Report - tbCgXlQIMjI1kIcB.jpg.ps1

Antivirus
ScreenShot
Created 2021.06.22 11:14 Machine s1_win7_x6402
Filename tbCgXlQIMjI1kIcB.jpg.ps1
Type ASCII text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
2.0
ZERO API file : clean
VT API (file) 1 detected (PowerShell, MulDrop)
md5 55dae81112baf10e1cdbfad99c922ce8
sha256 746e59a3a5bb415311f0c95845d7132db0878a6e2a43f4f63a65f0eefabc39f3
ssdeep 6144:flGLP3jZRhKGES5AY6mTohHAvPZsgqdC4cEGDA2z+yeMmBDHHzrfCeKc8A7u:4O8r
imphash
impfuzzy
  Network IP location

Signature (6cnts)

Level Description
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
notice File has been identified by one AntiVirus engine on VirusTotal as malicious
info Checks amount of memory in system
info Command line console output was observed
info Uses Windows APIs to generate a cryptographic key

Rules (1cnts)

Level Name Description Collection
watch Antivirus Contains references to security software binaries (download)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure