SEYLIZ - FREE internal.vmp(1)(1).exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

47.3sto launch

11telemetry events

4observed

69agent notes

Suspicious

38/100

3 points past the suspicious line at 35, 32 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+38

Static analysis

Packed (unknown/custom, confidence 64)
1 high-risk capability(ies): sandbox evasion
Weak exploit-mitigation posture (no ASLR/DEP/CFG) and unsigned
Local ML score 100.0

Model review

findings review (advisory, not scored): suspicious - packed executable, vm detection capability, registry key creation, no network observed

Model reading

Measured SUSPICIOUS38 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran moved the score

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution139s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

2 detected

Severity	Detection	Evidence	Layer
MED	Packed with unknown/custom MITRE T1027.002	packer unknown/custom packer identification entropy 7.72 file entropy (8.0 = random)	static
MED	Weak exploit mitigations and unsigned MITRE T1027	mitigation posture: weak signature unsigned	static

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	none established at runtime
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	none observed
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Anti-analysis / evasion checks	none observed

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: packing detected.

Instrument coverage

3 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	measured	Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
API call sequence	measured	Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else.
Explicit module loads	measured	Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

VMProtect(2.XX-3.XX)

Packed VMProtect(2.XX-3.XX) Unsigned

LibraryMicrosoft C/C++ Runtime[dynamic]

Identity

File

typeexecutable

size16.6 MB

file arch64-bit (x64)

subsystemConsole

entropy7.7208

date2026-10-20 19:11:36 UTC

languageEN

Antivirus engine

no signature matched signature set 28162 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28162
Signatures in the set	3,642,894
Set published	23 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

100.0 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 100.0 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural feature	What it means	Pushes	Weight
section size .nigga2	Size of section .nigga2	towards malicious	+1.1953
readable executable sections	Sections marked both readable and executable (3)	towards malicious	+1.0161
image flag dll	Image flag: a library rather than a program	towards malicious	+0.8285
section entropy .nigga2	Byte randomness of section .nigga2	towards malicious	+0.4802
resource directory size	Size of the resource table (480)	towards malicious	+0.4246
parser warning: Suspicious flags set for section...	Header defect reported by the parse: Suspicious flags set for section... (0)	towards benign	-0.4054
feature column 2478	When a timestamp authority countersigned the signature	towards malicious	+0.3495
optional.checksum	Header checksum, which is zero on most files that were never signed (0)	towards malicious	+0.3082

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing

Packed with unknown/custom

Packed code is compressed or encrypted on disk and only appears once the sample runs.

64/100

packer confidence

Detonation is the reliable read here A packed file hides its behaviour from a static pass, so the verdict leans on what it does when it runs.

Evidence 6 signals

Executable section '.text' has zero raw size (unpack target)
Executable section '.nigga0' has zero raw size (unpack target)
Executable-section entropy 7.72 (encrypted/packed)
Unusually few imports (13)
Entry point in non-code section '.nigga2'
Non-standard section names: .nigga0, .nigga1, .nigga2

Family configuration search

Not attempted

The sample is 16.6 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

Sample size	16.6 MB
Bound	16.0 MB
Limit reached	Sample size, before any parser was loaded.

Capabilities

1 behaviour bucket

Severity	Capability	MITRE	APIs
low	Registry manipulation Reads / writes the registry	T1112	regcreatekeyexw

Security mitigations

weak posture

OFF ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Atypical for a benign modern build - common in packed/repacked malware.

Sections

8 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.text Executable code	0x1000	0.0 B	31.9 KB expands	EXECUTEREAD	0.0
.rdata Read-only data	0x9000	0.0 B	18.2 KB expands	READ	0.0
.data Initialised data	0xe000	0.0 B	757.6 KB expands	READWRITE	0.0
.pdata Exception unwind data	0xcc000	0.0 B	1.9 KB	READ	0.0
.nigga0 Non-standard section	0xcd000	0.0 B	9.9 MB expands	EXECUTEREAD	0.0
.nigga1 Non-standard section	0xac0000	512.0 B	264.0 B	READWRITE	0.8165
.nigga2EP Non-standard section	0xac1000	16.6 MB	16.6 MB	EXECUTEREAD	7.7211
.rsrc Resources	0x1b58000	512.0 B	480.0 B	READ	4.7749

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

13 funcs / 13 DLLs

▸KERNEL32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetConsoleWindow	0x00ac0000	-	-

▸USER32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
SetLayeredWindowAttributes	0x00ac0010	-	-

▸ADVAPI32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
RegCreateKeyExW	0x00ac0020	-	-

▸SHELL32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
SHCreateDirectoryExW	0x00ac0030	-	-

▸MSVCP140.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z	0x00ac0040	-	-

▸VCRUNTIME140_1.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__CxxFrameHandler4	0x00ac0050	-	-

▸VCRUNTIME140.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__current_exception_context	0x00ac0060	-	-

▸api-ms-win-crt-stdio-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
fgetpos	0x00ac0070	-	-

▸api-ms-win-crt-heap-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
free	0x00ac0080	-	-

