Report - HBankers_Latest.hta

ScreenShot
Created 2021.04.30 09:32 Machine s1_win7_x3201
Filename HBankers_Latest.hta
Type HTML document, UTF-8 Unicode text, with CRLF line terminators
AI Score Not founds Behavior Score
0.6
ZERO API file : clean
VT API (file) 4 detected (PowerShell)
md5 4324831d87b2b6e82e60406c4d07b42c
sha256 24cb21df00e66ed1909db354442c6902a1b2caab782f26c1982a0f6d2828e31a
ssdeep 48:np1TTkUp7ZcUvkjCQR3UzvnDBL2aRHEAfAZ40QW:vUUp7Z9Wx3o/p2SEAf0
imphash
impfuzzy
  Network IP location

Signature (2cnts)

Level Description
notice File has been identified by 4 AntiVirus engines on VirusTotal as malicious
info One or more processes crashed

Rules (0cnts)

Level Name Description Collection

Network (3cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://192.168.56.103:2869/upnphost/udhisapi.dll?content=uuid:d96d86f3-ac35-41f2-9523-f4e50073f2f3 Unknown 192.168.56.103 clean
http://192.168.56.103:5357/da8ea474-550f-433d-b444-54d2081d1d24/ Unknown 192.168.56.103 clean
http://192.168.56.103:2869/upnphost/udhisapi.dll?content=uuid:2d284ad3-5648-4376-8360-b0559e35418f Unknown 192.168.56.103 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure