Report - hash.ps1

Generic Malware Antivirus
ScreenShot
Created 2023.10.31 09:31 Machine s1_win7_x6401
Filename hash.ps1
Type UTF-8 Unicode text, with very long lines, with CRLF line terminators
AI Score Not founds Behavior Score
1.4
ZERO API file : clean
VT API (file) 9 detected (PowerShell, Kryptik, Outbreak, Detected, Malware@#gjmwe060moew)
md5 e2de940fab2b14c512499006bbe5cd0a
sha256 9465750d2ddfcbfc68cd92da0bbad34a36a1eeac8c82a1c8ed086465b6c0cccf
ssdeep 48:zZ+onhYxPxRrlb3XAw0JThCipAg6n0vfv1UnNzkrTPJ3:zZ+Ec5RNCF
imphash
impfuzzy
  Network IP location

Signature (5cnts)

Level Description
notice Allocates read-write-execute memory (usually to unpack itself)
notice File has been identified by 9 AntiVirus engines on VirusTotal as malicious
info Checks amount of memory in system
info Command line console output was observed
info Uses Windows APIs to generate a cryptographic key

Rules (2cnts)

Level Name Description Collection
warning Generic_Malware_Zero Generic Malware binaries (download)
watch Antivirus Contains references to security software binaries (download)

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure