Malwagon
EXE
AutoFishing.exe File Analysis · first seen Oct 9, 2026 11:42 · 32.7 MB
4proc 2reg 3IOCs
Suspicious35 Completed Public
Get sample Report Sign in

AutoFishing.exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

14.9sto launch
9telemetry events
6observed
17agent notes

Suspicious

35/100

0 points past the suspicious line at 35, 35 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+32
Static analysis
  • Packed (Inno Setup, confidence 53)
  • 2 high-risk capability(ies): sandbox evasion, token manipulation
  • 4 supporting capabilities in one unsigned binary: file discovery, obfuscation, registry query, system information
  • 1 high-risk capability bucket(s): Privilege escalation
+3
Review confirms
  • 3 of 3 local reviews independently read this as suspicious, on top of 32 points the platform measured itself
+0
Model review
  • findings review (advisory, not scored): suspicious - packed installer, anti-vm checks, rc4/xor encoding, process creation

Model reading

Measured SUSPICIOUS35 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution75s (ended early)
Guest hardware2 vCPU4095 MB RAM

Detection signatures

10 detected · 6 withheld as common
Severity Detection Evidence Layer
MED
Creates a suspended process then resumes (hollowing/hijack)
MITRE T1055.012
import kernel32.dll!CreateProcessW requires createprocess
import kernel32.dll!ResumeThread requires resumethread
static
MED
Forces reboot/shutdown (post-impact)
MITRE T1529
import user32.dll!ExitWindowsEx
static
MED
Packed with Inno Setup
MITRE T1027.002
packer Inno Setup packer identification
entropy 7.99 file entropy (8.0 = random)
static
MED
TLS callback (pre-main execution)
MITRE T1055
pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point
static
LOW
Adjusts token privileges (SeDebug / escalation)
MITRE T1134
seen in 8% of benign software
import advapi32.dll!AdjustTokenPrivileges
static
LOW
Checks free disk space (sandbox sizing check)
MITRE T1497.001
seen in 6% of benign software
import kernel32.dll!GetDiskFreeSpaceW
static
LOW
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
import kernel32.dll!VirtualProtect requires virtualprotect
import kernel32.dll!VirtualAlloc requires virtualalloc
static
LOW
Reflective/manual DLL load pattern
MITRE T1620
seen in 8% of benign software
import kernel32.dll!VirtualAlloc requires virtualalloc
import kernel32.dll!GetProcAddress requires getprocaddress
import kernel32.dll!LoadLibraryA requires loadlibrary
import kernel32.dll!CreateThread requires createthread
static
LOW
Scans memory layout (VirtualQuery)
MITRE T1055
import kernel32.dll!VirtualQueryEx
static
LOW
Spawns child processes
MITRE T1106
seen in 16% of benign software
import kernel32.dll!CreateProcessW
static
Withheld: 6 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Executes external code / commands fires on 30% of benign software
Queries system information (host recon) fires on 25% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnot tested - the autostart surfaces were snapshotted before the sample ran, but this run left no record of the comparison afterwards, so an empty result cannot be read as a clean one
Cross-process injectionnone observed
Payloads written to disknone observed
Network connectionsnot tested - internet was disabled
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Anti-analysis / evasion checksnot measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: packing detected.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Inno Setup Module(6.0.0)[unicode]
Packed Unsigned
CompilerEmbarcadero Delphi(10.3 Rio)[Professional]
LinkerTurbo Linker(2.25*,Delphi)[GUI32]
InstallerInno Setup Module(6.0.0)[unicode]
Identity
File
typeexecutable
size32.7 MB
file arch32-bit (x86)
subsystemGUI
entropy7.9889
date2019-10-12 11:15:57 UTC
version
descriptionAuto Fishing Clash Setup
productAuto Fishing Clash
languageEN, NEU, NL

Antivirus engine

no signature matched signature set 28147 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28147
Signatures in the set3,642,847
Set published08 Oct 2026 06:24 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

no model score

No model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

Structural rules of thumb, not a model. 4 cheap static signals fired, for 70 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

  • high entropy 7.9889
  • packed (Inno Setup)
  • unsigned executable
  • TLS callback
Packing
Packed with Inno Setup
Packed code is compressed or encrypted on disk and only appears once the sample runs.
installer
53/100
packer confidence
Detonation is the reliable read here A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.
Evidence 3 signals
  • Packer section '.didata' (Inno Setup)
  • Marker 'Inno Setup' (Inno Setup)
  • TLS callback present

Family configuration search

Not attempted

The sample is 32.7 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size32.7 MB
Bound16.0 MB
Limit reachedSample size, before any parser was loaded.

Capabilities

7 behaviour buckets · 1 high-risk
SeverityCapabilityMITREAPIs
high Privilege escalation
Adjusts tokens / privileges
 T1134, T1134.001 adjusttokenprivileges, openprocesstoken
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress, loadlibrarya, loadlibraryw
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497.003 gettickcount, queryperformancecounter, sleep
med Code execution
Creates processes / runs commands or shellcode
 T1059, T1106 createprocessw, createthread, system
med System shutdown / reboot
Reboots or shuts down the host
 T1529 exitwindowsex
med Ransomware behaviour
Enumerates + encrypts files, deletes backups
 T1083 findfirstfilew
low Discovery
Enumerates the host, users, processes or network
 T1082 getsysteminfo, netwkstagetinfo

Security mitigations

partial posture
ON ASLR (DynamicBase)
OFF High-entropy ASLR (64-bit)
ON DEP / NX (NxCompat)
OFF Control Flow Guard
? SafeSEH
? Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Sections

10 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.text
Executable code
 0x1000
660.5 KB
660.2 KB
EXECUTEREAD
6.3693
.itextEP
Initialisation code
 0xa7000
6.0 KB
5.6 KB
EXECUTEREAD
5.9518
.data
Initialised data
 0xa9000
14.0 KB
13.9 KB
READWRITE
5.0352
.bss
Uninitialised data
 0xad000
0.0 B
25.9 KB
READWRITE
0.0
.idata
Import table
 0xb4000
4.0 KB
3.8 KB
READWRITE
4.7916
.didata
Non-standard section
 0xb5000
512.0 B
420.0 B
READWRITE
2.7458
.edata
Export table
 0xb6000
512.0 B
154.0 B
READ
1.8811
.tls
Thread-local storage
 0xb7000
0.0 B
24.0 B
READWRITE
0.0
.rdata
Read-only data
 0xb8000
512.0 B
93.0 B
READ
1.38
.rsrc
Resources
 0xb9000
17.5 KB
17.5 KB
READ
4.4302
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

137 funcs / 7 DLLs · 13 suspicious
▸kernel32.dll99 funcs 10 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetACP 0x000b42e0 - -
GetExitCodeProcess 0x000b42e4 - -
LocalFree 0x000b42e8 - -
CloseHandle 0x000b42ec - -
SizeofResource 0x000b42f0 - -
VirtualProtect 0x000b42f4 - T1055
VirtualFree 0x000b42f8 - -
GetFullPathNameW 0x000b42fc - -
ExitProcess 0x000b4300 - -
HeapAlloc 0x000b4304 - -
GetCPInfoExW 0x000b4308 - -
RtlUnwind 0x000b430c yes -
GetCPInfo 0x000b4310 - -
GetStdHandle 0x000b4314 - -
GetModuleHandleW 0x000b4318 - -
FreeLibrary 0x000b431c - -
HeapDestroy 0x000b4320 - -
ReadFile 0x000b4324 - -
CreateProcessW 0x000b4328 - T1106
GetLastError 0x000b432c - -
GetModuleFileNameW 0x000b4330 - -
SetLastError 0x000b4334 - -
FindResourceW 0x000b4338 - -
CreateThread 0x000b433c - -
CompareStringW 0x000b4340 - -
LoadLibraryA 0x000b4344 - T1129
ResetEvent 0x000b4348 - -
GetVersion 0x000b434c - -
RaiseException 0x000b4350 - -
FormatMessageW 0x000b4354 - -
SwitchToThread 0x000b4358 - -
GetExitCodeThread 0x000b435c - -
GetCurrentThread 0x000b4360 - -
LoadLibraryExW 0x000b4364 - -
LockResource 0x000b4368 - -
GetCurrentThreadId 0x000b436c - -
UnhandledExceptionFilter 0x000b4370 - -
VirtualQuery 0x000b4374 - -
VirtualQueryEx 0x000b4378 - -
Sleep 0x000b437c - -
EnterCriticalSection 0x000b4380 - -
SetFilePointer 0x000b4384 - -
LoadResource 0x000b4388 - T1129
SuspendThread 0x000b438c - -
GetTickCount 0x000b4390 - T1497
GetFileSize 0x000b4394 - -
GetStartupInfoW 0x000b4398 - -
GetFileAttributesW 0x000b439c - -
InitializeCriticalSection 0x000b43a0 - -
GetThreadPriority 0x000b43a4 - -
SetThreadPriority 0x000b43a8 - -
GetCurrentProcess 0x000b43ac - -
VirtualAlloc 0x000b43b0 - T1055
GetSystemInfo 0x000b43b4 - -
GetCommandLineW 0x000b43b8 - -
LeaveCriticalSection 0x000b43bc - -
GetProcAddress 0x000b43c0 - T1129
ResumeThread 0x000b43c4 - -
GetVersionExW 0x000b43c8 - -
VerifyVersionInfoW 0x000b43cc - -
HeapCreate 0x000b43d0 - -
GetWindowsDirectoryW 0x000b43d4 - -
VerSetConditionMask 0x000b43d8 - -
GetDiskFreeSpaceW 0x000b43dc - -
FindFirstFileW 0x000b43e0 - T1083
GetUserDefaultUILanguage 0x000b43e4 - -
lstrlenW 0x000b43e8 - -
QueryPerformanceCounter 0x000b43ec - T1497
SetEndOfFile 0x000b43f0 - -
HeapFree 0x000b43f4 - -
WideCharToMultiByte 0x000b43f8 - -
FindClose 0x000b43fc - -
MultiByteToWideChar 0x000b4400 - -
LoadLibraryW 0x000b4404 - T1129
SetEvent 0x000b4408 - -
CreateFileW 0x000b440c - -
GetLocaleInfoW 0x000b4410 - -
GetSystemDirectoryW 0x000b4414 - -
DeleteFileW 0x000b4418 - -
GetLocalTime 0x000b441c - -
GetEnvironmentVariableW 0x000b4420 - -
WaitForSingleObject 0x000b4424 - -
WriteFile 0x000b4428 - -
ExitThread 0x000b442c - -
DeleteCriticalSection 0x000b4430 - -
TlsGetValue 0x000b4434 - -
GetDateFormatW 0x000b4438 - -
SetErrorMode 0x000b443c - -
IsValidLocale 0x000b4440 - -
TlsSetValue 0x000b4444 - -
CreateDirectoryW 0x000b4448 - -
GetSystemDefaultUILanguage 0x000b444c - -
EnumCalendarInfoW 0x000b4450 - -
LocalAlloc 0x000b4454 - -
GetUserDefaultLangID 0x000b4458 - -
RemoveDirectoryW 0x000b445c - -
CreateEventW 0x000b4460 - -
SetThreadLocale 0x000b4464 - -
GetThreadLocale 0x000b4468 - -
▸comctl32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
InitCommonControls 0x000b4470 - -
▸version.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetFileVersionInfoSizeW 0x000b4478 - -
VerQueryValueW 0x000b447c - -
GetFileVersionInfoW 0x000b4480 - -
▸user32.dll15 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
CreateWindowExW 0x000b4488 - -
TranslateMessage 0x000b448c - -
CharLowerBuffW 0x000b4490 - -
CallWindowProcW 0x000b4494 - -
CharUpperW 0x000b4498 - -
PeekMessageW 0x000b449c - -
GetSystemMetrics 0x000b44a0 - -
SetWindowLongW 0x000b44a4 - -
MessageBoxW 0x000b44a8 - -
DestroyWindow 0x000b44ac - -
CharNextW 0x000b44b0 - -
MsgWaitForMultipleObjects 0x000b44b4 - -
LoadStringW 0x000b44b8 - -
ExitWindowsEx 0x000b44bc - -
DispatchMessageW 0x000b44c0 - -
▸oleaut32.dll11 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
SysAllocStringLen 0x000b44c8 - -
SafeArrayPtrOfIndex 0x000b44cc - -
VariantCopy 0x000b44d0 - -
SafeArrayGetLBound 0x000b44d4 - -
SafeArrayGetUBound 0x000b44d8 - -
VariantInit 0x000b44dc - -
VariantClear 0x000b44e0 - -
SysFreeString 0x000b44e4 - -
SysReAllocStringLen 0x000b44e8 - -
VariantChangeType 0x000b44ec - -
SafeArrayCreate 0x000b44f0 - -
▸netapi32.dll2 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
NetWkstaGetInfo 0x000b44f8 - -
NetApiBufferFree 0x000b44fc - -
▸advapi32.dll6 funcs 3 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
RegQueryValueExW 0x000b4504 - -
AdjustTokenPrivileges 0x000b4508 - T1134
LookupPrivilegeValueW 0x000b450c - T1134
RegCloseKey 0x000b4510 - -
OpenProcessToken 0x000b4514 - T1134
RegOpenKeyExW 0x000b4518 - -

Binary metadata

what the headers declare about this build
Resource langsENNEUNL
Debug infono
TLS callbacksyes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Similar samples

4 related samples

Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

RelationSampleVerdictWhy it matched
related INSIDE_V2.0.0_Windows_Installer… Malicious identical export table (exphash)
related fsrdemoing.exe Suspicious identical export table (exphash)
related Setup_BrightSlide_1.1.2.exe No threats detected identical export table (exphash)
related afterpatch.exe No threats detected identical export table (exphash)

Capability detection

51 capabilities
list is incomplete here

The capability analysis reports that this file is an installer, so the capabilities below are mostly its installer stub's, not the payload's.

Read what follows as the capabilities of the code that could be read, not of the file as a whole.

CapabilityNamespace
link function at runtime on Windows linking/runtime-linking
calculate modulo 256 via x86 assembly -
create or open file -
modify access privileges host-interaction/process/modify
create process on Windows host-interaction/process/create
allocate memory -
allocate or change RW memory -
delay execution -
generate random numbers using the Delphi LCG data-manipulation/prng/lcg
create thread host-interaction/thread/create
create or open registry key -
get file attributes host-interaction/file-system/meta
encode data using XOR data-manipulation/encoding/xor
PEB access -
suspend thread host-interaction/thread/suspend
create process suspended host-interaction/process/create
change memory protection -
allocate or change RWX memory host-interaction/process/inject
contain loop -
write file on Windows host-interaction/file-system/write
check for time delay via GetTickCount anti-analysis/anti-debugging/debugger-detection
terminate process host-interaction/process/terminate
get OS version -
check OS version host-interaction/os/version
get geographical location collection
identify system language via API targeting/language
query or enumerate registry value host-interaction/registry
get system information on Windows host-interaction/os/info
set thread local storage value host-interaction/thread/tls
get thread local storage value host-interaction/process
get common file path host-interaction/file-system
encrypt data using RC4 PRGA data-manipulation/encryption/rc4
get disk size host-interaction/hardware/storage
get file version info host-interaction/file-system/meta
query environment variable host-interaction/environment-variable
accept command line arguments host-interaction/cli
clear file content host-interaction/file-system/write
hash data with CRC32 data-manipulation/checksum/crc32
delete file host-interaction/file-system/delete
create directory host-interaction/file-system/create
shutdown system host-interaction/os
check if file exists host-interaction/file-system/exists
extract resource via kernel32 functions executable/resource
delete directory host-interaction/file-system/delete
reference anti-VM strings targeting Qemu anti-analysis/anti-vm/vm-detection
reference anti-VM strings targeting Xen anti-analysis/anti-vm/vm-detection
packaged as an Inno Setup installer executable/installer/inno-setup
reference analysis tools strings anti-analysis
contain a thread local storage (.tls) section executable/pe/section/tls
compiled with Borland Delphi compiler/delphi
ATT&CK techniques
Defense Evasion::Obfuscated Files or Information [T1027]Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]Discovery::File and Directory Discovery [T1083]Discovery::Query Registry [T1012]Discovery::System Information Discovery [T1082]Discovery::System Location Discovery [T1614]Discovery::System Location Discovery::System Language Discovery [T1614.001]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]Impact::System Shutdown/Reboot [T1529]Privilege Escalation::Access Token Manipulation [T1134]
Malware Behavior Catalog
Anti-Behavioral Analysis::Debugger Detection::Process Environment BlockAnti-Behavioral Analysis::Debugger Detection::Timing/Delay Check GetTickCountAnti-Behavioral Analysis::Dynamic Analysis Evasion::Delayed ExecutionAnti-Behavioral Analysis::Virtual Machine DetectionCryptography::Encrypt Data::RC4Cryptography::Generate Pseudo-random SequenceCryptography::Generate Pseudo-random Sequence::RC4 PRGAData::Checksum::CRC32Data::Encode Data::XORData::ModuloDefense Evasion::Obfuscated Files or Information::Encoding-Standard AlgorithmDiscovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create DirectoryFile System::Create FileFile System::Delete DirectoryFile System::Delete FileFile System::Get File AttributesFile System::Writes FileMemory::Allocate MemoryMemory::Change Memory ProtectionOperating System::Registry::Create Registry KeyOperating System::Registry::Open Registry KeyOperating System::Registry::Query Registry ValueProcess::Create ProcessProcess::Create Process::Create Suspended ProcessProcess::Create ThreadProcess::Set Thread Local Storage ValueProcess::Suspend ThreadProcess::Terminate Process

Signature matches

1 finding · 5 file properties · 0 scored
Rule What it matched Corpus Weight
possible_includes_base64_packed_functions
Detects possible includes and packed functions
2 of 2 strings matched
$f aToB at 0x9bb5ba
$fff This at 0x50 · 171312 hits
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
File properties - not findings
IsPE32IsWindowsGUIIsPackedHasOverlayborland_delphi

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 200 of 3104
  • This program must be run under Win32
  • .text
  • `.itext
  • `.data
  • .bss
  • .idata
  • .didata
  • .edata
  • @.tls
  • .rdata
  • @.rsrc
  • Boolean
  • False
  • True
  • System
  • AnsiChar
  • Char
  • ShortInt
  • SmallInt
  • Integer
  • Byte
  • Word
  • Cardinal
  • Pointer
  • UInt64
  • NativeInt
  • NativeUInt
  • Single
  • Extended
  • Double
  • Comp
  • Currency
  • ShortString
  • PAnsiChar0
  • PWideCharL
  • ByteBool
  • WordBool
  • LongBool
  • string
  • WideString
  • AnsiString
  • Variant
  • OleVariant
  • TClass
  • HRESULT
  • TGUID
  • &op_Equality
  • Left
  • Right
  • &op_Inequality
  • Create
  • Data
  • BigEndian
  • AStartIndex
  • PInterfaceEntry
  • TInterfaceEntry
  • VTable
  • IOffset
  • ImplGetter
  • PInterfaceTable4
  • TInterfaceTable
  • EntryCount
  • Entries
  • TMethod
  • Code
  • &op_GreaterThan
  • &op_GreaterThanOrEqual
  • &op_LessThan
  • &op_LessThanOrEqual
  • TObject&
  • Self
  • Free
  • DisposeOf
  • InitInstance
  • Instance
  • CleanupInstance
  • ClassType
  • ClassName
  • ClassNameIs
  • Name
  • ClassParent
  • ClassInfo
  • InstanceSize
  • InheritsFrom
  • AClass
  • MethodAddress
  • MethodName
  • Address
  • QualifiedClassName
  • FieldAddress
  • GetInterface
  • GetInterfaceEntry
  • GetInterfaceTable
  • UnitName
  • UnitScope
  • GetHashCode
  • ToString
  • SafeCallException
  • ExceptObject
  • ExceptAddr
  • AfterConstruction
  • BeforeDestruction
  • Dispatch
  • Message
  • DefaultHandler
  • NewInstance
  • FreeInstance
  • Destroy
  • TObjecth
  • TCustomAttribute
  • WeakAttribute
  • UnsafeAttribute
  • UnsafeAttribute@!@
  • VolatileAttribute
  • HPPGENAttribute5
  • AData
  • AFlag
  • HPPGENAttribute
  • PMonitorT$@
  • TMonitor.PWaitingThread
  • TMonitor.TWaitingThread
  • Next
  • Thread
  • WaitEvent
  • TMonitor.TSpinLock
  • Enter
  • Exit
  • TMonitor
  • FLockCount
  • FRecursionCount
  • FOwningThread
  • FLockEvent
  • FSpinCount
  • SetSpinCount
  • ASpinCount
  • Timeout
  • TryEnter
  • Wait
  • ALock
  • Pulse
  • PulseAll
  • IInterface
  • IEnumerable
  • IDispatch
  • FRefCount
  • TInterfacedObject1
  • TInterfacedObject
  • RefCount
  • PShortString
  • UTF8String
  • RawByteString
  • PByte
  • PInt64
  • PExtended
  • PCurrency
  • PVariant
  • PPointer
  • TDateTime
  • TDate
  • TVarArrayBound
  • ElementCount
  • LowBound
  • TVarArrayBoundArray
  • PVarArray
  • TVarArray
  • DimCount
  • Flags
  • ElementSize
  • LockCount
  • Bounds
  • TVarRecord
  • PRecord
  • RecInfo
  • TVarData
  • VType
  • Reserved1
  • Reserved2
  • Reserved3
  • VSmallInt
  • VInteger
  • VSingle
  • VDouble
  • VCurrency
  • VDate
  • VOleStr
  • VDispatch
  • VError
  • VBoolean
  • VShortInt
  • VByte
  • VWord
  • VLongWord
  • VUInt32
  • VInt64
  • VUInt64
  • VString
  • VAny
  • VArray
  • VPointer
  • VUString

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x4a7ed055pushebp
0x4a7ed18becmovebp, esp
0x4a7ed383c4a4addesp, -0x5c
0x4a7ed653pushebx
0x4a7ed756pushesi
0x4a7ed857pushedi
0x4a7ed933c0xoreax, eax
0x4a7edb8945c4movdword ptr [ebp - 0x3c], eax
0x4a7ede8945c0movdword ptr [ebp - 0x40], eax
0x4a7ee18945a4movdword ptr [ebp - 0x5c], eax
0x4a7ee48945d0movdword ptr [ebp - 0x30], eax
0x4a7ee78945c8movdword ptr [ebp - 0x38], eax
0x4a7eea8945ccmovdword ptr [ebp - 0x34], eax
0x4a7eed8945d4movdword ptr [ebp - 0x2c], eax
0x4a7ef08945d8movdword ptr [ebp - 0x28], eax
0x4a7ef38945ecmovdword ptr [ebp - 0x14], eax
0x4a7ef6b8c42b4a00moveax, 0x4a2bc4
0x4a7efbe80856f6ffcall0x40d508
0x4a7f0033c0xoreax, eax
0x4a7f0255pushebp
0x4a7f0368c2854a00push0x4a85c2
0x4a7f0864ff30pushdword ptr fs:[eax]
0x4a7f0b648920movdword ptr fs:[eax], esp
0x4a7f0e33d2xoredx, edx
0x4a7f1055pushebp
0x4a7f11687e854a00push0x4a857e
0x4a7f1664ff32pushdword ptr fs:[edx]
0x4a7f19648922movdword ptr fs:[edx], esp
0x4a7f1ca134064b00moveax, dword ptr [0x4b0634]
0x4a7f21e80697ffffcall0x4a162c
0x4a7f26e85d92ffffcall0x4a1188
0x4a7f2b8d55ecleaedx, [ebp - 0x14]
0x4a7f2e33c0xoreax, eax
0x4a7f30e833acf7ffcall0x422b68
0x4a7f358b55ecmovedx, dword ptr [ebp - 0x14]
0x4a7f38b814374b00moveax, 0x4b3714
0x4a7f3de892fef5ffcall0x407dd4
0x4a7f426a02push2
0x4a7f446a00push0
0x4a7f466a01push1
0x4a7f488b0d14374b00movecx, dword ptr [0x4b3714]
0x4a7f4eb201movdl, 1
0x4a7f50a198364200moveax, dword ptr [0x423698]
0x4a7f55e89abcf7ffcall0x423bf4
0x4a7f5aa318374b00movdword ptr [0x4b3718], eax
0x4a7f5f33d2xoredx, edx
0x4a7f6155pushebp
0x4a7f62682a854a00push0x4a852a
0x4a7f6764ff32pushdword ptr fs:[edx]
0x4a7f6a648922movdword ptr fs:[edx], esp
0x4a7f6de88e97ffffcall0x4a1700
0x4a7f72a320374b00movdword ptr [0x4b3720], eax
0x4a7f77a120374b00moveax, dword ptr [0x4b3720]
0x4a7f7c83780c01cmpdword ptr [eax + 0xc], 1
0x4a7f807548jne0x4a7fca
0x4a7f82a120374b00moveax, dword ptr [0x4b3720]
0x4a7f87ba28000000movedx, 0x28
0x4a7f8ce88fc5f7ffcall0x424520
0x4a7f918b1520374b00movedx, dword ptr [0x4b3720]
0x4a7f973b4228cmpeax, dword ptr [edx + 0x28]
callbranchretstackarithregisterimmediatememory

Installer package analysis

3 packaged files
Packagescript-driven installer (setup data 6.0.0 (unicode))
NameAuto Fishing Clash v2.6.3.0 6.0.0
Contents listed3 entries
Password protectedno
Languages
default
Packaged contents (3)
PathSizeDigest
C$/Fishing LdPlayer/Auto Fishing Clash.exe 29.5 MiB afcd6eeba9dbfe4edc9…
C$/Fishing LdPlayer/eng.traineddata 22.4 MiB 007b522901a665bc203…
C$/Fishing LdPlayer/ievision.dll 21.9 MiB 46d1064ca70033d0d5c…

Import fingerprint

3 related samples
Fingerprint48:ukHAxN9RJjD3vF9X1RfOz9O1hr8XNVXGSHAS4Fo/g/vEj5MlVNb7q/cE:ukH+NbJj7N9X1tOz9Yhr8XbMlVNb7CcE
Imports read137 functions from 7 libraries (137 distinct)
Comparableyes
Compared against7 stored samples
Samples built on the same import table (3)

An identical import table survives repacking, so a high score usually means the same code rebuilt. It is corroboration, not a verdict of its own.

ScoreSampleVerdict
100 13e2ef2b923691986ebf894… suspicious
100 13e2ef2b923691986ebf894… suspicious
100 13e2ef2b923691986ebf894… suspicious

Screen recording

11 frames · screen recording · 76s · ended early

The run was ended early from the console, so the recording covers only the 76s the sample actually ran.

Screen recording frame
1 / 11
0:00 · 1/11
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 75s · ended early

4 process(es) observed

LaunchedC:\Users\user\Desktop\AutoFishing.exe
Privilegestandard
Telemetry sources: Kernel ETW (0 events) agent poll: 4

Evasion / anti-analysis checks

9 checks
MED
System Checks Capability analysis
MITRE T1497
MED
Check for time delay via GetTickCount Capability rule
MITRE T1622 · Debugger detection
MED
Reference anti-VM strings targeting Qemu Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Reference anti-VM strings targeting Xen Capability rule
MITRE T1497.001 · Virtual-machine detection
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis
MED
Debugger Detection::Process Environment Block Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Debugger Detection::Timing/Delay Check GetTickCount Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Dynamic Analysis Evasion::Delayed Execution Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis
MED
Virtual Machine Detection Capability taxonomy
MITRE T1497 · Anti-Behavioral Analysis

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Command lines, unwrapped

4 read

4 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

4processes
2registry operations

AutoFishing.exe

4 processes
4 processes

Attributed activity

0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 2 registry · sample scope
OperationTargetProcess
create
\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\WBEM\CIMOM
 AutoFishing.tmp pid 1940
create
\REGISTRY\MACHINE\Software\WOW6432Node
 AutoFishing.tmp pid 1940

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

1 reported a hit 9 answered no 13 had nothing to check
1Sources with a hit
10Sources queriedof 23 available
470.5kFeed records
0Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 2,934 records
39 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
4 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,146 records
39 minutes ago
URLhaus payload hashes File hash clean not in feed 1,658 records
39 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check
SourceChecksResultDetailFeed
blocklist.de IP / domain / URL not checked no IP, domain or URL observed to check 27.6k records
39 minutes ago
CINS Army IP / domain / URL not checked no IP, domain or URL observed to check 15k records
39 minutes ago
Emerging Threats IP / domain / URL not checked no IP, domain or URL observed to check 482 records
39 minutes ago
Feodo Tracker IP / domain / URL not checked no IP, domain or URL observed to check 5 records
39 minutes ago
IPsum IP / domain / URL not checked no IP, domain or URL observed to check 19.7k records
39 minutes ago
Phishing.Database IP / domain / URL not checked no IP, domain or URL observed to check 391.5k records
4 hours ago
ThreatFox IP / domain / URL not checked no IP, domain or URL observed to check 1,146 records
39 minutes ago
URLhaus IP / domain / URL not checked no IP, domain or URL observed to check no records ingested

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
11 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

1 of 2 listed
SourceChecksResultDetailFeed
Signature rules Sample content 1 match possible_includes_base64_packed_functions 110 records
39 minutes ago
Sigma rules Behavior log clean - 2,275 records
6 hours ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 4 process image paths, none masqueraded 245 records
39 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
38 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
39 minutes ago
LOLRMM Names and domains clean 5 name/domain indicators checked, no remote-management tooling 360 records
39 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 3 info

File indicators

3
SeverityTypeIndicatorDescription
info sample_sha256 f88b4200079dca27da65cd2b6f4eba73aace4fa13058269a2eac9ae95b044509 Submitted sample (SHA256)
info sample_md5 e57adaeac1dffb7c672d91a64c6a9f11 Submitted sample (MD5)
info imphash eb5bc6ff6263b364dfbfb78bdb48ed59 Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2696_sigma_reg

Auto-generated
title: Auto-generated registry behavior rule (sandbox scan 2696)
id: sandbox-auto-2696-reg
status: experimental
description: Auto-generated from sandbox scan 2696
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - '\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\WBEM\CIMOM'
            - '\REGISTRY\MACHINE\Software\WOW6432Node'
    condition: selection
level: medium

YARA: auto_file_2696_yara

Auto-generated
import "pe"

rule auto_file_2696_yara
{
    meta:
        description = "Auto-generated from scan 2696"
        author = "sandbox auto-generator"
        imphash = "eb5bc6ff6263b364dfbfb78bdb48ed59"
    condition:
        uint16(0) == 0x5a4d and filesize < 137331336 and pe.imphash() == "eb5bc6ff6263b364dfbfb78bdb48ed59"
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2696

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run
SubmittedEnvironmentVerdictScore
2026-10-09 11:42 Shown below Windows 10 22H2 Suspicious 35/100