popup

Submissions

No Date Request Urls Hosts IDS Rule Score Zero VT Player Etc
12931 2021-09-29 10:59 Document-753GF01.msi  

2d6ba1a2c184dccac37e3c8b10083989


Gen2 Malicious Packer Malicious Library OS Processor Check MSOffice File VirusTotal Malware suspicious privilege Check memory Checks debugger unpack itself AntiVM_Disk VM Disk Size Check ComputerName 		2.6 22 ZeroCERT

12932 2021-09-29 11:03 PURCHASE ORDER EXPORTO52022 IM...  

b5697d67ea7945e6944061d076eeecc3


Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		2 1 13.6 ZeroCERT

12933 2021-09-29 11:03 PROFORMA INVOICE EXPORTO52022 ...  

65691a95adce3b875c496e077d5f7aa5


Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		4 1 15.4 ZeroCERT

12934 2021-09-29 11:08 PURCHASE ORDER EXPORTO52022 IM...  

b5697d67ea7945e6944061d076eeecc3


Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		2 1 15.2 ZeroCERT

12935 2021-09-29 11:09 PURCHASE ORDER, PRICE AND AVAI...  

5599a3b68f359dc757f72b493d1a3fdd


RAT PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities Checks Bios Detects VirtualBox suspicious process WriteConsoleW VMware anti-virtualization human activity check Windows ComputerName DNS Cryptographic key DDNS Software 		4 1 17.6 ZeroCERT

12936 2021-09-29 11:15 Quotation pdf.exe  

1ffd399d86c04f2ca7eb2d9b8f95388f


RAT PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		4 1 14.8 ZeroCERT

12937 2021-09-29 11:15 Revised & Final Document for S...  

54b442adb39e17c3fb224136bdc3e1b3


RAT PWS .NET framework Generic Malware DNS AntiDebug AntiVM PE File .NET EXE PE32 Malware download Nanocore VirusTotal Malware c&c Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 2 13.0 8 ZeroCERT

12938 2021-09-29 11:20 SWIFT PAYMENT-KAZAZI FARM SHPK...  

d641710cc3d6ddb2d3e70a68c0f53c61


RAT PWS .NET framework Generic Malware DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS DDNS 		3 2 15.6 31 ZeroCERT

12939 2021-09-29 11:22 Shipping Documents-BL#SE201000...  

8993ca9025df7cdfee64edc454377def


UPX PE File PE32 VirusTotal Malware Buffer PE suspicious privilege MachineGuid Check memory Checks debugger buffers extracted RWX flags setting unpack itself Windows utilities suspicious process WriteConsoleW anti-virtualization Tofsee Windows ComputerName DNS DDNS 		2 6 2 8.0 42 ZeroCERT

12940 2021-09-29 11:30 TT SWIFT.exe  

46855d8af16f8ae6251cc0e2a65dcfdd


RAT PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware powershell Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities powershell.exe wrote suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		2 1 15.0 25 ZeroCERT

12941 2021-09-29 11:30 TT USD 32000.exe  

43f300620443cf156513fcfef7218561


PWS .NET framework Generic Malware Antivirus DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates shortcut unpack itself Windows utilities suspicious process WriteConsoleW human activity check Windows ComputerName DNS Cryptographic key DDNS 		2 1 15.4 22 ZeroCERT

12942 2021-09-29 11:35 VSB_093876535367-0398765345637...  

c4d393054bc0954eedc9f72d5edc1b0e


PWS .NET framework Generic Malware Admin Tool (Sysinternals etc ...) DNS AntiDebug AntiVM PE File .NET EXE PE32 VirusTotal Malware Buffer PE AutoRuns suspicious privilege MachineGuid Code Injection Check memory Checks debugger buffers extracted Creates executable files unpack itself Windows utilities suspicious process AppData folder WriteConsoleW human activity check Windows ComputerName DNS DDNS 		2 1 16.8 23 ZeroCERT

12943 2021-09-29 11:35 daiparl.exe  

d0efa396aec4477851bb35136c716732


Gen1 Generic Malware Malicious Library Malicious Packer UPX Admin Tool (Sysinternals etc ...) PE File OS Processor Check PE32 DLL PE64 VirusTotal Malware suspicious privilege Checks debugger Creates executable files unpack itself suspicious process AppData folder WriteConsoleW Turn off Windows Error Recovery notification window Tofsee ComputerName crashed 		2 2 4.4 M 29 ZeroCERT

12944 2021-09-29 16:19 CompensationClaim-1630636598-0...  

f3e5e9eb94f7bc0115c4b373093d085d


VBA_macro Generic Malware MSOffice File VirusTotal Malware ICMP traffic RWX flags setting unpack itself suspicious process DNS 		3 3 5.8 5 ZeroCERT

12945 2021-09-29 16:27 etooltipred.png  

7dc229cc5bf7e78b899a888728a11198


Emotet Gen1 UPX Malicious Library PE File OS Processor Check PE32 Dridex TrickBot Malware suspicious privilege Malicious Traffic buffers extracted unpack itself Check virtual network interfaces suspicious process Kovter ComputerName DNS crashed 		1 5 2 6.4 ZeroCERT

keyword