sahtewin.webpIMAGE analysis report - No threats detected

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

36.0sto launch

61agent notes

No threats detected

0/100

Nothing scored against this sample. A run reads as suspicious from 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

Every layer that ran completed without scoring anything against this sample.

Model reading

Measured CLEAN0 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Analysis layers

Static ran no points

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEimage/webp

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution136s

Guest hardware2 vCPU4095 MB RAM

Detection signatures

1 detected

Severity	Detection	Evidence	Layer
MED	High file entropy (encrypted/compressed payload) MITRE T1027	entropy 7.97 threshold 7.20, maximum 8.00	static

The dynamic layer ran and recorded no process, network or file activity for this sample.

What the tests returned

9 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	not tested - nothing executed in the sandbox
Cross-process injection	not tested - nothing executed in the sandbox
Payloads written to disk	not tested - nothing executed in the sandbox
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	not tested - nothing executed in the sandbox
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Capability analysis of the file's code	not checked
Anti-analysis / evasion checks	not tested - nothing executed in the sandbox

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Not tested. This run did not test the claim. The verdict covers only what the coverage section lists. The one fact that decided it: nothing executed in the sandbox, so no behaviour was tested.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	not measured	Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence	not measured	Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads	not measured	Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Format: WebP

Not packed

Identity

File

typeRIFF (little-endian) data, Web/P image

size146.7 KB

entropy7.9716

Antivirus engine

no signature matched signature set 28162 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28162
Signatures in the set	3,642,894
Set published	23 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

no model score

No model score exists for this file: the local model reads Windows executables only, so this file got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

Structural rules of thumb, not a model. 1 cheap static signal fired, for 30 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

high entropy 7.9716

Packing

Not packed

This is a WEBP, a format that is compressed by design.

0/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed 1 signal

WEBP document/media (entropy 7.9716 is the format)

Family configuration search

Incomplete

4 of this platform's 69 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available	69
Returned a result	4
Failed to decode	4

Capability detection

not run on this file

Capability detection reads the machine code of a compiled program and lists what that code is able to do. This submission is not a compiled program, so the check was not run on it and had nothing it could have found. Read this as a question that was not asked here, not as an answer about the file.

Extracted strings

showing 95

RIFF
ICCP
desc
rTRC
(gTRC
(bTRC
(cprt
enUS
-para
Vqkel
C!ELgy
ESaz
Edhz}
JWHe
ROBk
C%%u
OCET
//x!^
pahQ
qiohOH
E$CXw
[R%l
qltA
.Kx*h
mqIC
8M:%okk8
{iiBE$DH
e:\
blQ$NE
$%xjmd
DKIC
SQI#c
I.Hq
g&}TES
KOim
UTLA
aSNA+S
q.ME
.RHe
PTAK}
hjUR
OAN5j
-ZThg{
.Udx<FX
HIGG
vteG
N.mH
iMWT
tsoZ
NTUv
.EnO
+.wqJC
rOEF
uLSZ
`".rtd
Y\\9
RVial+
.ij@
twCA
itaHG
8Etqn
Etqj
zUIS
|YTut
QCon
W.zk
\IMAz
N2kco
.QEt
ExifMeta
<?xpacket begin='
' id='W5M0MpCehiHzreSzNTczkc9d'?>
<x:xmpmeta xmlns:x='adobe:ns:meta/'>
<rdf:RDF xmlns:rdf='http://www.w3.org/1999/02/22-rdf-syntax-ns#'>
<rdf:Description rdf:about=''
xmlns:Attrib='http://ns.attribution.com/ads/1.0/'>
<Attrib:Ads>
<rdf:li rdf:parseType='Resource'>
<Attrib:Created>2026-10-22</Attrib:Created>
<Attrib:Data>{"doc":"DAHYwLUU3gA","user":"UAGYijKLwng","brand":"BAGYihGvBLw"}</Attrib:Data>
<Attrib:ExtId>533feb05-8f79-4da2-b162-6d4d368930da</Attrib:ExtId>
<Attrib:FbId>525265914179580</Attrib:FbId>
<Attrib:TouchType>2</Attrib:TouchType>
</Attrib:Ads>
</rdf:Description>
xmlns:dc='http://purl.org/dc/elements/1.1/'>
<dc:title>
<rdf:li xml:lang='x-default'>Ads
z tasar
xmlns:pdf='http://ns.adobe.com/pdf/1.3/'>
<pdf:Author>Eymen ege Tekiner</pdf:Author>
xmlns:xmp='http://ns.adobe.com/xap/1.0/'>
<xmp:CreatorTool>Canva doc=DAHYwLUU3gA user=UAGYijKLwng brand=BAGYihGvBLw</xmp:CreatorTool>
</x:xmpmeta>
Google Inc. 201

Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

Screen recording

15 frames · screen recording · 136s

1 / 15

0:00 · 1/15

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 136s

Nothing was captured during the run, which lasted 136 seconds. No process, file or registry activity reached any telemetry layer - which is a statement about what was observed, not about what the sample would do given longer.

LaunchedC:\Users\user\Desktop\sahtewin.webp

Privilegestandard

Telemetry sources: no layer reported

Nothing inside the guest reported an event during this run. Rows elsewhere on this page, where there are any, come from comparing the machine against its pre-run baseline and from the packet capture taken outside it - so a quiet report here is a statement about the instrumentation, and not yet one about the sample.

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 985 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

nothing captured

The run captured no command line and no script block, so there was no text to unwrap. A sample that does its work in-process, and one that never started, both land here - which of the two this is, the process tree and the verdict answer.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

No processes were captured

This run recorded no process activity. A hash lookup and a URL analysis never open a Windows VM, and a detonation that produced no telemetry says so on the report.

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 0 registry · sample scope

Files (0) Registry (0)

Operation	Target	Process

No file or registry operations captured.

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

16 answered no 1 could not answer 6 had nothing to check

0Sources with a hit

17Sources queriedof 23 available

470.6kFeed records

1Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	3,003 records 4 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 3 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,153 records 4 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,680 records 4 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

7 clear · 1 could not answer

Source	Checks	Result	Detail	Feed
URLhaus	IP / domain / URL	feed unavailable	5 observed indicators, none listed	no records ingested
blocklist.de	IP / domain / URL	clean	5 observed indicators, none listed	27.6k records 4 minutes ago
CINS Army	IP / domain / URL	clean	5 observed indicators, none listed	15k records 4 minutes ago
Emerging Threats	IP / domain / URL	clean	5 observed indicators, none listed	482 records 4 minutes ago
Feodo Tracker	IP / domain / URL	clean	5 observed indicators, none listed	5 records 4 minutes ago
IPsum	IP / domain / URL	clean	5 observed indicators, none listed	19.7k records 4 minutes ago
Phishing.Database	IP / domain / URL	clean	5 observed indicators, none listed	391.5k records 3 hours ago
ThreatFox	IP / domain / URL	clean	5 observed indicators, none listed	1,153 records 4 minutes ago

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 9 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

2 clear

Source	Checks	Result	Detail	Feed
Sigma rules	Behavior log	clean	-	2,275 records 5 hours ago
Signature rules	Sample content	clean	no rule matched	110 records 4 minutes ago

Tooling catalogs

3 clear · 1 not checked

Source	Checks	Result	Detail	Feed
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 3 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 4 minutes ago
LOLRMM	Names and domains	clean	1 name/domain indicator checked, no remote-management tooling	360 records 4 minutes ago
LOLBAS	Process image paths	not checked	no process image path observed to check	245 records 4 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 2 info

File indicators

Severity	Type	Indicator	Description
info	sample_sha256	3e9f563cb2287fcde4843fda42f7370ce2fa364343f5c3ce35339b15215ad599	Submitted sample (SHA256)
info	sample_md5	567eb8956737a817637fa15ae21633dd	Submitted sample (MD5)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2933

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-10-23 22:00 Shown below	Windows 10 22H2	No threats detected	0/100