Malwagon
BIN
59474588a312b6b6.bin File Analysis · submitted Sep 8, 2026 14:02 · 1.3 MB
1proc 8files 2IOCs
Clean8 Linux Completed Public
Get sample Report Sign in

Clean

8/100

27 points short of the suspicious line at 35.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+8
Static analysis
  • 1 high-risk capability bucket(s): Defense evasion

Analysis layers

Static ran moved the score
Dynamic ran no points
Threat intel local feeds only no points
AI not included

Sample

TypeFile Linux
MIMEapplication/x-sharedlib

Run conditions

Sandbox OSUbuntu 24.04 (Linux sandbox)
InternetIsolated

Detection signatures

2 detected · 2 withheld as common
Severity Detection Evidence Layer
LOW
Network communication capability
MITRE T1071
seen in 6% of benign software
capability connect capability: network
capability socket capability: network
static
LOW
Resolves a host via getaddrinfo (C2 lookup)
MITRE T1071.004
string getaddrinfo found in the sample's strings
static
Withheld: 2 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Dynamic API resolution (obfuscation) fires on 65% of benign software
Executes external code / commands fires on 30% of benign software

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature
GLIBC(2.8)[DYN AMD64-64]
Not packed
LibraryGLIBC(2.8)[DYN AMD64-64]
Identity
File
typeELF 64-bit LSB shared object, x86-64, version 1 (SYSV)
size1.3 MB
entropy6.1924
Packing
Not packed
The file's code is readable on disk - nothing is compressed or encrypted around it.
0/100
packer confidence
Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
Indicators weighed

Packer detection looks at a program's entry point, sections and entropy. This file is not a program image, so there was nothing of that kind to assess.

Capabilities

4 behaviour buckets · 1 high-risk
SeverityCapabilityMITREAPIs
high Defense evasion
Tampers with security tooling / hides artifacts
 T1070.004, T1562 kill, unlink
med Code execution
Creates processes / runs commands or shellcode
 T1059.004, T1106 execve, fork
med Dynamic API resolution
Resolves APIs at runtime (obfuscation)
 T1129 dlopen, dlsym
med Network / C2
Opens sockets, HTTP or downloads payloads
 T1071, T1095 connect, socket

ELF header

x86-64 · 64-bit
TypeET_DYN
Machinex86-64 (little-endian)
Entry point0x32ef0
Interpreter/lib64/ld-linux-x86-64.so.2
Linkage dynamic PIE stripped
Hardening NX full RELRO

ELF sections

30 total
NameTypeSizeFlagsEntropy
-SHT_NULL0.0 B -
.interpSHT_PROGBITS28.0 B ALLOC
3.9408
.note.gnu.propertySHT_NOTE48.0 B ALLOC
1.9345
.note.gnu.build-idSHT_NOTE36.0 B ALLOC
4.2472
.note.ABI-tagSHT_NOTE32.0 B ALLOC
1.5613
.gnu.hashSHT_GNU_HASH18.9 KB ALLOC
6.3572
.dynsymSHT_DYNSYM58.9 KB ALLOC
3.0477
.dynstrSHT_STRTAB39.2 KB ALLOC
4.3769
.gnu.versionSHT_GNU_versym4.9 KB ALLOC
1.2806
.gnu.version_rSHT_GNU_verneed224.0 B ALLOC
3.254
.rela.dynSHT_RELA56.1 KB ALLOC
2.627
.rela.pltSHT_RELA5.2 KB ALLOC
1.8245
.initSHT_PROGBITS27.0 B ALLOCEXECINSTR
4.3104
.pltSHT_PROGBITS3.5 KB ALLOCEXECINSTR
4.4337
.plt.gotSHT_PROGBITS48.0 B ALLOCEXECINSTR
3.7759
.plt.secSHT_PROGBITS3.5 KB ALLOCEXECINSTR
4.0537
.textSHT_PROGBITS884.8 KB ALLOCEXECINSTR
6.3198
.finiSHT_PROGBITS13.0 B ALLOCEXECINSTR
3.2389
.rodataSHT_PROGBITS102.2 KB ALLOC
5.3493
.eh_frame_hdrSHT_PROGBITS17.8 KB ALLOC
5.99
.eh_frameSHT_PROGBITS110.8 KB ALLOC
5.2322
.init_arraySHT_INIT_ARRAY8.0 B WRITEALLOC
1.5488
.fini_arraySHT_FINI_ARRAY8.0 B WRITEALLOC
1.5488
.data.rel.roSHT_PROGBITS10.5 KB WRITEALLOC
2.5324
.dynamicSHT_DYNAMIC512.0 B WRITEALLOC
1.7297
.gotSHT_PROGBITS2.3 KB WRITEALLOC
2.6056
.dataSHT_PROGBITS33.6 KB WRITEALLOC
1.4707
.bssSHT_NOBITS43.8 KB WRITEALLOC -
.gnu_debuglinkSHT_PROGBITS52.0 B
4.2343
.shstrtabSHT_STRTAB285.0 B
4.2828

Needed libraries

2
libtinfo.so.6libc.so.6

Imported symbols

237
Suspicious
connectdlopendlsymexecveforkkillsocketunlink
BCPCUP_ITM_deregisterTMCloneTable_ITM_registerTMCloneTable__asprintf_chk__ctype_b_loc__ctype_get_mb_cur_max__ctype_tolower_loc__ctype_toupper_loc__cxa_finalize__environ__errno_location__fdelt_chk__fprintf_chk__fpurge__getgroups_chk__gmon_start____libc_current_sigrtmax__libc_current_sigrtmin__libc_start_main__longjmp_chk__mbrlen__mbsnrtowcs_chk__mbsrtowcs_chk__mbstowcs_chk__memcpy_chk__memmove_chk__printf_chk__sigsetjmp__snprintf_chk__sprintf_chk__stack_chk_fail__strcpy_chk__strncpy_chk__vfprintf_chk__vsnprintf_chkabortaccessalarmbindtextdomaincallocchdirchownclearerrcloseclosedirconfstrconnectdcgettextdcngettextdlclosedlerrordlopendlsymdupdup2eaccessendgrentendpwentendserventenvironexecveexitfaccessatfchmodfclosefcntlfdopenferrorfflushfgetsfilenofnmatchfopenforkfputcfputsfreefreeaddrinfo

Extracted strings

showing 200 of 2674
  • /lib64/ld-linux-x86-64.so.2
  • wnsB
  • gbLE
  • .Af#
  • pRDQ
  • __cxa_finalize
  • __libc_start_main
  • strrchr
  • getpwuid
  • strcpy
  • endpwent
  • dcgettext
  • fcntl
  • strstr
  • stdout
  • stderr
  • setresuid
  • setresgid
  • gethostname
  • __stack_chk_fail
  • __fprintf_chk
  • fputs
  • strchr
  • fputc
  • fileno
  • strncpy
  • localtime
  • __strcpy_chk
  • __sprintf_chk
  • ttyname
  • strftime
  • __memmove_chk
  • getcwd
  • clearerr
  • memset
  • strtol
  • __sigsetjmp
  • sigprocmask
  • putchar
  • getuid
  • getgid
  • geteuid
  • getegid
  • gettimeofday
  • __printf_chk
  • isatty
  • strncmp
  • lseek
  • __errno_location
  • fstat
  • __getgroups_chk
  • memmove
  • sysconf
  • __mbstowcs_chk
  • wcswidth
  • getdtablesize
  • group_member
  • confstr
  • strtoimax
  • __vfprintf_chk
  • localeconv
  • __ctype_get_mb_cur_max
  • strnlen
  • __memcpy_chk
  • fwrite
  • strpbrk
  • __fpurge
  • ferror
  • sigemptyset
  • sigaddset
  • calloc
  • __snprintf_chk
  • getpid
  • getppid
  • qsort
  • __longjmp_chk
  • tzset
  • __environ
  • fdopen
  • tcsetattr
  • imaxdiv
  • tcgetpgrp
  • strsignal
  • setpgid
  • sigaction
  • tcgetattr
  • tcsetpgrp
  • strncasecmp
  • __libc_current_sigrtmax
  • __libc_current_sigrtmin
  • strcasecmp
  • wcslen
  • iswupper
  • towlower
  • sigismember
  • sigdelset
  • strcoll
  • __asprintf_chk
  • setservent
  • getservent
  • endservent
  • setgrent
  • getgrent
  • endgrent
  • strcat
  • fopen
  • fgets
  • __strncpy_chk
  • setlocale
  • iconv_close
  • bindtextdomain
  • strcasestr
  • dlopen
  • dlerror
  • unlink
  • dcngettext
  • getrlimit
  • umask
  • __mbrlen
  • getrusage
  • setrlimit
  • __vsnprintf_chk
  • wcscoll
  • __ctype_tolower_loc
  • wctob
  • iswctype
  • wmemchr
  • mbsinit
  • strtold
  • strtoumax
  • opendir
  • readdir
  • closedir
  • strchrnul
  • wcrtomb
  • setvbuf
  • getpeername
  • readlink
  • iswprint
  • strdup
  • setitimer
  • pselect
  • __fdelt_chk
  • ioctl
  • getrandom
  • wcwidth
  • putenv
  • unsetenv
  • regcomp
  • regexec
  • regfree
  • faccessat
  • getaddrinfo
  • socket
  • freeaddrinfo
  • gai_strerror
  • pathconf
  • mkstemp
  • iswalnum
  • __ctype_toupper_loc
  • iswlower
  • towupper
  • wctomb
  • iconv
  • iconv_open
  • setpwent
  • getpwent
  • rename
  • fnmatch
  • chown
  • getpwnam
  • nl_langinfo
  • chdir
  • fchmod
  • _ITM_deregisterTMCloneTable
  • _ITM_registerTMCloneTable
  • tgetnum
  • tputs
  • tgoto
  • tgetent
  • tgetflag
  • tgetstr
  • libtinfo.so.6
  • libc.so.6
  • sigwinch_sighandler
  • sh_modcase
  • parse_shellopts
  • strvec_search
  • parse_string
  • _rl_set_normal_color
  • protected_mode
  • rl_show_char
  • rl_byte_oriented
  • rl_filename_quoting_desired
  • search_for_command
  • _rl_eof_char
  • _rl_start_using_history
  • shell_glob_filename
  • _rl_intr_char
  • sourcenest_max

Stack and decoded strings were not recovered: string emulation failed on this file. Only literal strings present in the file are listed above.

VM console

headless guest

The Linux sandbox runs a server image with no desktop, so there is no screen to record - this is the boot console, kept because a kernel panic or an out-of-memory kill would show up here and in no other layer. What the sample did is under Behavior, File & registry and Network, captured from the syscall trace rather than from pixels.

VM console

Behavior summary

1 process(es) observed

Launched/var/tmp/59474588a312b6b6e73e5a42a59bf71e62b55416b6c9d5e4
Execution::Native API [T1106]Execution::Command and Scripting Interpreter [T1059]

MITRE ATT&CK

2 techniques
Execution
Native API
T1106
Execution
Command and Scripting Interpreter
T1059

Syscall summary

top calls
brk3
mmap14
access1
execve1
getcwd1
munmap1
openat8
socket2
connect2
mprotect4
exit_group1
newfstatat2
rt_sigaction14
rt_sigprocmask5

Persistence & evasion

No persistence or evasion behavior observed.

No network activity - the run was isolated

This detonation was given no internet connection, so a sample that wanted to reach out could not. An empty section here says nothing about whether it tried.

Network capture

paid plan

Nothing is being held back from this report. The guest had no route off its segment, so there was no traffic to capture at all - the seven observers below are what a detonation with live internet fills in, and on this run not one of them had anything to see.

  • DNS queriesEvery name the guest resolves, the record type and the address that answered.
  • ConnectionsEach remote address and port, with the process that opened the socket.
  • HTTP and HTTPS requestsMethod, host and path, and what the server sent back to the guest.
  • TLS handshakesSNI host, certificate and the JA3 and JA4 fingerprints of the client.
  • IDS alertsThe full capture replayed through the intrusion detection ruleset.
  • Beaconing, DGA and fast fluxPeriodic call-home intervals, generated names and address spread.
  • Indicator reputationEach address and host checked against the threat intelligence feeds.

See plans Create a free account A live-internet detonation is a paid-plan option. An account on its own still runs isolated.