▸api-ms-win-crt-runtime-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_register_thread_local_exe_atexit_callback	0x00ac0090	-	-

▸api-ms-win-crt-filesystem-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_lock_file	0x00ac00a0	-	-

▸api-ms-win-crt-math-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
__setusermatherr	0x00ac00b0	-	-

▸api-ms-win-crt-locale-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
_configthreadlocale	0x00ac00c0	-	-

Binary metadata

what the headers declare about this build

Resource langs	EN
Debug info	no
TLS callbacks	no

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Resources

Resource Hacker view

Manifest1

▸Manifest1

1EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Manifest 1 Download

Type	Manifest
Name / ID	1
Language	EN
Size	392.0 B
RVA offset	0x1b58058
Content signature	XML manifest
MD5	b8e76ddb52d0eb41e972599ff3ca431b
Entropy	4.896

Application manifest

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='requireAdministrator' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Capability detection

2 capabilities

Capability	Namespace
reference analysis tools strings	anti-analysis
reference anti-VM strings targeting Xen	anti-analysis/anti-vm/vm-detection

ATT&CK techniques

Defense Evasion::Virtualization/Sandbox Evasion::System Checks [T1497.001]

Malware Behavior Catalog

Anti-Behavioral Analysis::Virtual Machine DetectionDiscovery::Analysis Tool Discovery::Process detection

Signature matches

1 finding · 3 file properties · 0 scored

Rule	What it matched	Corpus	Weight
maldoc_getEIP_method_1 maldoc	No description 1 of 1 string matched $a \xe8\x00\x00\x00\x00Y at 0xa0791d · 900 hits	Tier 3 - community corpus casts no family vote; every measured false family match came from here	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it.

File properties - not findings

IsPE64IsConsoleIsPacked

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 151

!This program cannot be run in DOS mode.
.text
`.rdata
@.data
.pdata
h.rsrc
MR.Yh
__current_exception_context
Qss;y r
,.sB
9]DArw
gfOI
m%s<
6ROEC=
YCNco
".Xr.
[.nq
SSQA
utn?v
3=%uO
ATAPH
_configthreadlocale
&s.FLp
%x9Os
.Iq@
}.bG
rixr
Tn_HqB
N.iw
+Q%s
jardz
%uuh
|usDN
alt.h
aTI9R
AXID8
ATAUAVfA
anuH
APAR
ESTc
KLAO
kqND
qqND
h}J.pzW\+@
odbE'
(nUSM
diXV
STOWOL
3.Up
EDIl
meuu
Aatm
o.Kr
~IA%s
ZXOHo
i?NEN
wnoam
r".uF
qzTI
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
Dfoq7
XVns
cvHAQ|
Xg\\
,ESmw
Npw.jD
WSiq0[
COYa
bsbE
Litk
l39eOX
jSOK
"6>.Kp(
-iXL`E
*.msJ
.Cex
'//|[
KXNg,
ETV?o
jtrJ@A
I>ATt
2uVCRUNTIME140_1.dll
ATj{n
xnb9E+
*falv
[@.hz
n}ENL
.cKf
qwutl>
LbQeCE
h.sp
maOP
tDHO
E;DYq5
putgg|HO
.kGA
kn\\8
sT%d
Ausx
I.syk
]rBIT'
KinduF
k7//
.fW/
:Oljh
1lHiOEu
XRLi
EDQ`Rt:
0yOL1UQ
i[LIW
orHF5
towg2f
jcN?/O
meQ8G
8vffo
xeeI
TEni
H2.Hm
.ezD
yUUS
fDEQ
.BAJ
u@rdW
raxK
XZ4Hah
UTRFb
QQLl6-
Idxs
u.bv
X^RAZ
YRRO-
uv_fYJ+
#.idI
!omlP
WIME
.uj:
.Rpb
='_0F,<\\
?.in=
}.av
v.DP
JZAS
sdnA
voaIC:>
n//E
*.HE
Tve4s1
stmhc
thgwh
tcde<#
geHLO

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 15 insns

AddressBytesMnemonicOperands

0x1414c14304151pushr9

0x1414c143249b915da2846806aba2fmovabsr9, 0x2fba6a804628da15

0x1414c143c51pushrcx

0x1414c143d9cpushfq

0x1414c143e498bc9movrcx, r9

0x1414c14416681e19305andcx, 0x593

0x1414c14464c8b4c2410movr9, qword ptr [rsp + 0x10]

0x1414c144b48c7442410305098f5movqword ptr [rsp + 0x10], 0xfffffffff5985030

0x1414c1454488b4c2408movrcx, qword ptr [rsp + 8]

0x1414c14590f860a000000jbe0x1414c1469

0x1414c145fff742400pushqword ptr [rsp]

0x1414c14639dpopfq

0x1414c1464488d642410learsp, [rsp + 0x10]

0x1414c1469e801cd0000call0x1414ce16f

0x1414c146e88ecmovah, ch

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	12:jyXDplqR0NCDKWu1oT2Q4W2VW5KcaagAdJBbmI2uD1FF:jyXDLqmdty5yWvaJQJBb+u5FF
Imports read	13 functions from 13 libraries (13 distinct)
Comparable	yes
Compared against	107 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

21 frames · screen recording · 139s

1 / 21

0:00 · 1/21

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 139s

2 process(es) observed

LaunchedC:\Users\user\Desktop\SEYLIZ_-_FREE_internal.vmp_1__1_.exe

Privilegestandard

Telemetry sources: Kernel ETW (15 of 279 events) Process audit: 4keydiff: 1

Evasion / anti-analysis checks

4 checks

MED

System Checks Capability analysis

MITRE T1497

MED

Reference analysis tools strings Capability rule

MITRE T1497 · Anti-analysis

MED

Reference anti-VM strings targeting Xen Capability rule

MITRE T1497.001 · Virtual-machine detection

MED

Virtual Machine Detection Capability taxonomy

MITRE T1497 · Anti-Behavioral Analysis

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No anti-analysis API call seen. In-process hooks were placed in 1 process and recorded no debugger, firmware, timing or sleep call, so this is an observation rather than a gap. A check made in the first seconds of a launch, before the hooks were placed, would still be missed.

No module load worth listing. In-process hooks were placed in 1 process and recorded no explicit module load, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 924 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

2 read

2 captured texts were read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

2processes

1registry operation

SEYLIZ - FREE internal.vmp(1)(1).exe

2 processes

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations1

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 2 registry · sample scope

Files (0) Registry (2)

Operation	Target	Process
create	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters kernel trace	SEYLIZ_-_FREE_internal.vmp_1__1_.exe pid 1236
setvalue	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters TrapPollTimeMilliSecs = 15000 read backread back	-

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

1 reported a hit 9 answered no 13 had nothing to check

1Sources with a hit

10Sources queriedof 23 available

470.6kFeed records

0Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	3,003 records 52 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 4 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,153 records 52 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,680 records 52 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check

Source	Checks	Result	Detail	Feed
blocklist.de	IP / domain / URL	not checked	no IP, domain or URL observed to check	27.6k records 52 minutes ago
CINS Army	IP / domain / URL	not checked	no IP, domain or URL observed to check	15k records 52 minutes ago
Emerging Threats	IP / domain / URL	not checked	no IP, domain or URL observed to check	482 records 52 minutes ago
Feodo Tracker	IP / domain / URL	not checked	no IP, domain or URL observed to check	5 records 52 minutes ago
IPsum	IP / domain / URL	not checked	no IP, domain or URL observed to check	19.7k records 52 minutes ago
Phishing.Database	IP / domain / URL	not checked	no IP, domain or URL observed to check	391.5k records 4 hours ago
ThreatFox	IP / domain / URL	not checked	no IP, domain or URL observed to check	1,153 records 52 minutes ago
URLhaus	IP / domain / URL	not checked	no IP, domain or URL observed to check	no records ingested

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 10 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
Signature rules	Sample content	1 match	maldoc_getEIP_method_1	110 records 53 minutes ago
Sigma rules	Behavior log	clean	-	2,275 records 6 hours ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	2 process image paths, none masqueraded	245 records 53 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 52 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 52 minutes ago
LOLRMM	Names and domains	clean	3 name/domain indicators checked, no remote-management tooling	360 records 52 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 0 info

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	c351816e8f3bf522f1e7e8e2edfb5147bba3d8f8dfcc5f297266b56ed775f731	Submitted sample (SHA256)
suspicious	sample_md5	906782e7e06994a05d8a266419383241	Submitted sample (MD5)
suspicious	imphash	c803fb19f66bafe6f690b310fa9f2799	Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2935_sigma_reg

Auto-generated

title: Auto-generated registry behavior rule (sandbox scan 2935)
id: sandbox-auto-2935-reg
status: experimental
description: Auto-generated from sandbox scan 2935
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

YARA: auto_file_2935_yara

Auto-generated

import "pe"

rule auto_file_2935_yara
{
    meta:
        description = "Auto-generated from scan 2935"
        author = "sandbox auto-generator"
        imphash = "c803fb19f66bafe6f690b310fa9f2799"
    condition:
        uint16(0) == 0x5a4d and filesize < 69582848 and pe.imphash() == "c803fb19f66bafe6f690b310fa9f2799"
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2935

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-10-23 22:42 Shown below	Windows 10 22H2	Suspicious	38/100

SEYLIZ - FREE internal.vmp(1)(1).exePE analysis report - Suspicious

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Detection signatures

What the tests returned

Arguing against malice

How much weight this carries

Instrument coverage

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Family configuration search

Capabilities

Security mitigations

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Import fingerprint

Screen recording

Behavior summary

Evasion / anti-analysis checks

Command lines, unwrapped

Network activity

Process tree

SEYLIZ - FREE internal.vmp(1)(1).exe

Attributed activity

Not attributed to any process

Persistence mechanisms

No persistence established

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

Sigma detections

Generated rules

Sigma: auto_file_2935_sigma_reg

YARA: auto_file_2935_yara

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file