ScreenShot
| Created | 2025.01.14 15:12 | Machine | s1_win7_x6403 |
| Filename | pi-240924.ps1 | ||
| Type | ASCII text | ||
| AI Score | Not founds | Behavior Score |
|
| ZERO API | file : compromised | ||
| VT API (file) | 2 detected (PowerShell, SC207005) | ||
| md5 | 9a3a3d4de4fe37edaf0c588e94f3ac8f | ||
| sha256 | 5dda9f4c3e8f64a90cf3968142fc904a21414f9879ede229af3c16e3d42dcf8e | ||
| ssdeep | 96:IowVaiaKKOi3VysuPKXyc3iI4A3U/J8W6h6rWCd0gwq/lu89lX1o/SSNyDo9OmU:IjJKOi4suPsyc3iILcJYId889N1GSSNy | ||
| imphash | |||
| impfuzzy | |||
Network IP location
Signature (8cnts)
| Level | Description |
|---|---|
| notice | Allocates read-write-execute memory (usually to unpack itself) |
| notice | Executes one or more WMI queries |
| notice | Executes one or more WMI queries which can be used to identify virtual machines |
| notice | File has been identified by 2 AntiVirus engines on VirusTotal as malicious |
| info | Checks amount of memory in system |
| info | Command line console output was observed |
| info | Queries for the computername |
| info | Uses Windows APIs to generate a cryptographic key |
Rules (2cnts)
| Level | Name | Description | Collection |
|---|---|---|---|
| warning | Generic_Malware_Zero | Generic Malware | binaries (download) |
| watch | Antivirus | Contains references to security software | binaries (download) |
Network (0cnts) ?
| Request | CC | ASN Co | IP4 | Rule ? | ZERO ? |
|---|