Malwagon
ZIP
arcadiawin32-1.0rc2.zip File Analysis · first seen Oct 22, 2026 17:22 · 9.2 MB
2proc 2reg 2IOCs
No threats detected0 Completed Public
Get sample Report Sign in

arcadiawin32-1.0rc2.zipZIP analysis report - No threats detected

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

42.2sto launch
48telemetry events
46observed
65agent notes

No threats detected

0/100

Nothing scored against this sample. A run reads as suspicious from 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+0
Model review
  • findings review (advisory, not scored): suspicious - regsvr32 dll execution, dns lookups to adult domains, no intel match

Model reading

Measured CLEAN0 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran no points
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/zip

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution141s
Guest hardware2 vCPU4095 MB RAM

Detection signatures

1 detected
Severity Detection Evidence Layer
MED
High file entropy (encrypted/compressed payload)
MITRE T1027
entropy 8.00 threshold 7.20, maximum 8.00
static

What the tests returned

9 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Payloads written to disknone observed
Network connectionsthe capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Capability analysis of the file's codenot checked
Anti-analysis / evasion checksnot measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.
  • High entropy here is the container's compression, not necessarily packing.

How much weight this carries

Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: the sample ran for 141s and no malicious behaviour was observed.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch not measured Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence not measured Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads not measured Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Unknown
No compiler or packer signature matched this file.
Not packed
Identity
File
typeZip archive data, at least v1.0 to extract, compression method=store
size9.2 MB
entropy7.9978

Antivirus engine

no signature matched signature set 28161 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28161
Signatures in the set3,642,894
Set published22 Oct 2026 06:24 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

no model score

No model score exists for this file: the local model reads Windows executables only, so this file got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

Structural rules of thumb, not a model. 1 cheap static signal fired, for 30 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

  • high entropy 7.9978
Packing
Not packed
Bytes are compressed because this is a ZIP container - that is the format, not concealment.
0/100
packer confidence
Detonation is the reliable read here A static pass cannot see through this file's own compression, so the verdict leans on what it does when it runs.
Indicators weighed 1 signal
  • ZIP container (entropy 7.9978 is the compression)

Family configuration search

Incomplete

4 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available69
Returned a result4
Failed to decode4

Capability detection

not run on this file

Capability detection reads the machine code of a compiled program and lists what that code is able to do. This submission is not a compiled program, so the check was not run on it and had nothing it could have found. Read this as a question that was not asked here, not as an answer about the file.

Extracted strings

showing 152
  • arcadiawin32-1.0rc2/UT
  • arcadiawin32-1.0rc2/arcadia.exeUT
  • 3f.su
  • hb4oLN
  • OTPD
  • FEE<*r
  • JNTt
  • cauI
  • #fp5rosKQN\e
  • DY.LW
  • RNam
  • plrA
  • Mjis
  • ntbE
  • .VfZ
  • RE%d
  • ntRZ
  • o& rtQ
  • ].Wd
  • LLC2{pf
  • N[.UF
  • ANLh
  • TFOE3S
  • V,@UHI
  • 1.dN:
  • ;ioDV
  • jucA
  • %dN-
  • aB.pE
  • y.RD
  • #rS)%l
  • Gdon
  • YLax
  • @.oR
  • S.VS
  • 3e.yi
  • b!PPA
  • WG.VvTT
  • o!%x
  • >%.kP
  • .rRa
  • AUR3O
  • xbMO/o(f>
  • RTRE
  • lcuL
  • zcoGR
  • 2>%u
  • H7KPEE
  • Nf_bp
  • Zk_PL
  • A7?OUxa
  • lAMZ
  • *f_iforx[
  • Lxet
  • &vnA#P
  • .Bc)
  • a%x(G
  • "C:\
  • KMac
  • x.pQ
  • FSur
  • ssar
  • >.jO?^
  • bPRM)
  • '3VBa,%x
  • U.KU
  • \rrmO7
  • ;LHOl_
  • Jfi7c
  • urMX
  • T1Urs
  • LKIn
  • byimf?
  • ;dhi:C
  • eiifu
  • ONIg
  • %ICae
  • k+Cume-c
  • )umr7ie
  • F{STMZ_
  • GHS<O
  • UTTo
  • sPTI
  • X[%d=
  • hnlA|
  • thn!u
  • iDPF
  • //yNU
  • ecb,q
  • eche
  • ECS4M&M1
  • Kj5.YQ
  • Q=OMe
  • NSicc}
  • otW:SN]
  • yjNS2
  • 5WAEn
  • 14LROy
  • Jfim
  • 3{AYHanT
  • >lA_Fe=I
  • k:.aUs
  • N"HAX
  • Atnb
  • TEJf
  • e)TMR
  • <unoQT
  • 8G>deCbmL
  • @\\R
  • ntMS
  • 69ww;hnDI
  • Algi;z
  • ?ANyzz
  • dG/.VE
  • ukeS|
  • 7.ku
  • .HDT
  • =STtz
  • .DWq
  • {ANIo
  • I.cp
  • xens
  • i.rd=
  • 8qVUL
  • ~Trgz7
  • GNgc
  • .xa|r
  • J.vJ
  • ITiy=]
  • x.Fe
  • NDCI
  • %xxU
  • Beka
  • fhof
  • Pea4u
  • /S4for
  • |w\\
  • :xmus
  • %\\#Z
  • ]yxTE
  • n^oOX
  • AHe\q
  • _.fw
  • uunS
  • ~qgm,uT0
  • >}%d:?n
  • yiuL
  • ujntP
  • .vwr
  • kLQO_Rv
  • momd
  • n@iOP

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Screen recording

60 frames · screen recording · 142s
Screen recording frame
1 / 60
0:00 · 1/60
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 141s

2 process(es) observed

Launchedregsvr32.exe /s "C:\Users\user\Desktop\QtGui4.dll"
Privilegestandard
Telemetry sources: Kernel ETW (28 of 295 events) Process audit: 2Autostart diff: 42

What ran is a file from inside the archive. The submission is arcadiawin32-1.0rc2.zip; the host unpacked it and detonated QtGui4.dll, one of 24 members (an executable image inside). The score, the hashes and the static analysis on this page are the archive's. Opening an archive in the guest runs the shell's handler and never the file inside it, so the alternative was a run with nothing in it.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 861 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

2 read

2 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

2processes
2registry operations

arcadiawin32-1.0rc2.zip

2 processes
2 processes

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations42
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 2 registry · sample scope
OperationTargetProcess
setvalue
System\CurrentControlSet\Services\PptpMiniport
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
Start = 2
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
DriverMajorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
DriverMinorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\PptpMiniport
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
NdisMinorVersion = 84
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndiswanlegacy
NdisMajorVersion = 5
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndiswanlegacy
NdisMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
DriverMajorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\PptpMiniport
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\NdisWan
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarpv6
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
NdisMinorVersion = 84
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
NdisMajorVersion = 6
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasAgileVpn
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasMan\Parameters
MiniportsInstalled = 65535
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasMan
Start = 2
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\Rasl2tp
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasPppoe
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\wanarp
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasMan
DelayedAutostart = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\PptpMiniport
DriverMinorVersion = 0
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\RasSstp
NdisMinorVersion = 30
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
DriverMajorVersion = 1
autostart diffautostart diff
 -
setvalue
System\CurrentControlSet\Services\ndproxy
NdisMajorVersion = 6
autostart diffautostart diff
 -
create
\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\StillImage\Trace
kernel trace
 regsvr32.exe pid 2672
create
\REGISTRY\MACHINE\SYSTEM\ControlSet001
kernel trace
 regsvr32.exe pid 2672

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

17 answered no 1 could not answer 5 had nothing to check
0Sources with a hit
18Sources queriedof 23 available
470.6kFeed records
1Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
52 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
4 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
52 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
52 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer
SourceChecksResultDetailFeed
URLhaus IP / domain / URL feed unavailable 4 observed indicators, none listed no records ingested
blocklist.de IP / domain / URL clean 4 observed indicators, none listed 27.6k records
52 minutes ago
CINS Army IP / domain / URL clean 4 observed indicators, none listed 15k records
52 minutes ago
Emerging Threats IP / domain / URL clean 4 observed indicators, none listed 482 records
52 minutes ago
Feodo Tracker IP / domain / URL clean 4 observed indicators, none listed 5 records
52 minutes ago
IPsum IP / domain / URL clean 4 observed indicators, none listed 19.7k records
52 minutes ago
Phishing.Database IP / domain / URL clean 4 observed indicators, none listed 391.5k records
4 hours ago
ThreatFox IP / domain / URL clean 4 observed indicators, none listed 1,153 records
52 minutes ago

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
10 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

2 clear
SourceChecksResultDetailFeed
Sigma rules Behavior log clean - 2,275 records
5 hours ago
Signature rules Sample content clean no rule matched 110 records
52 minutes ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 2 process image paths, none masqueraded 245 records
52 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
51 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
52 minutes ago
LOLRMM Names and domains clean 7 name/domain indicators checked, no remote-management tooling 360 records
52 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 2 info

File indicators

2
SeverityTypeIndicatorDescription
info sample_sha256 7bac619b22df4964503bda08ba99e675d5724186a03fdf2e0e2544266a8b39bd Submitted sample (SHA256)
info sample_md5 c6ccaba6c77104b198cd11bcd25d4a78 Submitted sample (MD5)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

Artifacts

17 files
TypeNameSizeWhat it isSHA-256Download
Extracted file QtGui4.dll 11.0 MB PEno detection c1ee9f502ede042600c75db8a1a1b9f3f2f178432d5ad203dab64d04e7e10172 ZIP
Extracted file QtCore4.dll 2.6 MB PEno detection 1b7e81992715b1e79e79cd16e9ecf1968ee6d9ade54706e2d964193c9de45713 ZIP
Extracted file QtSvg4.dll 437.0 KB PEno detection 59c1f7c50b7b18ff0e55a87542d11bfc767c53c1dba9dbc0179ccbae01227eab ZIP
Extracted file QtXml4.dll 498.5 KB PEno detection 0ebe0db82905ba3b5d7b56a558b6b9c9f797ca2244839555dd0eebd867417a3d ZIP
Extracted file arcadia.exe 3.1 MB PEno detection 54d323451c12bac68561e48634c14f326eadc68a4528c68e642a6a50c7bb8c84 ZIP
Extracted file iconv.dll 872.0 KB PEno detection aa9ec502e20b927d236e19036b40a5da5ddd4ae030553a6608f821becd646efb ZIP
Extracted file libcdt-4.dll 56.8 KB PEno detection fa328738e07a80a015f06c845751f32abfcc4ac93ea602a352619cf131349b3c ZIP
Extracted file libexpat.dll 140.0 KB PEno detection 5db5a53399d10b3b78172bc87806ad13937b86d11181bb67ba66088f9563c801 ZIP
Extracted file libgraph-4.dll 127.2 KB PEno detection 9ad3a9d03b9c1165aa55e5b4b84fecb719edb64aa270f5869366361e97058dbb ZIP
Extracted file libgvc-4.dll 1.5 MB PEno detection d55c8be4c31315c6ea191fd8f59df9a6f0c6c4db3d73c5b88922d185919e6963 ZIP
Extracted file libgvplugin_dot_layout-5.dll 293.8 KB PEno detection a6744d3ec095babaac3fef38cc76281fe482473d5f4e0442dda96990a7dfe23d ZIP
Extracted file libgvplugin_neato_layout-5.dll 621.0 KB PEno detection 76f9bb08d1d660f6d20dff9e6d05c6fb4f934d76ca54a0828cc32f42e641b065 ZIP
Extracted file libltdl-3.dll 459.2 KB PEno detection 4cea319de022b005c5ab9561dc54443dc8a4761d71875d4cf014868471c13331 ZIP
Extracted file libpathplan-4.dll 85.0 KB PEno detection 678a4eabad0145a8864b11edf3d4c9569e7cf6ae60e4d150b837cb8cd64db4e7 ZIP
Extracted file libxml2-2.dll 1.2 MB PEno detection 82e916ef03117f214bc3e870fefddd4fc422854c27bda75ab272bb0aac6b7a12 ZIP
Extracted file mingwm10.dll 15.6 KB PEno detection 15e64dbea73be5a44650f10780d8709fdbc41ec3ce695cef5c2bf67e58247909 ZIP
Extracted file zlib1.dll 58.5 KB PEno detection b09537250201236472ccd3caff5c0c12a5fad262e1e951350e9e5ed2a81d9dde ZIP

Export & download

/s/2903

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run
SubmittedEnvironmentVerdictScore
2026-10-22 17:22 Shown below Windows 10 22H2 No threats detected 0/100