a.exe: Suspicious PE analysis report

Suspicious

40/100

5 points past the suspicious line at 35, 30 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+40

Threat intelligence

MalwareBazaar known sample: Phorpiex

Analysis layers

Static ran no points

Dynamic ran no points

Threat intel ran moved the score

AI ran no points

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution136s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

9 detected · 6 withheld as common

Severity	Detection	Evidence	Layer
MED	Anti-analysis strings present MITRE T1497	string isdebuggerpresent matched string string malware matched string	static
MED	DNS TXT lookup (DNS tunneling / C2) MITRE T1071.004	import dnsapi.dll!DnsQuery_A	static
MED	Network activity via WinINet MITRE T1071.001	import wininet.dll!InternetOpenA	static
MED	Ransomware-related strings MITRE T1486	string .crypt matched string string bitcoin matched string	static
MED	Raw socket networking MITRE T1095	import ws2_32.dll!WSAStartup	static
MED	Reads an HTTP response body (payload/tasking) MITRE T1105	import wininet.dll!InternetReadFile	static
LOW	Network communication capability MITRE T1071 seen in 6% of benign software	capability connect capability: network capability dnsquery_a capability: network capability gethostbyname capability: network capability internetopena capability: network capability internetopenurla capability: network capability internetopenurlw capability: network	static
LOW	Performs DNS resolution MITRE T1071.004	import dnsapi.dll!DnsQuery_A	static
LOW	Resolves a host (C2 lookup) MITRE T1071.004	import ws2_32.dll!gethostbyname	static

Withheld: 6 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software

Anti-debugging capability fires on 65% of benign software

Anti-debug: checks for a debugger fires on 60% of benign software

Reads its own startup info (parent/desktop check) fires on 36% of benign software

Creates a named mutex (single-instance / infection marker) fires on 31% of benign software

Executes external code / commands fires on 30% of benign software

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Microsoft Visual C/C++(15.00.30729)[C++]

Not packed Unsigned

CompilerMicrosoft Visual C/C++(15.00.30729)[C++]

LinkerMicrosoft Linker(9.00.30729)

Identity

File

typeexecutable

size18.0 KB

file arch32-bit (x86)

subsystemGUI

entropy6.0048

date2026-08-30 16:29:11 UTC

languageEN

Packing

Not packed

The file's code is readable on disk - nothing is compressed or encrypted around it.

0/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed

No packer indicator fired: the entry point, the section layout and the entropy all read as an ordinary build.

Secrets & malicious strings

4 flagged strings

Flagged string categories

anti-analysis / evasion med 2 hits

Indicator	Found in	Evidence from the sample
isdebuggerpresent	import table	KERNEL32.dll!IsDebuggerPresent
malware	extracted string	After that, I removed my malware to leave no traces.

ransomware med 2 hits

Indicator	Found in	Evidence from the sample
.crypt	extracted string	http://www.crypto.com - Payment options: Credit/Debit Cards, Bank Transfers, Apple Pay, Google Pay, and more.
bitcoin	extracted string	All you need is $1400 USD in Bitcoin (BTC), transferred to my wallet address.

Capabilities

4 behaviour buckets · 1 high-risk

Severity	Capability	MITRE	APIs
high	Anti-debugging Detects or obstructs a debugger	T1622	isdebuggerpresent
med	Network / C2 Opens sockets, HTTP or downloads payloads	T1071, T1071.001, T1071.004, T1095, T1105, T1590	connect, dnsquery_a, gethostbyname, internetopena, internetopenurla, internetopenurlw, internetopenw, internetreadfile, recv, sen…
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497, T1497.003	getsystemtimeasfiletime, gettickcount, queryperformancecounter, sleep
med	Code execution Creates processes / runs commands or shellcode	T1106	createthread

Security mitigations

partial posture

ON ASLR (DynamicBase)

OFF High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

ON SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Rich header (toolchain)

richhash cdffab6d4ca709a7

Tool	Build	Uses
prodid_123	50727	12
prodid_147	30729	3
Import (linker)	0	97
prodid_149	30729	2
Utc1400_CPP	30729	21
Utc1400_C	30729	5
Utc1500_CPP	30729	1

Sections

5 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	8.5 KB	8.1 KB	EXECUTEREAD	5.9238
.rdata Read-only data	0x4000	6.0 KB	5.8 KB	READ	5.2333
.data Initialised data	0x6000	512.0 B	3.2 KB	READWRITE	1.3671
.rsrc Resources	0x7000	1.0 KB	688.0 B	READ	5.1902
.reloc Base relocations	0x8000	1.0 KB	948.0 B	READ	5.5971

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

97 funcs / 7 DLLs · 12 suspicious

▸MSVCR90.dll42 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_unlock	0x00004088	-	-
__dllonexit	0x0000408c	-	-
_lock	0x00004090	-	-
_onexit	0x00004094	-	-
?terminate@@YAXXZ	0x00004098	-	-
_except_handler4_common	0x0000409c	-	-
_invoke_watson	0x000040a0	-	-
_controlfp_s	0x000040a4	-	-
_crt_debugger_hook	0x000040a8	-	-
__set_app_type	0x000040ac	-	-
_encode_pointer	0x000040b0	-	-
__p__fmode	0x000040b4	-	-
__p__commode	0x000040b8	-	-
_adjust_fdiv	0x000040bc	-	-
__setusermatherr	0x000040c0	-	-
_configthreadlocale	0x000040c4	-	-
_initterm_e	0x000040c8	-	-
_initterm	0x000040cc	-	-
_acmdln	0x000040d0	-	-
exit	0x000040d4	-	-
_ismbblead	0x000040d8	-	-
_XcptFilter	0x000040dc	-	-
_exit	0x000040e0	-	-
_cexit	0x000040e4	-	-
__getmainargs	0x000040e8	-	-
_amsg_exit	0x000040ec	-	-
mbstowcs	0x000040f0	-	-
atoi	0x000040f4	-	-
_wfopen	0x000040f8	-	-
fgets	0x000040fc	-	-
fclose	0x00004100	-	-
strtok	0x00004104	-	-
strchr	0x00004108	-	-
strcpy	0x0000410c	-	-
strcat	0x00004110	-	-
memset	0x00004114	-	-
strstr	0x00004118	-	-
srand	0x0000411c	-	-
sprintf	0x00004120	-	-
strlen	0x00004124	-	-
_decode_pointer	0x00004128	-	-
rand	0x0000412c	-	-

▸WININET.dll6 funcs 4 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
InternetCloseHandle	0x00004150	-	-
InternetOpenUrlA	0x00004154	-	T1071
InternetOpenA	0x00004158	-	T1071
InternetOpenUrlW	0x0000415c	-	T1071
InternetOpenW	0x00004160	-	T1071
InternetReadFile	0x00004164	-	-

▸SHLWAPI.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
StrStrA	0x00004134	-	-
StrCmpNA	0x00004138	-	-
PathFileExistsW	0x0000413c	-	-

▸WS2_32.dll12 funcs 4 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
recv	0x0000416c	-	-
select	0x00004170	-	-
htons	0x00004174	-	-
gethostbyname	0x00004178	-	-
inet_addr	0x0000417c	-	-
connect	0x00004180	-	T1071
socket	0x00004184	-	T1071
closesocket	0x00004188	-	-
setsockopt	0x0000418c	-	-
shutdown	0x00004190	-	-
WSAStartup	0x00004194	-	T1071
send	0x00004198	-	T1071

▸DNSAPI.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
DnsQuery_A	0x00004000	-	-
DnsFree	0x00004004	-	-

▸KERNEL32.dll30 funcs 4 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetTickCount	0x0000400c	-	T1497
lstrlenA	0x00004010	-	-
GetTimeZoneInformation	0x00004014	-	-
FileTimeToSystemTime	0x00004018	-	-
FileTimeToLocalFileTime	0x0000401c	-	-
ExitThread	0x00004020	-	-
ExitProcess	0x00004024	-	-
DeleteFileW	0x00004028	-	-
CreateThread	0x0000402c	-	-
ExpandEnvironmentStringsW	0x00004030	-	-
GetModuleFileNameW	0x00004034	-	-
GetLastError	0x00004038	-	-
CreateMutexA	0x0000403c	-	T1027
InterlockedExchange	0x00004040	-	-
InterlockedCompareExchange	0x00004044	-	-
GetStartupInfoA	0x00004048	-	-
SetUnhandledExceptionFilter	0x0000404c	-	-
QueryPerformanceCounter	0x00004050	-	T1497
GetCurrentThreadId	0x00004054	-	-
Sleep	0x00004058	-	-
CloseHandle	0x0000405c	-	-
WriteFile	0x00004060	-	-
CreateFileW	0x00004064	-	-
GetCurrentProcessId	0x00004068	-	-
GetSystemTimeAsFileTime	0x0000406c	-	-
TerminateProcess	0x00004070	-	-
GetCurrentProcess	0x00004074	-	-
UnhandledExceptionFilter	0x00004078	-	-
IsDebuggerPresent	0x0000407c	-	T1622
GetLocalTime	0x00004080	-	-

▸USER32.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
wsprintfA	0x00004144	-	-
wsprintfW	0x00004148	-	-

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Binary metadata

Resource langs	EN
Debug info	no
TLS callbacks	no

Resources

Resource Hacker view

Manifest1

▸Manifest1

1EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	EN
Size	598.0 B
RVA offset	0x7058
Content signature	XML manifest
MD5	5a32206e4bb9d06170ae00fa980db49b
Entropy	5.021

Application manifest

<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
      </requestedPrivileges>
    </security>
  </trustInfo>
  <dependency>
    <dependentAssembly>
      <assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>
    </dependentAssembly>
  </dependency>
</assembly>

YARA matches

4 findings · 3 file properties · 0 scored

Rule	What it matched	Corpus	Weight
SUSP_XORed_URL_In_EXE rule dated 2020-03-09	Detects an XORed URL in an executable 2 of 20 strings matched $s1 http:// at 0x2908 · 7 hits $f1 http:// at 0x2908 · 6 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. Only anti-vm, anti-debug, dropper and packer matches carry weight.
without_attachments mail	Rule to detect the no presence of any attachment 3 of 5 strings matched $eml_01 From: at 0x2b0c $eml_02 To: at 0x2b18 $eml_03 Subject: at 0x2b24	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. Only anti-vm, anti-debug, dropper and packer matches carry weight.
without_images mail	Rule to detect the no presence of any image 3 of 6 strings matched $eml_01 From: at 0x2b0c $eml_02 To: at 0x2b18 $eml_03 Subject: at 0x2b24	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. Only anti-vm, anti-debug, dropper and packer matches carry weight.
with_urls mail	Rule to detect the presence of an or several urls 4 of 4 strings matched $eml_01 From: at 0x2b0c $eml_02 To: at 0x2b18 $eml_03 Subject: at 0x2b24 $url_regex http://icanhazip.com/ at 0x2908 · 6 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. Only anti-vm, anti-debug, dropper and packer matches carry weight.

File properties - not findings

IsPE32IsWindowsGUIHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 160

!This program cannot be run in DOS mode.
^4Fw^Rich5Fw^
.text
`.rdata
@.data
.rsrc
@.reloc
%s%d
%u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
%s, %u %s %u %.2u:%.2u:%.2u %s%.2u%.2u
yandex.ru
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/202.0.4664.110 Safari/537.36
http://icanhazip.com/
[%s]
%s.com
ESMTP
EHLO %s
HELO %s
<%s>
MAIL FROM: %s
RCPT TO: <%s>
DATA
Received: from %s ([%d.%d.%d.%d]) by %s with MailEnable ESMTP; %s
Received: (qmail %s invoked by uid %s); %s
From: %s
To: %s
Subject: %s
Date: %s
Message-ID: <%s.%s@%s>
Mime-Version: 1.0
Content-type: text/plain;
Unfortunately, there is some bad news for you.
Some time ago, your device was infected with my private Trojan, R.A.T. (Remote Administration Tool).
If you want to find out more about it, simply use Google.
My Trojan allowed me to access your files, accounts, and your camera.
Check the sender of this email; I have sent it from your email account.
I RECORDED YOU (through your camera) MASTURBATING!
If you still doubt my serious intentions, it only takes a couple of mouse clicks to share the video of you masturbating with your family, friends, relatives, all email contacts, on social networks and the darknet.
After that, I removed my malware to leave no traces.
To ensure you read this email, you will receive it multiple times.
All you need is $1400 USD in Bitcoin (BTC), transferred to my wallet address.
After the transaction is successful, I will proceed to delete everything.
You can purchase Bitcoin (BTC) from reputable exchanges here:
http://www.coinbase.com - Payment options: Credit/Debit Cards, Bank Transfers, PayPal (in some regions).
http://www.binance.com - Payment options: Credit/Debit Cards, Bank Transfers, P2P trading, third-party payment providers, and gift cards.
http://www.bitrefill.com - Payment options: Paysafecard, credit/debit cards, crypto, bank transfer, and other gift cards.
http://www.crypto.com - Payment options: Credit/Debit Cards, Bank Transfers, Apple Pay, Google Pay, and more.
http://www.etoro.com - Payment options: Credit/Debit Cards, Bank Transfers, PayPal.
Alternatively, simply Google for other exchanges.
Once purchased, you can send the Bitcoin (BTC) directly to my wallet address or use a wallet application such as Atomic Wallet or Exodus Wallet to manage your transactions.
My Bitcoin (BTC) wallet address is: 1DFN2R8w1Qos6Cwi4kp68ACZLSHHFeaRFq
Yes, that's how the wallet address looks. Copy and paste my wallet address; it's case-sensitive.
A piece of advice from me: regularly change all your passwords and update your device with the latest security patches.
QUIT
rand
strlen
sprintf
srand
strstr
memset
strcat
strcpy
strchr
strtok
fgets
_wfopen
atoi
mbstowcs
MSVCR90.dll
_amsg_exit
__getmainargs
_cexit
_exit
_ismbblead
exit
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
_encode_pointer
__set_app_type
?terminate@@YAXXZ
__dllonexit
_onexit
_decode_pointer
_except_handler4_common
_invoke_watson
_controlfp_s
_crt_debugger_hook
InternetCloseHandle
InternetReadFile
InternetOpenUrlA
InternetOpenA
InternetOpenUrlW
InternetOpenW
WININET.dll
StrCmpNA
StrStrA
PathFileExistsW
SHLWAPI.dll
WS2_32.dll
DnsFree
DnsQuery_A
DNSAPI.dll
lstrlenA
GetTickCount
GetTimeZoneInformation
FileTimeToSystemTime
FileTimeToLocalFileTime
GetLocalTime
Sleep
CloseHandle
WriteFile
CreateFileW
ExitThread
ExitProcess
DeleteFileW
CreateThread
ExpandEnvironmentStringsW
GetModuleFileNameW
GetLastError
CreateMutexA
InterlockedExchange
InterlockedCompareExchange
GetStartupInfoA
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
IsDebuggerPresent
KERNEL32.dll
wsprintfA
wsprintfW
USER32.dll
YOU GOT RECORDED!
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
<security>
<requestedPrivileges>
<requestedExecutionLevel level="asInvoker" uiAccess="false"></requestedExecutionLevel>
</requestedPrivileges>
</security>
</trustInfo>
<dependency>
<dependentAssembly>
<assemblyIdentity type="win32" name="Microsoft.VC90.CRT" version="9.0.21022.8" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b"></assemblyIdentity>
</dependentAssembly>
</dependency>
</assembly>PAPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDING
%temp%
%sn.txt
%s%d.txt
%s\%d%d%d.jpg
%s:Zone.Identifier

