Malwagon
file icon
Config.exe File Analysis · first seen Oct 24, 2026 04:08 · 292.0 KB
1proc 1reg 3IOCs
Suspicious35 Completed Public
Get sample Report Sign in

Config.exePE analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

49.2sto launch
6telemetry events
4observed
67agent notes

Suspicious

35/100

0 points past the suspicious line at 35, 35 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+23
Review confirms
  • 3 of 3 local reviews independently read this as suspicious, on top of 12 points the platform measured itself
+12
Static analysis
  • Malicious strings: injection / execution
  • Weak exploit-mitigation posture (no ASLR/DEP/CFG) and unsigned
+0
Model review
  • findings review (advisory, not scored): suspicious - signature match to banking trojan, registry write, process spawn, anti-analysis timing check

Model reading

Measured SUSPICIOUS35 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Other high-severity findings
  • HIGH Keylogging capability

Analysis layers

Static ran moved the score
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile
MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10
EnvironmentWorkgroup
InternetIsolated
Execution137s
Guest hardware2 vCPU4095 MB RAM

Detection signatures

12 detected · 9 withheld as common
Severity Detection Evidence Layer
HIGH
Injection/execution API strings
MITRE T1055
string setwindowshookex matched string
static
HIGH
Keylogging capability
MITRE T1056.001
capability getkeystate capability: keylogging
static
MED
Anti-VM / sandbox-detection capability
MITRE T1497
capability getcursorpos capability: anti_vm
static
MED
Surveillance/keylogging strings
MITRE T1056
string getdc matched string
string getforegroundwindow matched string
string screenshot matched string
static
MED
Weak exploit mitigations and unsigned
MITRE T1027
mitigation posture: weak
signature unsigned
static
LOW
Changes the desktop wallpaper (ransom note)
MITRE T1491
seen in 8% of benign software
import user32.dll!SystemParametersInfoA
static
LOW
Direct memory execution (VirtualProtect + memory copy)
MITRE T1055
seen in 9% of benign software
import kernel32.dll!VirtualProtect requires virtualprotect
import kernel32.dll!VirtualAlloc requires virtualalloc
static
LOW
Executable heap allocation (GlobalAlloc + VirtualProtect)
MITRE T1055
seen in 6% of benign software
import kernel32.dll!GlobalAlloc requires globalalloc
import kernel32.dll!VirtualProtect requires virtualprotect
static
LOW
Hides its window (ShowWindow SW_HIDE pattern)
MITRE T1564.003
seen in 13% of benign software
import user32.dll!ShowWindow
static
LOW
Installs a Windows hook (keylogging / injection)
MITRE T1056.001
seen in 5% of benign software
import user32.dll!SetWindowsHookExA
static
LOW
Reads the foreground window (activity monitoring)
MITRE T1113
import user32.dll!GetForegroundWindow
static
LOW
Screen-capture capability
MITRE T1113
seen in 8% of benign software
capability getdc capability: screen_capture
static
Withheld: 9 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
Dynamic API resolution (obfuscation) fires on 65% of benign software
Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
Reads its own startup info (parent/desktop check) fires on 36% of benign software
Executes external code / commands fires on 30% of benign software
Writes to the registry fires on 30% of benign software
Persistence-capable APIs present fires on 29% of benign software
Queries system information (host recon) fires on 25% of benign software
Enumerates registry keys (discovery) fires on 21% of benign software

What the tests returned

8 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

TestResult
Persistence mechanismsnone established at runtime
Cross-process injectionnone observed
Payloads written to disknone observed
Network connectionsnot tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)none observed
Known-malicious hash (reputation sources)no source reported this file
Local anti-virus enginereported no detection
Anti-analysis / evasion checksnone above the reporting threshold - the anti-analysis calls this run did make are listed with their counts

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

  • The local anti-virus engine reported no detection.
  • No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

3 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

LayerRanWhat that means
Runtime anti-analysis watch measured Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
API call sequence measured Measured for the hooked anti-analysis calls. It is not a full API trace: the sequence carries interpreter spawns plus the hooked anti-analysis calls, and nothing else.
Explicit module loads measured Measured, with two limits. Only a module the sample asks for by hand is recorded, so one brought in by its own import table never appears, and the hooks arrive a few seconds after a process starts.
Network capture not on this plan Not included on this scan's plan.
Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
Microsoft Visual C/C++(13.10.3077)[C++/std]
Not packed Unsigned
CompilerMicrosoft Visual C/C++(13.10.3077)[C++/std]
LinkerMicrosoft Linker(7.10.3077)
LibraryMFC[static]
Identity
File
typeexecutable
size292.0 KB
file arch32-bit (x86)
subsystemGUI
entropy6.5635
date2018-05-30 15:54:29 UTC
version1.0.0.1
descriptionTODO: <ファイルの説明>
productTODO: <製品名>
original nameシル学コンフィグ.exe
languageJA

Antivirus engine

no signature matched signature set 28162 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature setValue
Set version28162
Signatures in the set3,642,894
Set published23 Oct 2026 06:24 +0000
Age when this file was scannedsame day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

37.3 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 37.3 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural featureWhat it meansPushesWeight
parser warning: Suspicious flags set for section... Header defect reported by the parse: Suspicious flags set for section... (0) towards benign -0.9151
image flag dll Image flag: a library rather than a program towards malicious +0.6422
optional.checksum Header checksum, which is zero on most files that were never signed (0) towards malicious +0.4202
imported function count Number of functions imported from other libraries (251) towards benign -0.4080
image flag relocs_stripped Image flag: relocations stripped towards malicious +0.3375
resource directory size Size of the resource table (143432) towards benign -0.2928
debug directory address Location of the debug table (115728) towards benign -0.2588
readable executable sections Sections marked both readable and executable (1) towards benign -0.2378

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing
Not packed
This file's code is readable on disk - nothing is compressed or encrypted around it.
0/100
packer confidence
Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed

No packer indicator fired: the entry point, the section layout and the entropy all read as an ordinary build.

Family configuration search

Incomplete

1 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available69
Returned a result2
Failed to decode1

Secrets & malicious strings

4 flagged strings

Flagged string categories

injection / execution high 1 hit
IndicatorFound inEvidence from the sample
setwindowshookex extracted string SetWindowsHookExA
keylogging / surveillance med 3 hits
IndicatorFound inEvidence from the sample
getdc extracted string GetDCOrgEx
getforegroundwindow import table USER32.dll!GetForegroundWindow
screenshot extracted string ScreenShotFlag=

Capabilities

10 behaviour buckets · 3 high-risk
SeverityCapabilityMITREAPIs
high Hooking
Installs Windows or API hooks
 T1056.001 setwindowshookexa
high Anti-VM / anti-sandbox
Detects a virtual machine or analysis sandbox
 T1497.002 getcursorpos
high Keylogging / input capture
Hooks the keyboard or reads input state
 T1056.001 getkeystate
med Evasion / stalling
Sleeps, times, or otherwise stalls analysis
 T1497, T1497.003 getsystemtimeasfiletime, gettickcount, queryperformancecounter
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 getprocaddress, loadlibrarya
med Persistence
Survives reboot via autostart / services / tasks
 T1547.001 regsetvalueexa
med Code execution
Creates processes / runs commands or shellcode
 T1059 system
med Screen capture
Grabs the screen / clipboard
 T1113 getdc
low Discovery
Enumerates the host, users, processes or network
 T1082 getsysteminfo, getversionexa
low Registry manipulation
Reads / writes the registry
 T1112 regcreatekeyexa

Security mitigations

weak posture
OFF ASLR (DynamicBase)
OFF High-entropy ASLR (64-bit)
OFF DEP / NX (NxCompat)
OFF Control Flow Guard
ON SafeSEH
ON Stack cookies (GS)
OFF Force Integrity
OFF AppContainer isolation
OFF Authenticode signed

Atypical for a benign modern build - common in packed/repacked malware.

Rich header (toolchain)

richhash d4eece7c1f7dbe95
ToolBuildUses
Linker 7.1021797
prodid_2592106
C++ (VS2003)20672
C++ (VS2003)217915
Import (linker)0530
Masm 6.13307728
Linker 7.103077146
prodid_96307796
prodid_9830773
C (VS2003)30521
prodid_9030771
Linker mismatch - possible tampering

Sections

4 sections · the file's memory layout
SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
.textEP
Executable code
 0x1000
108.0 KB
106.7 KB
EXECUTEREAD
6.5213
.rdata
Read-only data
 0x1c000
28.0 KB
27.1 KB
READ
4.9015
.data
Initialised data
 0x23000
8.0 KB
20.5 KB
expands
READWRITE
3.5339
.rsrc
Resources
 0x29000
144.0 KB
140.1 KB
READ
6.2525
code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

251 funcs / 8 DLLs · 13 suspicious
▸KERNEL32.dll107 funcs 7 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
HeapAlloc 0x0001c098 - -
HeapFree 0x0001c09c - -
GetStartupInfoA 0x0001c0a0 - -
GetCommandLineA 0x0001c0a4 - -
TerminateProcess 0x0001c0a8 - -
HeapReAlloc 0x0001c0ac - -
HeapSize 0x0001c0b0 - -
QueryPerformanceCounter 0x0001c0b4 - T1497
GetTickCount 0x0001c0b8 - T1497
GetCurrentProcessId 0x0001c0bc - -
GetSystemTimeAsFileTime 0x0001c0c0 - -
HeapDestroy 0x0001c0c4 - -
HeapCreate 0x0001c0c8 - -
VirtualFree 0x0001c0cc - -
IsBadWritePtr 0x0001c0d0 - -
SetUnhandledExceptionFilter 0x0001c0d4 - -
SetHandleCount 0x0001c0d8 - -
GetStdHandle 0x0001c0dc - -
GetFileType 0x0001c0e0 - -
VirtualQuery 0x0001c0e4 - -
FreeEnvironmentStringsA 0x0001c0e8 - -
GetEnvironmentStrings 0x0001c0ec - -
FreeEnvironmentStringsW 0x0001c0f0 - -
GetEnvironmentStringsW 0x0001c0f4 - -
LCMapStringA 0x0001c0f8 - -
LCMapStringW 0x0001c0fc - -
GetStringTypeA 0x0001c100 - -
GetStringTypeW 0x0001c104 - -
IsBadReadPtr 0x0001c108 - -
IsBadCodePtr 0x0001c10c - -
SetStdHandle 0x0001c110 - -
GetSystemInfo 0x0001c114 - -
VirtualAlloc 0x0001c118 - T1055
VirtualProtect 0x0001c11c - T1055
ExitProcess 0x0001c120 - -
RtlUnwind 0x0001c124 yes -
SetErrorMode 0x0001c128 - -
CreateFileA 0x0001c12c - -
GetCurrentProcess 0x0001c130 - -
SetEndOfFile 0x0001c134 - -
FlushFileBuffers 0x0001c138 - -
SetFilePointer 0x0001c13c - -
WriteFile 0x0001c140 - -
ReadFile 0x0001c144 - -
GetOEMCP 0x0001c148 - -
GetCPInfo 0x0001c14c - -
GlobalFlags 0x0001c150 - -
TlsFree 0x0001c154 - -
LocalReAlloc 0x0001c158 - -
TlsSetValue 0x0001c15c - -
TlsAlloc 0x0001c160 - -
TlsGetValue 0x0001c164 - -
EnterCriticalSection 0x0001c168 - -
GlobalHandle 0x0001c16c - -
GlobalReAlloc 0x0001c170 - -
LeaveCriticalSection 0x0001c174 - -
LocalAlloc 0x0001c178 - -
InterlockedIncrement 0x0001c17c - -
DeleteCriticalSection 0x0001c180 - -
InitializeCriticalSection 0x0001c184 - -
RaiseException 0x0001c188 - -
WritePrivateProfileStringA 0x0001c18c - -
CloseHandle 0x0001c190 - -
GetCurrentThread 0x0001c194 - -
lstrcmpA 0x0001c198 - -
ConvertDefaultLocale 0x0001c19c - -
EnumResourceLanguagesA 0x0001c1a0 - -
lstrcpyA 0x0001c1a4 - -
InterlockedDecrement 0x0001c1a8 - -
GetCurrentThreadId 0x0001c1ac - -
GlobalGetAtomNameA 0x0001c1b0 - -
GlobalAddAtomA 0x0001c1b4 - -
GlobalFindAtomA 0x0001c1b8 - -
GlobalDeleteAtom 0x0001c1bc - -
LoadLibraryA 0x0001c1c0 - T1129
FreeLibrary 0x0001c1c4 - -
lstrcatA 0x0001c1c8 - -
lstrcmpW 0x0001c1cc - -
GetModuleHandleA 0x0001c1d0 - -
GetProcAddress 0x0001c1d4 - T1129
FreeResource 0x0001c1d8 - -
SetLastError 0x0001c1dc - -
GlobalFree 0x0001c1e0 - -
FindResourceA 0x0001c1e4 - -
LoadResource 0x0001c1e8 - T1129
LockResource 0x0001c1ec - -
SizeofResource 0x0001c1f0 - -
MulDiv 0x0001c1f4 - -
GlobalAlloc 0x0001c1f8 - -
GlobalLock 0x0001c1fc - -
GlobalUnlock 0x0001c200 - -
FormatMessageA 0x0001c204 - -
lstrcpynA 0x0001c208 - -
LocalFree 0x0001c20c - -
GetLastError 0x0001c210 - -
lstrlenA 0x0001c214 - -
lstrcmpiA 0x0001c218 - -
WideCharToMultiByte 0x0001c21c - -
MultiByteToWideChar 0x0001c220 - -
GetVersion 0x0001c224 - -
GetThreadLocale 0x0001c228 - -
GetLocaleInfoA 0x0001c22c - -
GetACP 0x0001c230 - -
InterlockedExchange 0x0001c234 - -
GetVersionExA 0x0001c238 - -
UnhandledExceptionFilter 0x0001c23c - -
GetModuleFileNameA 0x0001c240 - -
▸USER32.dll101 funcs 3 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
DestroyMenu 0x0001c264 - -
LoadCursorA 0x0001c268 - -
GetSysColorBrush 0x0001c26c - -
GetMessageA 0x0001c270 - -
TranslateMessage 0x0001c274 - -
ValidateRect 0x0001c278 - -
SetCursor 0x0001c27c - -
PostQuitMessage 0x0001c280 - -
EndPaint 0x0001c284 - -
BeginPaint 0x0001c288 - -
ReleaseDC 0x0001c28c - -
GetDC 0x0001c290 - -
ClientToScreen 0x0001c294 - -
GrayStringA 0x0001c298 - -
DrawTextExA 0x0001c29c - -
DrawTextA 0x0001c2a0 - -
TabbedTextOutA 0x0001c2a4 - -
wsprintfA 0x0001c2a8 - -
SetMenuItemBitmaps 0x0001c2ac - -
ModifyMenuA 0x0001c2b0 - -
EnableMenuItem 0x0001c2b4 - -
CheckMenuItem 0x0001c2b8 - -
GetMenuCheckMarkDimensions 0x0001c2bc - -
LoadBitmapA 0x0001c2c0 - -
ShowWindow 0x0001c2c4 - -
SetWindowTextA 0x0001c2c8 - -
IsDialogMessageA 0x0001c2cc - -
RegisterWindowMessageA 0x0001c2d0 - -
WinHelpA 0x0001c2d4 - -
GetCapture 0x0001c2d8 - -
CreateWindowExA 0x0001c2dc - -
SetWindowsHookExA 0x0001c2e0 - T1056.001
CallNextHookEx 0x0001c2e4 - -
GetClassInfoExA 0x0001c2e8 - -
GetClassNameA 0x0001c2ec - -
SetPropA 0x0001c2f0 - -
GetPropA 0x0001c2f4 - -
RemovePropA 0x0001c2f8 - -
SendDlgItemMessageA 0x0001c2fc - -
GetFocus 0x0001c300 - -
SetFocus 0x0001c304 - -
GetWindowTextA 0x0001c308 - -
GetForegroundWindow 0x0001c30c - T1010
GetLastActivePopup 0x0001c310 - -
DispatchMessageA 0x0001c314 - -
GetTopWindow 0x0001c318 - -
UnhookWindowsHookEx 0x0001c31c - -
GetMessageTime 0x0001c320 - -
GetMessagePos 0x0001c324 - -
PeekMessageA 0x0001c328 - -
MapWindowPoints 0x0001c32c - -
GetKeyState 0x0001c330 - T1056.001
MessageBoxA 0x0001c334 - -
GetCursorPos 0x0001c338 - -
DrawIcon 0x0001c33c - -
SendMessageA 0x0001c340 - -
IsIconic 0x0001c344 - -
GetClientRect 0x0001c348 - -
EnableWindow 0x0001c34c - -
LoadIconA 0x0001c350 - -
SetForegroundWindow 0x0001c354 - -
IsWindowVisible 0x0001c358 - -
UpdateWindow 0x0001c35c - -
GetMenu 0x0001c360 - -
PostMessageA 0x0001c364 - -
GetSysColor 0x0001c368 - -
AdjustWindowRectEx 0x0001c36c - -
GetClassInfoA 0x0001c370 - -
RegisterClassA 0x0001c374 - -
UnregisterClassA 0x0001c378 - -
GetDlgCtrlID 0x0001c37c - -
DefWindowProcA 0x0001c380 - -
CallWindowProcA 0x0001c384 - -
SetWindowLongA 0x0001c388 - -
SetWindowPos 0x0001c38c - -
OffsetRect 0x0001c390 - -
IntersectRect 0x0001c394 - -
SystemParametersInfoA 0x0001c398 - -
GetClassLongA 0x0001c39c - -
GetSubMenu 0x0001c3a0 - -
GetMenuItemCount 0x0001c3a4 - -
GetMenuItemID 0x0001c3a8 - -
GetMenuState 0x0001c3ac - -
EndDialog 0x0001c3b0 - -
GetNextDlgTabItem 0x0001c3b4 - -
GetParent 0x0001c3b8 - -
IsWindowEnabled 0x0001c3bc - -
GetDlgItem 0x0001c3c0 - -
GetWindowLongA 0x0001c3c4 - -
IsWindow 0x0001c3c8 - -
DestroyWindow 0x0001c3cc - -
CreateDialogIndirectParamA 0x0001c3d0 - -
GetSystemMetrics 0x0001c3d4 - -
SetActiveWindow 0x0001c3d8 - -
GetWindowPlacement 0x0001c3dc - -
GetWindowRect 0x0001c3e0 - -
CopyRect 0x0001c3e4 - -
PtInRect 0x0001c3e8 - -
GetWindow 0x0001c3ec - -
GetDesktopWindow 0x0001c3f0 - -
GetActiveWindow 0x0001c3f4 - -
▸GDI32.dll25 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
GetStockObject 0x0001c030 - -
DeleteDC 0x0001c034 - -
ScaleWindowExtEx 0x0001c038 - -
TextOutA 0x0001c03c - -
SetWindowExtEx 0x0001c040 - -
ScaleViewportExtEx 0x0001c044 - -
SetViewportExtEx 0x0001c048 - -
OffsetViewportOrgEx 0x0001c04c - -
SetViewportOrgEx 0x0001c050 - -
SelectObject 0x0001c054 - -
Escape 0x0001c058 - -
GetDeviceCaps 0x0001c05c - -
RectVisible 0x0001c060 - -
PtVisible 0x0001c064 - -
DeleteObject 0x0001c068 - -
SetMapMode 0x0001c06c - -
RestoreDC 0x0001c070 - -
SaveDC 0x0001c074 - -
CreateBitmap 0x0001c078 - -
GetObjectA 0x0001c07c - -
SetBkColor 0x0001c080 - -
SetTextColor 0x0001c084 - -
GetClipBox 0x0001c088 - -
GetDCOrgEx 0x0001c08c - -
ExtTextOutA 0x0001c090 - -
▸WINSPOOL.DRV3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
OpenPrinterA 0x0001c3fc - -
DocumentPropertiesA 0x0001c400 - -
ClosePrinter 0x0001c404 - -
▸ADVAPI32.dll9 funcs 3 suspicious
NameFile RVAIs undocumentedMITRE (tactic - technique)
RegOpenKeyA 0x0001c000 - T1112
RegQueryValueExA 0x0001c004 - -
RegOpenKeyExA 0x0001c008 - -
RegDeleteKeyA 0x0001c00c - T1112
RegEnumKeyA 0x0001c010 - -
RegQueryValueA 0x0001c014 - -
RegCreateKeyExA 0x0001c018 - -
RegSetValueExA 0x0001c01c - T1112
RegCloseKey 0x0001c020 - -
▸COMCTL32.dll1 func
NameFile RVAIs undocumentedMITRE (tactic - technique)
ordinal_17 0x0001c028 yes -
▸SHLWAPI.dll2 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
PathFindFileNameA 0x0001c258 - -
PathFindExtensionA 0x0001c25c - -
▸OLEAUT32.dll3 funcs
NameFile RVAIs undocumentedMITRE (tactic - technique)
VariantClear 0x0001c248 - -
VariantChangeType 0x0001c24c - -
VariantInit 0x0001c250 - -

Binary metadata

what the headers declare about this build
Resource langsJA
Debug infoyes
TLS callbacksno

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Capability detection

29 capabilities
CapabilityNamespace
link function at runtime on Windows linking/runtime-linking
calculate modulo 256 via x86 assembly -
create or open file -
set application hook host-interaction/gui
allocate memory -
allocate or change RW memory -
change memory protection -
create or open registry key -
get OS version -
check OS version host-interaction/os/version
contain loop -
get geographical location collection
extract resource via kernel32 functions executable/resource
link many functions at runtime linking/runtime-linking
get system information on Windows host-interaction/os/info
parse PE header load-code/pe
terminate process host-interaction/process/terminate
accept command line arguments host-interaction/cli
allocate thread local storage host-interaction/thread/tls
read file on Windows host-interaction/file-system/read
write file on Windows host-interaction/file-system/write
clear file content host-interaction/file-system/write
get graphical window text host-interaction/gui/window/get-text
set registry value host-interaction/registry/create
query or enumerate registry value host-interaction/registry
query or enumerate registry key host-interaction/registry
get thread local storage value host-interaction/process
set thread local storage value host-interaction/thread/tls
reference analysis tools strings anti-analysis
ATT&CK techniques
Discovery::Query Registry [T1012]Discovery::System Information Discovery [T1082]Discovery::System Location Discovery [T1614]Execution::Command and Scripting Interpreter [T1059]Execution::Shared Modules [T1129]
Malware Behavior Catalog
Data::ModuloDiscovery::Analysis Tool Discovery::Process detectionDiscovery::Application Window DiscoveryDiscovery::System Information DiscoveryExecution::Command and Scripting InterpreterFile System::Create FileFile System::Read FileFile System::Writes FileMemory::Allocate MemoryMemory::Change Memory ProtectionOperating System::Registry::Create Registry KeyOperating System::Registry::Open Registry KeyOperating System::Registry::Query Registry KeyOperating System::Registry::Query Registry ValueOperating System::Registry::Set Registry KeyProcess::Allocate Thread Local StorageProcess::Set Thread Local Storage ValueProcess::Terminate Process

Signature matches

1 finding · 4 file properties · 0 scored
Rule What it matched Corpus Weight
IceID_Bank_trojan
rule dated 2018-01-14
Detects IcedID..adjusted several times
8 of 10 strings matched
$header MZ at 0x0
$magic1 \xe8\x83M\xfc\xff\xe9:K\x00\x00j\x08h\xb0\xe7 at 0x9f90
$st01 CCmdTarget at 0x1d8b0
$st02 CUserException at 0x1dd20
$st04 FlsGetValue at 0x1e784
$st06 AVCCmdTarget@@ at 0x23286
$st07 AUCThreadData@@ at 0x23872
$st08 AVCUserException@@ at 0x23666
Tier 3 - community corpus
casts no family vote; every measured false family match came from here
 SCORED 0
Scored 0: the rule declares no category. No branch of the score model reads it.
File properties - not findings
IsPE32IsWindowsGUIHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 200 of 579
  • !This program cannot be run in DOS mode.
  • Rich
  • .text
  • `.rdata
  • @.data
  • .rsrc
  • @PVSS
  • t#SSUP
  • t$$VSS
  • ptaS
  • hDEB
  • tihL
  • SSSSS
  • @uESW
  • hrNA
  • %xKB
  • hhhA
  • SSIQ
  • UUSW
  • Invalid DateTime
  • Invalid DateTimeSpan
  • %s%s
  • Game.ini
  • Start=
  • SoftModeFlag=
  • WindowModeFlag=
  • SEandBGM=
  • FrameSkip=
  • Proxy=
  • ProxyPort=
  • ScreenShotFlag=
  • F12_Reset=
  • Display_Number=
  • Old_DirectX_Use=
  • Start=%d
  • SoftModeFlag=%d
  • WindowModeFlag=%d
  • SEandBGM=%d
  • FrameSkip=%d
  • Proxy=%s
  • ProxyPort=%s
  • ScreenShotFlag=%d
  • F12_Reset=%d
  • Display_Number=%d
  • Old_DirectX_Use=%d
  • LastUpdateTime.txt
  • Steam
  • COleException
  • DISPLAY
  • CInvalidArgException
  • CNotSupportedException
  • CMemoryException
  • CException
  • CDialog
  • Edit
  • MS Shell Dlg
  • CWnd
  • AfxOldWndProc423
  • AfxControlBar70s
  • AfxMDIFrame70s
  • AfxOleControl70s
  • EnumDisplayDevicesA
  • GetMonitorInfoA
  • EnumDisplayMonitors
  • MonitorFromPoint
  • MonitorFromRect
  • MonitorFromWindow
  • GetSystemMetrics
  • USER32
  • qInitCommonControlsEx
  • COMCTL32.DLL
  • HtmlHelpA
  • hhctrl.ocx
  • commctrl_DragListMsg
  • CCmdTarget
  • CButton
  • CStatic
  • STATIC
  • BUTTON
  • CBitmap
  • CGdiObject
  • CPaintDC
  • CUserException
  • CResourceException
  • CWinApp
  • PreviewPages
  • Settings
  • ntdll.dll
  • Control Panel\Desktop\ResourceLocale
  • GetSystemDefaultUILanguage
  • GetUserDefaultUILanguage
  • kernel32.dll
  • NoFileMru
  • NoBackButton
  • NoPlacesBar
  • Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32
  • NoEntireNetwork
  • Software\Microsoft\Windows\CurrentVersion\Policies\Network
  • NoClose
  • NoRecentDocsHistory
  • NoNetConnectDisconnect
  • RestrictRun
  • NoDrives
  • Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
  • %s.dll
  • Software\
  • CWinThread
  • software
  • CObject
  • Delete
  • NoRemove
  • ForceRemove
  • System
  • CMenu
  • CMapPtrToPtr
  • CArchiveException
  • MSWHEEL_ROLLMSG
  • .INI
  • .HLP
  • .CHM
  • NotifyWinEvent
  • user32.dll
  • CByteArray
  • commdlg_FindReplace
  • KERNEL32
  • CorExitProcess
  • mscoree.dll
  • (null)
  • FlsSetValue
  • FlsGetValue
  • FlsAlloc
  • Microsoft Visual C++ Runtime Library
  • Program:
  • <program name unknown>
  • A buffer overrun has been detected which has corrupted the program's
  • internal state. The program cannot safely continue execution and must
  • now be terminated.
  • Buffer overrun detected!
  • A security error of unknown cause has been detected which has
  • corrupted the program's internal state. The program cannot safely
  • continue execution and must now be terminated.
  • Unknown security failure detected!
  • runtime error
  • TLOSS error
  • SING error
  • DOMAIN error
  • - This application cannot run using the active version of the Microsoft .NET Runtime
  • Please contact the application's support team for more information.
  • - unable to initialize heap
  • - not enough space for lowio initialization
  • - not enough space for stdio initialization
  • - pure virtual function call
  • - not enough space for _onexit/atexit table
  • - unable to open console device
  • - unexpected heap error
  • - unexpected multithread lock error
  • - not enough space for thread data
  • This application has requested the Runtime to terminate it in an unusual way.
  • - not enough space for environment
  • - not enough space for arguments
  • - floating point not loaded
  • Runtime Error!
  • GAIsProcessorFeaturePresent
  • SunMonTueWedThuFriSat
  • JanFebMarAprMayJunJulAugSepOctNovDec
  • GetProcessWindowStation
  • GetUserObjectInformationA
  • GetLastActivePopup
  • GetActiveWindow
  • MessageBoxA
  • InitializeCriticalSectionAndSpinCount
  • December
  • November
  • October
  • September
  • August
  • July
  • June
  • April
  • March
  • January
  • Saturday
  • Friday
  • Thursday
  • Wednesday
  • Monday
  • 1#QNAN
  • 1#SNAN
  • invalid string position
  • string too long
  • OLEACC.dll
  • Unknown exception
  • \Config
  • \Release\
  • .pdb
  • CreateStdAccessibleObject
  • LresultFromObject
  • GetModuleFileNameA
  • GetVersionExA
  • InterlockedExchange

Stack and decoded strings were not recovered: it did not finish within the time allowed. Only literal strings present in the file are listed above.

Disassembly

entry point · x86 · 60 insns (listing capped)
AddressBytesMnemonicOperands
0x4078586a60push0x60
0x40785a68e0e54100push0x41e5e0
0x40785fe85c050000call0x407dc0
0x407864bf94000000movedi, 0x94
0x4078698bc7moveax, edi
0x40786be870eaffffcall0x4062e0
0x4078708965e8movdword ptr [ebp - 0x18], esp
0x4078738bf4movesi, esp
0x407875893emovdword ptr [esi], edi
0x40787756pushesi
0x407878ff1538c24100calldword ptr [0x41c238]
0x40787e8b4e10movecx, dword ptr [esi + 0x10]
0x407881890d24694200movdword ptr [0x426924], ecx
0x4078878b4604moveax, dword ptr [esi + 4]
0x40788aa330694200movdword ptr [0x426930], eax
0x40788f8b5608movedx, dword ptr [esi + 8]
0x407892891534694200movdword ptr [0x426934], edx
0x4078988b760cmovesi, dword ptr [esi + 0xc]
0x40789b81e6ff7f0000andesi, 0x7fff
0x4078a1893528694200movdword ptr [0x426928], esi
0x4078a783f902cmpecx, 2
0x4078aa740cje0x4078b8
0x4078ac81ce00800000oresi, 0x8000
0x4078b2893528694200movdword ptr [0x426928], esi
0x4078b8c1e008shleax, 8
0x4078bb03c2addeax, edx
0x4078bda32c694200movdword ptr [0x42692c], eax
0x4078c233f6xoresi, esi
0x4078c456pushesi
0x4078c58b3dd0c14100movedi, dword ptr [0x41c1d0]
0x4078cbffd7calledi
0x4078cd6681384d5acmpword ptr [eax], 0x5a4d
0x4078d2751fjne0x4078f3
0x4078d48b483cmovecx, dword ptr [eax + 0x3c]
0x4078d703c8addecx, eax
0x4078d9813950450000cmpdword ptr [ecx], 0x4550
0x4078df7512jne0x4078f3
0x4078e10fb74118movzxeax, word ptr [ecx + 0x18]
0x4078e53d0b010000cmpeax, 0x10b
0x4078ea741fje0x40790b
0x4078ec3d0b020000cmpeax, 0x20b
0x4078f17405je0x4078f8
0x4078f38975e4movdword ptr [ebp - 0x1c], esi
0x4078f6eb27jmp0x40791f
0x4078f883b9840000000ecmpdword ptr [ecx + 0x84], 0xe
0x4078ff76f2jbe0x4078f3
0x40790133c0xoreax, eax
0x40790339b1f8000000cmpdword ptr [ecx + 0xf8], esi
0x407909eb0ejmp0x407919
0x40790b8379740ecmpdword ptr [ecx + 0x74], 0xe
0x40790f76e2jbe0x4078f3
0x40791133c0xoreax, eax
0x40791339b1e8000000cmpdword ptr [ecx + 0xe8], esi
0x4079190f95c0setneal
0x40791c8945e4movdword ptr [ebp - 0x1c], eax
0x40791f6a01push1
0x407921e86b2c0000call0x40a591
0x40792659popecx
0x40792785c0testeax, eax
0x4079297508jne0x407933
callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample
Fingerprint96:VcBbw7JYOV+tpm4gDoVTD8XMXk4d65sFk07pcnc1LRNYQPD:ZWfSoOXMXk4d65sFv1cncSQPD
Imports read251 functions from 8 libraries (251 distinct)
Comparableyes
Compared against108 stored samples
Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

