI Gen1 Emotet Gen2 Themida Packer Generic Malware Malicious Library Anti_VM UPX Malicious Packer DGA DNS Socket Create Service Sniff Audio Escalate priviledges KeyLogger Code injection HTTP Hijack Network Internet API FTP ScreenShot Http API Steal cred VirusTotal Malware AutoRuns Code Injection Check memory Checks debugger Creates executable files unpack itself Windows utilities AppData folder malicious URLs AntiVM_Disk WriteConsoleW VM Disk Size Check Windows crashed 		1 7.0 M 25 ZeroCERT

12780 2021-09-24 17:14 6789568764240821.exe  

b105bec27851dabe21e1cf1c56bfda0e


PWS .NET framework email stealer BitCoin Generic Malware Admin Tool (Sysinternals etc ...) ScreenShot Steal credential DNS SMTP KeyLogger Code injection AntiDebug AntiVM PE File .NET EXE PE32 Browser Info Stealer VirusTotal Email Client Info Stealer Malware Cryptocurrency wallets Cryptocurrency suspicious privilege Code Injection Malicious Traffic Check memory Checks debugger buffers extracted unpack itself Check virtual network interfaces malicious URLs AntiVM_Disk IP Check VM Disk Size Check Windows Browser Email ComputerName Cryptographic key 		1 4 1 14.0 M 37 ZeroCERT

keyword