popup

Report - eh.txt

NPKI Antivirus
  1. Resubmit analysis
  2. Detailed report
ScreenShot
Created 2021.07.03 09:13 Machine s1_win7_x6402
Filename eh.txt
Type ASCII text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
2.8
ZERO API file : mailcious
VT API (file)
md5 8bc1da669ee262bf1e25dee032525abd
sha256 4ae2f55348b9e7935c0296ce0ec7d96ebc23c70a9bac334362cc724d571b14c6
ssdeep 96:8OJoskmMmU+u1ViXyzQX1f0gUe3X87J3aLQ4UtX4QLoBf/ETQjOfjjepUc/:/Jos3Mmxuj0yzCWIn8oZUx7DMAjCpUc/
imphash
impfuzzy
  Network IP location

Signature (5cnts)

Level Description
danger Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually)
watch Communicates with host for which no DNS query was performed
notice HTTP traffic contains suspicious features which may be indicative of malware related traffic
notice Performs some HTTP requests
notice Sends data using the HTTP POST Method

Rules (3cnts)

Level Name Description Collection
danger NPKI_Zero File included NPKI binaries (download)
watch Antivirus Contains references to security software binaries (download)
watch Antivirus Contains references to security software binaries (upload)

Network (16cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
http://ripzi.getenjoyment.net/le/post.php
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 clean
http://ripzi.getenjoyment.net/le/eh.down
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 clean
http://ripzi.getenjoyment.net/le/del.php?filename=eh
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 clean
aus.thunderbird.net
whois
US AMAZON-02 99.86.202.75 clean
ripzi.getenjoyment.net
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 mailcious
d2js2viceajwla.cloudfront.net
whois
US AMAZON-02 99.86.202.125 clean
aus5.mozilla.org
whois
US GOOGLE 35.244.181.201 clean
prod.balrog.prod.cloudops.mozgcp.net
whois
US GOOGLE 35.244.181.201 clean
99.86.144.61
whois
US AMAZON-02 99.86.144.61 clean
99.86.202.125
whois
US AMAZON-02 99.86.202.125 clean
99.86.144.100
whois
US AMAZON-02 99.86.144.100 clean
99.86.202.23
whois
US AMAZON-02 99.86.202.23 clean
185.176.43.98
whois
BG Zetta Hosting Solutions LLC. 185.176.43.98 mailcious
35.244.181.201
whois
US GOOGLE 35.244.181.201 clean
99.86.144.82
whois
US AMAZON-02 99.86.144.82 clean
99.86.144.46
whois
US AMAZON-02 99.86.144.46 clean

Suricata ids


Similarity measure (PE file only) - Checking for service failure