12 frames · screen recording · 138s
Screen recording frame
1 / 12
0:00 · 1/12
Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 137s

1 process(es) observed

LaunchedC:\Users\user\Desktop\Config.exe
Privilegestandard
Telemetry sources: Kernel ETW (12 of 185 events) agent poll: 1Process audit: 1keydiff: 1In-process monitor: 1

Evasion / anti-analysis checks

1 check
MED
Reference analysis tools strings Capability rule
MITRE T1497 · Anti-analysis

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

Anti-analysis API trace

1 API · 1 process hooked

Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

APISignalCallsSleepScored
GetTickCount timing 1 - no corroborates, never convicts on its own - ordinary software calls this
Call order 1 event sampled
GetTickCount

How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

No module load worth listing. In-process hooks were placed in 1 process and recorded no explicit module load, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 915 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

Config.exe

1 process
1 process

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations1
0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 1 registry · sample scope
OperationTargetProcess
create
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
not the samplekernel trace
 - pid 3632
setvalue
Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
TrapPollTimeMilliSecs = 15000
read backread back
 -

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

1 reported a hit 9 answered no 13 had nothing to check
1Sources with a hit
10Sources queriedof 23 available
470.6kFeed records
0Could not answer

File reputation

4 clear · 3 not checked
SourceChecksResultDetailFeed
MalwareBazaar hash feed File hash clean not in feed 3,003 records
40 minutes ago
MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
3 hours ago
ThreatFox hash IOCs File hash clean not in feed 1,153 records
41 minutes ago
URLhaus payload hashes File hash clean not in feed 1,680 records
40 minutes ago
filescan.io File hash not checked no hash lookup ran for this scan live lookup
MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
VirusTotal File hash not checked no hash lookup ran for this scan live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check
SourceChecksResultDetailFeed
blocklist.de IP / domain / URL not checked no IP, domain or URL observed to check 27.6k records
40 minutes ago
CINS Army IP / domain / URL not checked no IP, domain or URL observed to check 15k records
40 minutes ago
Emerging Threats IP / domain / URL not checked no IP, domain or URL observed to check 482 records
41 minutes ago
Feodo Tracker IP / domain / URL not checked no IP, domain or URL observed to check 5 records
41 minutes ago
IPsum IP / domain / URL not checked no IP, domain or URL observed to check 19.7k records
41 minutes ago
Phishing.Database IP / domain / URL not checked no IP, domain or URL observed to check 391.5k records
4 hours ago
ThreatFox IP / domain / URL not checked no IP, domain or URL observed to check 1,153 records
41 minutes ago
URLhaus IP / domain / URL not checked no IP, domain or URL observed to check no records ingested

TLS fingerprints

nothing of this kind to check
SourceChecksResultDetailFeed
JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
10 hours ago
SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

Detection rules

1 of 2 listed
SourceChecksResultDetailFeed
Signature rules Sample content 1 match IceID_Bank_trojan 110 records
41 minutes ago
Sigma rules Behavior log clean - 2,275 records
5 hours ago

Tooling catalogs

4 clear
SourceChecksResultDetailFeed
LOLBAS Process image paths clean 1 process image path, none masqueraded 245 records
41 minutes ago
LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
40 minutes ago
LOLDrivers File hash clean not a known vulnerable driver 2,333 records
41 minutes ago
LOLRMM Names and domains clean 2 name/domain indicators checked, no remote-management tooling 360 records
40 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 3 info

File indicators

3
SeverityTypeIndicatorDescription
info sample_sha256 283f1e94ab5397e329366f30ab8e72ddb0098f1ce424c7f8a549d698a7fc00eb Submitted sample (SHA256)
info sample_md5 1e52c9cc6e46cbfefd1ac5d6e45471a7 Submitted sample (MD5)
info imphash cdaf6bd071bbd2375e2d5d5beaa74652 Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2937_sigma_reg

Auto-generated
title: Auto-generated registry behavior rule (sandbox scan 2937)
id: sandbox-auto-2937-reg
status: experimental
description: Auto-generated from sandbox scan 2937
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

YARA: auto_file_2937_yara

Auto-generated
rule auto_file_2937_yara
{
    meta:
        description = "Auto-generated from scan 2937"
        author = "sandbox auto-generator"
        imphash = "cdaf6bd071bbd2375e2d5d5beaa74652"
        anchors = "5 independent regions"
    strings:
        $s0 = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Comdlg32" ascii fullword
        $s1 = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer" ascii fullword
        $s2 = "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Network" ascii fullword
        $s3 = "comdlg32.dll" ascii fullword
        $s4 = "LastUpdateTime.txt" ascii fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 1196032 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2937

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run
SubmittedEnvironmentVerdictScore
2026-10-24 04:08 Shown below Windows 10 22H2 Suspicious 35/100