ScreenShot
Created 2021.05.23 17:31 Machine s1_win7_x6402
Filename ALL.txt
Type ASCII text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
2.0
ZERO API file : clean
VT API (file) 1 detected ()
md5 a140c5bb18fc4adb4a2f5d2a907de048
sha256 1a745b44a0ca52b87ddd0d767b830474a8d95d1447ded8b27dc37a8a7a8fe20b
ssdeep 48:MAkN+lk6BKfU/X5tAo3XwPC+7ULtZVvlkphGBXpLV9WfbwKW7T/Rz0lT76la/W01:1Qc/JtD3OCbaGgzRWvR4lTP1
imphash
impfuzzy
  Network IP location

Signature (5cnts)

Level Description
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time)
notice File has been identified by one AntiVirus engine on VirusTotal as malicious
info Checks amount of memory in system

Rules (0cnts)

Level Name Description Collection

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure