AoiChan.exetigerrat analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

31.7sto launch

1telemetry events

1observed

42agent notes

Suspicious

35/100

0 points past the suspicious line at 35, 35 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+35

Malware family

Identified as Tiger RAT (possible confidence, named by static_yara)

Model review

findings review (advisory, not scored): suspicious - signature family match, unity-packaged pe, discovery apis, process execution only

Model reading

Measured SUSPICIOUS35 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran no points

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution18s (ended early)

Guest hardware2 vCPU4095 MB RAM

Malware family

1 independent source

Tiger RAT possible

Named by a single source. Treat it as a lead rather than a classification.

Layer	Source	What it matched
static_yara	rule corpus	TigerRAT_pe_yaraify

Detection signatures

1 detected · 7 withheld as common

Severity	Detection	Evidence	Layer
MED	Anti-analysis strings present MITRE T1497	string isdebuggerpresent matched string	static

Withheld: 7 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software

Anti-debugging capability fires on 65% of benign software

Dynamic API resolution (obfuscation) fires on 65% of benign software

Anti-debug: checks for a debugger fires on 60% of benign software

Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software

Reads its own startup info (parent/desktop check) fires on 36% of benign software

Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	not tested - the autostart surfaces were snapshotted before the sample ran, but this run left no record of the comparison afterwards, so an empty result cannot be read as a clean one
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	none observed
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Anti-analysis / evasion checks	not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	not measured	Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence	not measured	Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads	not measured	Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Microsoft Visual C/C++(19.36.34433)[C++]

Not packed Unsigned

CompilerMicrosoft Visual C/C++(19.36.34433)[C++]

LinkerMicrosoft Linker(14.36.34433)

Identity

File

typeexecutable

size652.0 KB

file arch64-bit (x64)

subsystemGUI

entropy5.6902

date2025-12-06 04:43:04 UTC

version6000.3.1.3609645

languageEN

Antivirus engine

no signature matched signature set 28160 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28160
Signatures in the set	3,642,883
Set published	21 Oct 2026 06:25 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

4.3 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 4.3 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural feature	What it means	Pushes	Weight
image flag dll	Image flag: a library rather than a program	towards malicious	+1.1886
parser warning: Suspicious flags set for section...	Header defect reported by the parse: Suspicious flags set for section... (0)	towards benign	-0.8525
debug directory size	Size of the debug table (84)	towards benign	-0.7657
resource directory size	Size of the resource table (565272)	towards benign	-0.4916
optional.minor_linker_version	Version of the linker that produced the file (minor) (42)	towards malicious	+0.4867
optional.checksum	Header checksum, which is zero on most files that were never signed (0)	towards malicious	+0.4225
export directory size	Size of the export table	towards benign	-0.3408
debug directory address	Location of the debug table (88336)	towards benign	-0.2449

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing

Not packed

This file's code is readable on disk - nothing is compressed or encrypted around it.

0/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed

No packer indicator fired: the entry point, the section layout and the entropy all read as an ordinary build.

Family configuration search

Incomplete

1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available	69
Returned a result	1
Failed to decode	1

Secrets & malicious strings

1 flagged string

Flagged string categories

anti-analysis / evasion med 1 hit

Indicator	Found in	Evidence from the sample
isdebuggerpresent	import table	KERNEL32.dll!IsDebuggerPresent

Capabilities

4 behaviour buckets · 1 high-risk

Severity	Capability	MITRE	APIs
high	Anti-debugging Detects or obstructs a debugger	T1622	isdebuggerpresent
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497, T1497.003	getsystemtimeasfiletime, queryperformancecounter
med	Dynamic API resolution Resolves APIs at runtime (obfuscation)	T1129	getprocaddress
med	Ransomware behaviour Enumerates + encrypts files, deletes backups	T1083	findnextfilew

Security mitigations

partial posture

ON ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Rich header (toolchain)

richhash a1c1113c5e427d9a

Tool	Build	Uses
Utc1900 (VS2017)	28900	5
Export 14.10	28900	138
Cvtres 14.10	28900	10
Utc1900 (VS2017)	28900	2
Utc1900 (VS2017)	34321	9
Cvtres 14.10	34321	16
Export 14.10	34321	40
Utc1900 (VS2017)	34433	3
Import (linker)	0	89
Export 14.10	34433	2
Alias	34433	1
Implib	34433	1
AliasObj 14.10	34433	1

Sections

6 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	51.5 KB	51.4 KB	EXECUTEREAD	6.4502
.rdata Read-only data	0xe000	38.0 KB	37.9 KB	READ	4.6923
.data Initialised data	0x18000	3.0 KB	7.4 KB expands	READWRITE	1.9077
.pdata Exception unwind data	0x1a000	4.0 KB	3.7 KB	READ	4.6021
.rsrc Resources	0x1b000	552.5 KB	552.0 KB	READ	5.5192
.reloc Base relocations	0xa6000	2.0 KB	1.6 KB	READ	4.8674

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

72 funcs / 2 DLLs · 4 suspicious

▸UnityPlayer.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
UnityMain2	0x0000e240	-	-

▸KERNEL32.dll71 funcs 4 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
HeapAlloc	0x0000e000	-	-
WriteConsoleW	0x0000e008	-	-
QueryPerformanceCounter	0x0000e010	-	T1497
GetCurrentProcessId	0x0000e018	-	-
GetCurrentThreadId	0x0000e020	-	-
GetSystemTimeAsFileTime	0x0000e028	-	-
InitializeSListHead	0x0000e030	-	-
RtlCaptureContext	0x0000e038	yes	-
RtlLookupFunctionEntry	0x0000e040	yes	-
RtlVirtualUnwind	0x0000e048	yes	-
IsDebuggerPresent	0x0000e050	-	T1622
UnhandledExceptionFilter	0x0000e058	-	-
SetUnhandledExceptionFilter	0x0000e060	-	-
GetStartupInfoW	0x0000e068	-	-
IsProcessorFeaturePresent	0x0000e070	-	-
GetModuleHandleW	0x0000e078	-	-
CloseHandle	0x0000e080	-	-
RtlUnwindEx	0x0000e088	yes	-
GetLastError	0x0000e090	-	-
SetLastError	0x0000e098	-	-
EnterCriticalSection	0x0000e0a0	-	-
LeaveCriticalSection	0x0000e0a8	-	-
DeleteCriticalSection	0x0000e0b0	-	-
InitializeCriticalSectionAndSpinCount	0x0000e0b8	-	-
TlsAlloc	0x0000e0c0	-	-
TlsGetValue	0x0000e0c8	-	-
TlsSetValue	0x0000e0d0	-	-
TlsFree	0x0000e0d8	-	-
FreeLibrary	0x0000e0e0	-	-
GetProcAddress	0x0000e0e8	-	T1129
LoadLibraryExW	0x0000e0f0	-	-
EncodePointer	0x0000e0f8	-	-
RaiseException	0x0000e100	-	-
RtlPcToFileHeader	0x0000e108	yes	-
GetStdHandle	0x0000e110	-	-
WriteFile	0x0000e118	-	-
GetModuleFileNameW	0x0000e120	-	-
GetCurrentProcess	0x0000e128	-	-
ExitProcess	0x0000e130	-	-
TerminateProcess	0x0000e138	-	-
GetModuleHandleExW	0x0000e140	-	-
HeapFree	0x0000e148	-	-
FindClose	0x0000e150	-	-
FindFirstFileExW	0x0000e158	-	-
FindNextFileW	0x0000e160	-	T1083
IsValidCodePage	0x0000e168	-	-
GetACP	0x0000e170	-	-
GetOEMCP	0x0000e178	-	-
GetCPInfo	0x0000e180	-	-
GetCommandLineA	0x0000e188	-	-
GetCommandLineW	0x0000e190	-	-
MultiByteToWideChar	0x0000e198	-	-
WideCharToMultiByte	0x0000e1a0	-	-
GetEnvironmentStringsW	0x0000e1a8	-	-
FreeEnvironmentStringsW	0x0000e1b0	-	-
SetStdHandle	0x0000e1b8	-	-
GetFileType	0x0000e1c0	-	-
GetStringTypeW	0x0000e1c8	-	-
FlsAlloc	0x0000e1d0	-	-
FlsGetValue	0x0000e1d8	-	-
FlsSetValue	0x0000e1e0	-	-
FlsFree	0x0000e1e8	-	-
LCMapStringW	0x0000e1f0	-	-
GetProcessHeap	0x0000e1f8	-	-
HeapSize	0x0000e200	-	-
HeapReAlloc	0x0000e208	-	-
FlushFileBuffers	0x0000e210	-	-
GetConsoleOutputCP	0x0000e218	-	-
GetConsoleMode	0x0000e220	-	-
SetFilePointerEx	0x0000e228	-	-
CreateFileW	0x0000e230	-	-

Binary metadata

what the headers declare about this build

Resource langs	EN
Debug info	yes
TLS callbacks	no

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Resources

Resource Hacker view

Group Icon1Icon9Manifest1Version Info1

▸Group Icon1

103EN

▸Icon9

1EN

2EN

3EN

4EN

5EN

6EN

7EN

8EN

9EN

▸Manifest1

1EN

▸Version Info1

1EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Group Icon 103 Download

Type	Group Icon
Name / ID	103
Language	EN
Size	132.0 B
RVA offset	0xa4838
Content signature	Icon
MD5	3bf2dac037ce87794e66ff7f054e913f
Entropy	3.045

Icon 1 Download

Type	Icon
Name / ID	1
Language	EN
Size	1.1 KB
RVA offset	0x1b2b0
Content signature	Icon
MD5	829da016ddc182a3e7695d007da47110
Entropy	6.267

Icon 2 Download

Type	Icon
Name / ID	2
Language	EN
Size	2.4 KB
RVA offset	0x1b718
Content signature	Icon
MD5	c350d6e4f6e0368daf8bf2f7180ea303
Entropy	6.2

Icon 3 Download

Type	Icon
Name / ID	3
Language	EN
Size	4.2 KB
RVA offset	0x1c0a0
Content signature	Icon
MD5	4772ace8bc0fedaee3059432a7ef302a
Entropy	6.111

Icon 4 Download

Type	Icon
Name / ID	4
Language	EN
Size	9.4 KB
RVA offset	0x1d148
Content signature	Icon
MD5	532a2d9c83d600fbad895dc9d19b7530
Entropy	5.919

Icon 5 Download

Type	Icon
Name / ID	5
Language	EN
Size	16.5 KB
RVA offset	0x1f6f0
Content signature	Icon
MD5	1f21a233f2f2f39e5181905b381bff6f
Entropy	5.832

Icon 6 Download

Type	Icon
Name / ID	6
Language	EN
Size	37.2 KB
RVA offset	0x23918
Content signature	Icon
MD5	3a557f5a43d715c5ba7c9d2a67e164df
Entropy	5.684

Icon 7 Download

Type	Icon
Name / ID	7
Language	EN
Size	66.0 KB
RVA offset	0x2cdc0
Content signature	Icon
MD5	81b2e2518f75730b9289de75f9b119f7
Entropy	5.576

Icon 8 Download

Type	Icon
Name / ID	8
Language	EN
Size	148.5 KB
RVA offset	0x3d5e8
Content signature	Icon
MD5	626f0c8172cc86f1d1dbf6084886331a
Entropy	5.476

Icon 9 Download

Type	Icon
Name / ID	9
Language	EN
Size	264.0 KB
RVA offset	0x62810
Content signature	Icon
MD5	1b36113d85a1beb9a99e2fa066696fe8
Entropy	5.418

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	EN
Size	1.3 KB
RVA offset	0xa48c0
Content signature	XML manifest
MD5	9df530c2f4fbe460da74e130d5d351a9
Entropy	5.25

Application manifest

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">
	<assemblyIdentity version="1.0.0.0" processorArchitecture="*" name="UnityTechnologies.Unity.UnityPlayer" type="win32"/>
	<description>Unity</description>
	<dependency>
		<dependentAssembly>
			<assemblyIdentity
					type="win32" name="Microsoft.Windows.Common-Controls"
					version="6.0.0.0" processorArchitecture="*" publicKeyToken="6595b64144ccf1df"
					language="*"
        />
		</dependentAssembly>
	</dependency>
	<trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
		<security>
			<requestedPrivileges>
				<requestedExecutionLevel
						level="asInvoker"
						uiAccess="false"
									/>
			</requestedPrivileges>
		</security>
	</trustInfo>
	<compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
		<application>
			<!-- Windows 10 -->
			<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>
		</application>
	</compatibility>
	<application xmlns="urn:schemas-microsoft-com:asm.v3">
		<windowsSettings>
			<dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">True/PM</dpiAware>
			<dpiAwareness xmlns="http://schemas.microsoft.com/SMI/2016/WindowsSettings">PerMonitorV2</dpiAwareness>
		</windowsSettings>
	</application>
</assembly>

Version Info 1 Download

Type	Version Info
Name / ID	1
Language	EN
Size	524.0 B
RVA offset	0xa4e08
Content signature	Version Info
MD5	22573300d184b089de195b1fc63305f6
Entropy	3.54

Parsed version info

FileVersion	6000.3.1.3609645
LegalCopyright	(c) 2005-2025 Unity Technologies. All rights reserved.
ProductVersion	6000.3.1f1 (37142da19a94)

Similar samples

1 related sample

Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

Relation	Sample	Verdict	Why it matched
related	Data Center.exe	Suspicious	identical import table (imphash) · identical export table (exphash)

Threat classification

Signature family candidates

Family	Agreeing rules	Matched rules	Disposition
Tiger RAT	1	TigerRAT_pe_yaraify	Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

Capability detection

9 capabilities

Capability	Namespace
link function at runtime on Windows	linking/runtime-linking
parse PE header	load-code/pe
contain loop	-
terminate process	host-interaction/process/terminate
enumerate files on Windows	host-interaction/file-system/files/list
query environment variable	host-interaction/environment-variable
write file on Windows	host-interaction/file-system/write
reference analysis tools strings	anti-analysis
contains PDB path	executable/pe/pdb

ATT&CK techniques

Discovery::File and Directory Discovery [T1083]Discovery::System Information Discovery [T1082]Execution::Shared Modules [T1129]

Malware Behavior Catalog

Discovery::Analysis Tool Discovery::Process detectionDiscovery::File and Directory DiscoveryDiscovery::System Information DiscoveryFile System::Writes FileProcess::Terminate Process

Signature matches

1 finding · 4 file properties · 0 scored

Rule	What it matched	Corpus	Weight
TigerRAT_pe_yaraify rule dated 2026-08-21	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits 1 of 1 string matched $c0 \x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed at 0x2b4e	Tier 1 - curated family set licence-gated and benign-tested; may name a malware family	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it. Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.

File properties - not findings

IsPE64IsWindowsGUIHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 200 of 374

!This program cannot be run in DOS mode.
yRichR
.text
`.rdata
@.data
.pdata
@.rsrc
@.reloc
ineIA
ntelD
Genu
VWATAVAWH
@USVWATAUAVAWH
p AWL
l$ VWATAVAWH
\$ VWATAUAVH
ATAUAVH
VWATAVAW
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`RTTI
`local vftable'
`local vftable constructor closure'
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
operator<=>
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
`anonymous namespace'
FlsAlloc
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
Unknown exception
bad exception
CorExitProcess
Monday
Wednesday
Thursday
Friday
Saturday
January
March
April
June
July
August
September
October
November
December
LCMapStringEx
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
=imb;D
K&>.yC
.xJ>Hf
C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_MT_nondev_m_r\WindowsPlayer_player_Master_mono_x64.pdb
.text$mn
.text$mn$00
.text$mn$21
.text$x
.idata$5
.CRT$XCA
.CRT$XCAA
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$00
.rdata$r
.rdata$voltmd
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata
.xdata$x
.edata
.idata$2
.idata$3
.idata$4
.idata$6
.data
.data$r
.data$rs
.bss
.rsrc$01
.rsrc$02
WindowsPlayer.exe
AmdPowerXpressRequestHighPerformance
D3D12SDKPath
D3D12SDKVersion
NvOptimusEnablement
UnityMain2
UnityPlayer.dll
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
KERNEL32.dll
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
GetCurrentProcess
ExitProcess
TerminateProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW

Stack and decoded strings were not recovered: no reason was recorded. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x1400012644883ec28subrsp, 0x28

0x140001268e84b020000call0x1400014b8

0x14000126d4883c428addrsp, 0x28

0x140001271e97afeffffjmp0x1400010f0

0x140001276ccint3

0x140001277ccint3

0x1400012784883ec28subrsp, 0x28

0x14000127ce8ef080000call0x140001b70

0x14000128185c0testeax, eax

0x1400012837421je0x1400012a6

0x14000128565488b042530000000movrax, qword ptr gs:[0x30]

0x14000128e488b4808movrcx, qword ptr [rax + 8]

0x140001292eb05jmp0x140001299

0x140001294483bc8cmprcx, rax

0x1400012977414je0x1400012ad

0x14000129933c0xoreax, eax

0x14000129bf0480fb10d3c780100lock cmpxchgqword ptr [rip + 0x1783c], rcx

0x1400012a475eejne0x140001294

0x1400012a632c0xoral, al

0x1400012a84883c428addrsp, 0x28

0x1400012acc3ret

0x1400012adb001moval, 1

0x1400012afebf7jmp0x1400012a8

0x1400012b1ccint3

0x1400012b2ccint3

0x1400012b3ccint3

0x1400012b44883ec28subrsp, 0x28

0x1400012b885c9testecx, ecx

0x1400012ba7507jne0x1400012c3

0x1400012bcc6052578010001movbyte ptr [rip + 0x17825], 1

0x1400012c3e8dc050000call0x1400018a4

0x1400012c8e8cb0a0000call0x140001d98

0x1400012cd84c0testal, al

0x1400012cf7504jne0x1400012d5

0x1400012d132c0xoral, al

0x1400012d3eb14jmp0x1400012e9

0x1400012d5e8fa420000call0x1400055d4

0x1400012da84c0testal, al

0x1400012dc7509jne0x1400012e7

0x1400012de33c9xorecx, ecx

0x1400012e0e8db0a0000call0x140001dc0

0x1400012e5ebeajmp0x1400012d1

0x1400012e7b001moval, 1

0x1400012e94883c428addrsp, 0x28

0x1400012edc3ret

0x1400012eeccint3

0x1400012efccint3

0x1400012f04053pushrbx

0x1400012f24883ec20subrsp, 0x20

0x1400012f6803dec77010000cmpbyte ptr [rip + 0x177ec], 0

0x1400012fd8bd9movebx, ecx

0x1400012ff7567jne0x140001368

0x14000130183f901cmpecx, 1

0x140001304776aja0x140001370

0x140001306e865080000call0x140001b70

0x14000130b85c0testeax, eax

0x14000130d7428je0x140001337

0x14000130f85dbtestebx, ebx

0x1400013117524jne0x140001337

0x140001313488d0dd6770100learcx, [rip + 0x177d6]

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	24:9/S1o0qtQmlJnc+pl3eDo/CuY2uUSOovbO9Ziv8GGMf:9/S1YtQkc+ppmuYs3Av
Imports read	72 functions from 2 libraries (72 distinct)
Comparable	yes
Compared against	88 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

10 frames · screen recording · 18s · ended early

The run was ended early from the console, so the recording covers only the 18s the sample actually ran.

1 / 10

0:00 · 1/10

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 18s · ended early

1 process(es) observed

LaunchedC:\Users\user\Desktop\AoiChan.exe

Privilegestandard

Telemetry sources: Kernel ETW (0 events) 1 kernel-only process

Evasion / anti-analysis checks

4 checks

MED

Anti-debug API imports static-api

MITRE T1622 · isdebuggerpresent

MED

Reference analysis tools strings Capability rule

MITRE T1497 · Anti-analysis

MED

Anti-analysis strings (VM/debugger/tool names) strings

MITRE T1497 · isdebuggerpresent

LOW

CPUID hypervisor/feature probe static-instruction

MITRE T1497.001 · 6x cpuid - no timing or descriptor-table instruction beside it

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Command lines, unwrapped

nothing captured

The run captured no command line and no script block, so there was no text to unwrap. A sample that does its work in-process, and one that never started, both land here - which of the two this is, the process tree and the verdict answer.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

AoiChan.exe

1 process

Attributed activity

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 0 registry · sample scope

Files (0) Registry (0)

Operation	Target	Process

No file or registry operations captured.

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

1 reported a hit 16 answered no 1 could not answer 5 had nothing to check

1Sources with a hit

18Sources queriedof 23 available

470.6kFeed records

1Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	3,003 records 48 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 4 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,153 records 48 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,680 records 48 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer

Source	Checks	Result	Detail	Feed
URLhaus	IP / domain / URL	feed unavailable	4 observed indicators, none listed	no records ingested
blocklist.de	IP / domain / URL	clean	4 observed indicators, none listed	27.6k records 48 minutes ago
CINS Army	IP / domain / URL	clean	4 observed indicators, none listed	15k records 48 minutes ago
Emerging Threats	IP / domain / URL	clean	4 observed indicators, none listed	482 records 48 minutes ago
Feodo Tracker	IP / domain / URL	clean	4 observed indicators, none listed	5 records 48 minutes ago
IPsum	IP / domain / URL	clean	4 observed indicators, none listed	19.7k records 48 minutes ago
Phishing.Database	IP / domain / URL	clean	4 observed indicators, none listed	391.5k records 4 hours ago
ThreatFox	IP / domain / URL	clean	4 observed indicators, none listed	1,153 records 48 minutes ago

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 10 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
Signature rules	Sample content	1 match	TigerRAT_pe_yaraify	110 records 49 minutes ago
Sigma rules	Behavior log	clean	-	2,275 records 5 hours ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	1 process image path, none masqueraded	245 records 49 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 48 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 48 minutes ago
LOLRMM	Names and domains	clean	2 name/domain indicators checked, no remote-management tooling	360 records 48 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 0 info

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	6f07950d709e72050787dedd0939e487dd9b89f2ee0c0595010b1a140844f21b	Submitted sample (SHA256)
suspicious	sample_md5	3aca1b830c43b28cf3a100a066dc79ac	Submitted sample (MD5)
suspicious	imphash	a136217cdd3247ff6a8766561064ca0b	Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

YARA: auto_file_2893_yara

Auto-generated

rule auto_file_2893_yara
{
    meta:
        description = "Auto-generated from scan 2893"
        author = "sandbox auto-generator"
        imphash = "a136217cdd3247ff6a8766561064ca0b"
        anchors = "5 independent regions"
    strings:
        $s0 = "WindowsPlayer.exe" ascii fullword
        $s1 = "api-ms-win-core-datetime-l1-1-1" wide fullword
        $s2 = "AppPolicyGetProcessTerminationMethod" ascii fullword
        $s3 = "api-ms-win-core-xstate-l2-1-0" wide fullword
        $s4 = "api-ms-win-core-fibers-l1-1-1" wide fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 2670592 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2893

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-10-22 14:40 Shown below	Windows 10 22H2	Suspicious	35/100

AoiChan.exetigerrat analysis report - Suspicious

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Malware family

Detection signatures

What the tests returned

Arguing against malice

How much weight this carries

Instrument coverage

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Family configuration search

Secrets & malicious strings

Flagged string categories

Capabilities

Security mitigations

Rich header (toolchain)

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Similar samples

Threat classification

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Import fingerprint

Screen recording

Behavior summary

Evasion / anti-analysis checks

Command lines, unwrapped

Network activity

Process tree

AoiChan.exe

Attributed activity

Persistence mechanisms

No persistence established

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

Sigma detections

Generated rules

YARA: auto_file_2893_yara

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file