Stack and decoded strings were not recovered: string emulation failed on this file. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x402b07e87c030000call0x402e88

0x402b0ce936fdffffjmp0x402847

0x402b118bffmovedi, edi

0x402b1355pushebp

0x402b148becmovebp, esp

0x402b168b4508moveax, dword ptr [ebp + 8]

0x402b198b00moveax, dword ptr [eax]

0x402b1b813863736de0cmpdword ptr [eax], 0xe06d7363

0x402b21752ajne0x402b4d

0x402b2383781003cmpdword ptr [eax + 0x10], 3

0x402b277524jne0x402b4d

0x402b298b4014moveax, dword ptr [eax + 0x14]

0x402b2c3d20059319cmpeax, 0x19930520

0x402b317415je0x402b48

0x402b333d21059319cmpeax, 0x19930521

0x402b38740eje0x402b48

0x402b3a3d22059319cmpeax, 0x19930522

0x402b3f7407je0x402b48

0x402b413d00409901cmpeax, 0x1994000

0x402b467505jne0x402b4d

0x402b48e8d1030000call0x402f1e

0x402b4d33c0xoreax, eax

0x402b4f5dpopebp

0x402b50c20400ret4

0x402b5368112b4000push0x402b11

0x402b58ff154c404000calldword ptr [0x40404c]

0x402b5e33c0xoreax, eax

0x402b60c3ret

0x402b61ccint3

0x402b62ff25ec404000jmpdword ptr [0x4040ec]

0x402b686a14push0x14

0x402b6a68404f4000push0x404f40

0x402b6fe868020000call0x402ddc

0x402b74ff359c6c4000pushdword ptr [0x406c9c]

0x402b7a8b3528414000movesi, dword ptr [0x404128]

0x402b80ffd6callesi

0x402b8259popecx

0x402b838945e4movdword ptr [ebp - 0x1c], eax

0x402b8683f8ffcmpeax, -1

0x402b89750cjne0x402b97

0x402b8bff7508pushdword ptr [ebp + 8]

0x402b8eff1594404000calldword ptr [0x404094]

0x402b9459popecx

0x402b95eb67jmp0x402bfe

0x402b976a08push8

0x402b99e892030000call0x402f30

0x402b9e59popecx

0x402b9f8365fc00anddword ptr [ebp - 4], 0

0x402ba3ff359c6c4000pushdword ptr [0x406c9c]

0x402ba9ffd6callesi

0x402bab8945e4movdword ptr [ebp - 0x1c], eax

0x402baeff35986c4000pushdword ptr [0x406c98]

0x402bb4ffd6callesi

0x402bb659popecx

0x402bb759popecx

0x402bb88945e0movdword ptr [ebp - 0x20], eax

0x402bbb8d45e0leaeax, [ebp - 0x20]

0x402bbe50pusheax

0x402bbf8d45e4leaeax, [ebp - 0x1c]

0x402bc250pusheax

callbranchretstackarithregisterimmediatememory

Screen recording

8 frames · screen recording · 136s

1 / 8

0:00 · 1/8

Behavior summary

ran 136s

1 process(es) observed

LaunchedC:\Users\user\Desktop\a.exe

Privilegestandard

Telemetry sources: Kernel ETW (3 of 105 events) Process audit: 1

Evasion / anti-analysis checks

2 checks

MED

Anti-debug API imports static-api

MITRE T1622 · isdebuggerpresent

MED

Anti-analysis strings (VM/debugger/tool names) strings

MITRE T1497 · isdebuggerpresent, malware

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 928 operations on the machine during the run; none of them came from the sample's process tree.

DNS queries

1 unique

Domain	Type
yandex.ru	MX

Also watched

no result to show

Observer	Result	What it means
TCP / UDP connections	none	The guest agent recorded no socket to a remote host.
TLS handshakes	none	No TLS session was negotiated, so there is no JA3/JA4 fingerprint to compare.
Beaconing analysis	not run	The interval analysis had no traffic to work from.
DGA scoring	no candidate	No resolved name scored as algorithmically generated.
IDS ruleset	0 alerts	The capture was replayed through the IDS ruleset and matched nothing.

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

1registry operation

a.exe

1 process

Attributed activity

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Established mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

File & registry ops

0 file · 1 registry · sample scope

Files (0) Registry (1)

Operation	Target	Process
create	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	a.exe pid 2440

4 reported a hit 16 answered no 1 could not answer 2 had nothing to check

4Sources with a hit

21Sources queriedof 23 available

486.1kFeed records

1Could not answer

File reputation

3 of 7 listed

Source	Checks	Result	Detail	Feed
filescan.io	File hash	11/17 engines	-	live lookup
MalwareBazaar	File hash	Phorpiex	exe	live lookup
MalwareBazaar hash feed	File hash	listed	malwarebazaar: Phorpiex	2,535 records 51 minutes ago
VirusTotal	File hash	cannot access	rate limited (free-tier quota)	live lookup
MalwareBazaar ransomware feed	File hash	clean	not in feed	8,271 records 5 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,632 records 51 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,474 records 51 minutes ago

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

8 clear

Source	Checks	Result	Detail	Feed
blocklist.de	IP / domain / URL	clean	7 observed indicators, none listed	24.5k records 51 minutes ago
CINS Army	IP / domain / URL	clean	7 observed indicators, none listed	15k records 51 minutes ago
Emerging Threats	IP / domain / URL	clean	7 observed indicators, none listed	580 records 51 minutes ago
Feodo Tracker	IP / domain / URL	clean	7 observed indicators, none listed	5 records 51 minutes ago
IPsum	IP / domain / URL	clean	7 observed indicators, none listed	17.7k records 51 minutes ago
Phishing.Database	IP / domain / URL	clean	7 observed indicators, none listed	391.1k records 5 hours ago
ThreatFox	IP / domain / URL	clean	7 observed indicators, none listed	1,632 records 51 minutes ago
URLhaus	IP / domain / URL	clean	7 observed indicators, none listed	5,155 records 51 minutes ago

TLS fingerprints

0 clear

Source	Checks	Result	Detail	Feed
abuse.ch JA3 blocklist	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 17 hours ago
SSL blocklist	JA3 / JA4	not checked	no TLS client fingerprint observed	10.7k records 51 minutes ago

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
YARA rules	Sample content	4 matches	SUSP_XORed_URL_In_EXE, without_attachments, without_images	110 records 52 minutes ago
Sigma rules	Behavior log	clean	-	2,275 records 23 hours ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	1 process image path, none masqueraded	244 records 52 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 51 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,306 records 51 minutes ago
LOLRMM	Names and domains	clean	3 name/domain indicators checked, no remote-management tooling	322 records 51 minutes ago

Analyst narrative

The analysis of the sample indicates that it was successfully executed in the sandbox environment. **Initial Access:** The sample does not provide explicit evidence of initial access mechanisms, such as exploitation of vulnerabilities or social engineering techniques. However, the presence of URLs related to cryptocurrency and financial services suggests potential targeting of users for financial gain. **Execution:** The sample was executed, as indicated by the observation of one process. The analysis did not capture specific API calls or behaviors during execution, which limits the understanding of its operational capabilities. **Persistence:** There were no persistence mechanisms observed in the analysis. The sample did not create any registry entries or scheduled tasks that would allow it to maintain a presence on the system after reboot. **Defense Evasion:** The sample is unsigned, which is a common tactic used to evade detection. However, no specific evasion techniques were recorded during the execution. **Command and Control (C2):** The sample made a DNS query to "yandex.ru," which could indicate an attempt to communicate with a remote server. Additionally, multiple URLs related to cryptocurrency services were identified, suggesting potential C2 infrastructure or targets for data exfiltration. **Impact:** There is no direct evidence of impact, such as data theft or system modification, as the behavior summary lacks detailed actions taken by the sample. **Verdict Rationale:** The sample exhibits characteristics that suggest it may be malicious, particularly due to its unsigned nature and the presence of URLs associated with financial services. However, the lack of detailed behavioral evidence limits the ability to definitively classify it as malware. Further investigation would be required to ascertain its true intent and capabilities.

Evasion analysis

No evasive checkpoints detected.

0 malicious 4 suspicious 7 info

Attribution:Phorpiex

Network indicators

Severity	Type	Indicator	Description
info	url	http://icanhazip.com/	Extracted from the sample's strings
info	url	http://www.coinbase.com	Extracted from the sample's strings
info	url	http://www.binance.com	Extracted from the sample's strings
info	url	http://www.bitrefill.com	Extracted from the sample's strings
info	url	http://www.crypto.com	Extracted from the sample's strings
info	url	http://www.etoro.com	Extracted from the sample's strings
info	domain	yandex.ru	Observed during analysis

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	75add6610bcc43f8962b2dfd2d6262a765329826274bcae7ad8967489aeaaa19	Submitted sample (SHA256)
suspicious	sample_md5	ebafe66c33d3fa02128f274d52d29d89	Submitted sample (MD5)
suspicious	imphash	edd9caae8565fbe43a73e0ad530f325e	Import table hash (imphash)

Registry indicators

Severity	Type	Indicator	Description
suspicious	registry_key	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Autostart / persistence key

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2373_sigma_reg

Auto-generated

title: Auto-generated registry behavior rule (sandbox scan 2373)
id: sandbox-auto-2373-reg
status: experimental
description: Auto-generated from sandbox scan 2373
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters'
    condition: selection
level: medium

Suricata/Snort: auto_file_2373_suricata

Auto-generated

alert dns any any -> any any (msg:"sandbox auto scan 2373 C2 domain yandex.ru"; dns.query; content:"yandex.ru"; sid:15976576; rev:1;)

YARA: auto_file_2373_yara

Auto-generated

rule auto_file_2373_yara
{
    meta:
        description = "Auto-generated from scan 2373"
        author = "sandbox auto-generator"
        imphash = "edd9caae8565fbe43a73e0ad530f325e"
        anchors = "5 independent regions"
    strings:
        $s0 = "yandex.ru" ascii fullword
        $s1 = "Content-type: text/plain;" ascii fullword
        $s2 = "http://icanhazip.com/" ascii fullword
        $s3 = "My Bitcoin (BTC) wallet address is: 1DFN2R8w1Qos6Cwi4kp68ACZLSHHFeaRFq" ascii fullword
        $s4 = "All you need is $1400 USD in Bitcoin (BTC), transferred to my wallet address." ascii fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 73728 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2373

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-09-07 21:41 Shown below	Static analysis	Suspicious	40/100

Why this verdict

Analysis layers

Sample

Run conditions

Detection signatures

Structure

Sections & resources

Signatures & packing

Strings

Code

Secrets & malicious strings

Flagged string categories

Capabilities

Security mitigations

Rich header (toolchain)

Sections

Imports

Code signing

Resources

Resources

YARA matches

Extracted strings

Disassembly

Nothing in this view

Screen recording

Behavior summary

Evasion / anti-analysis checks

DNS queries

Also watched

Process tree

a.exe

Attributed activity

Established mechanisms

No persistence established

Detection coverage

File activity summary

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

Analyst narrative

Evasion analysis

Network indicators

File indicators

Registry indicators

Sigma detections

Generated rules

Sigma: auto_file_2373_sigma_reg

Suricata/Snort: auto_file_2373_suricata

YARA: auto_file_2373_yara

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file