Report - cdcfe4d9-3401-f075-6f71-c7c8973688da.eml

AntiDebug AntiVM
ScreenShot
Created 2025.04.07 19:44 Machine s1_win7_x6401
Filename cdcfe4d9-3401-f075-6f71-c7c8973688da.eml
Type RFC 822 mail, ASCII text, with CRLF line terminators
AI Score Not founds Behavior Score
3.8
ZERO API file : clean
VT API (file) 1 detected ()
md5 a92351d390f50abd23c09dc8e8a6f788
sha256 c82b600681564ef46f1cbd463a000b97d00ce9f9856313f09bee284f43857673
ssdeep 384:sMk8/oJE/7AmVuHO8+0Qc9isOC0Yd2e3hZIU6HHY0BYgh78P0O2iHDxYWZ8MPk7h:oJu7AmVuuNvo5ZoxMjufy1jLDZDe
imphash
impfuzzy
  Network IP location

Signature (10cnts)

Level Description
watch Attempts to modify browser security settings
watch Harvests credentials from local email clients
notice Allocates read-write-execute memory (usually to unpack itself)
notice Checks for the Locally Unique Identifier on the system for a suspicious privilege
notice Creates a shortcut to an executable file
notice File has been identified by one AntiVirus engine on VirusTotal as malicious
notice Yara rule detected in process memory
info Checks if process is being debugged by a debugger
info Queries for the computername
info Tries to locate where the browsers are installed

Rules (8cnts)

Level Name Description Collection
info anti_dbg Checks if being debugged memory
info DebuggerCheck__GlobalFlags (no description) memory
info DebuggerCheck__QueryInfo (no description) memory
info DebuggerHiding__Active (no description) memory
info DebuggerHiding__Thread (no description) memory
info disable_dep Bypass DEP memory
info SEH__vectored (no description) memory
info ThreadControl__Context (no description) memory

Network (0cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?

Suricata ids



Similarity measure (PE file only) - Checking for service failure