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process
8file operations

59474588a312b6b6.bin

1 process
1 process

Attributed activity

0Mechanisms found
90Methods checked
0ATT&CK techniques
NONEHighest severity

Established mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

Logon & Startup 22 clean
  • Active Setup Installed Component T1547.014 clean
  • Explorer Delay-Load Object T1547.001 clean
  • Explorer Run Key T1547.001 clean
  • Explorer SharedTaskScheduler T1547.001 clean
  • Group Policy Extension DLL T1547.004 clean
  • Group Policy Run Key T1547.001 clean
  • Logon Script T1037.001 clean
  • RDP WDS Startup Program T1547.001 clean
  • Registry Run Key T1547.001 clean
  • Registry RunEx Key T1547.001 clean
  • Registry RunOnce Key T1547.001 clean
  • Registry RunOnceEx Key T1547.001 clean
  • Registry RunServices Key T1547.001 clean
  • Startup Folder Item T1547.001 clean
  • Startup Folder Redirection T1547.001 clean
  • Terminal Services Initial Program T1547.001 clean
  • Winlogon GINA DLL T1547.004 clean
  • Winlogon MPNotify Value T1547.004 clean
  • Winlogon Notify Package T1547.004 clean
  • Winlogon Shell Value T1547.004 clean
  • Winlogon Taskman Value T1547.004 clean
  • Winlogon Userinit Value T1547.004 clean
Services & Tasks 9 clean
  • BITS Job T1197 clean
  • Print Monitor DLL T1547.010 clean
  • Print Processor DLL T1547.012 clean
  • Scheduled Task T1053.005 clean
  • Scheduled Task Registry Implant T1053.005 clean
  • Service Control Manager Security Descriptor T1574.011 clean
  • Service DLL Hijack T1543.003 clean
  • Time Provider DLL T1547.003 clean
  • Windows Service Creation T1543.003 clean
Execution Hijack 17 clean
  • .NET Managed Debugger T1546.012 clean
  • Accessibility Tool Hijack T1546.008 clean
  • AeDebug Postmortem Debugger T1546.012 clean
  • App Paths Hijack T1546.012 clean
  • Application Shim Database T1546.011 clean
  • Boot Verification Program T1547.002 clean
  • Command Processor AutoRun T1546.011 clean
  • Explorer Load Value T1547.001 clean
  • Explorer MyComputer Tool Hijack T1546.001 clean
  • Registry Image File Execution Options T1546.012 clean
  • Screensaver Hijack T1546.002 clean
  • Setup ErrorHandler Script T1546 clean
  • Shell Open Command Hijack T1546.001 clean
  • SilentProcessExit Monitor T1546.012 clean
  • Telemetry Controller Command T1546.015 clean
  • WER ReflectDebugger T1546.012 clean
  • Windows Error Reporting Debugger T1546.012 clean
DLL Load Order 12 clean
  • .NET CLR Profiler DLL T1574.012 clean
  • .NET Startup Hook DLL T1574 clean
  • AppCert DLLs T1546.009 clean
  • AppInit DLLs T1546.010 clean
  • AutodialDLL Winsock Injection T1546.006 clean
  • DLL Search-Order Hijack T1574.001 T1574.002 clean
  • DNS Server Plugin DLL T1574.001 clean
  • HTML Help Helper DLL T1546 clean
  • KnownDLLs Manipulation T1574.001 clean
  • Natural Language Platform DLL Override T1546 clean
  • Netsh Helper DLL T1546.007 clean
  • Winsock Layered Service Provider T1546.006 clean
COM & Browser 6 clean
  • Browser Extension T1176 clean
  • Browser Helper Object T1176 clean
  • COM Server Hijack T1546.015 clean
  • HTML Help COM Object Hijack T1546.015 clean
  • Shell Context Menu Handler T1546.001 clean
  • Shell Extension Handler T1546.001 clean
Security Providers & Accounts 11 clean
  • Account RID Hijack T1098 clean
  • AMSI Provider T1562.001 clean
  • Credential Provider T1547.014 clean
  • DSRM Admin Logon Backdoor T1556 clean
  • Hidden Local Account T1136.001 clean
  • LSA Authentication Package T1547.002 clean
  • LSA Extension DLL T1547.005 clean
  • LSA Notification Package T1547.005 clean
  • LSA Security Package T1547.005 clean
  • Network Provider DLL T1556.008 clean
  • Security Support Provider T1547.005 clean
Scripting & Applications 9 clean
  • Netsh Port Proxy T1090.001 clean
  • Office Add-in T1137.006 clean
  • Office Executable Sideload T1574.002 clean
  • Office Startup Template T1137.001 clean
  • Office Test Key T1137.002 clean
  • Power Automate Flow T1546 clean
  • PowerShell Profile T1546.013 clean
  • Windows Terminal Startup Action T1546 clean
  • WMI Event Subscription T1546.003 clean
Boot & Firmware 4 clean
  • BootExecute Native Image T1547.002 clean
  • PlatformExecute Native Image T1547.002 clean
  • SetupExecute Native Image T1547.002 clean
  • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 1 modify 0 delete 0 rename 0

File & registry ops

8 file · 0 registry · sample scope
OperationTargetProcess
read
/etc/ld.so.cache
syscall_trace
 - pid 681 14:03:02.505525
read
/lib/x86_64-linux-gnu/libtinfo.so.6
syscall_trace
 - pid 681 14:03:02.508852
read
/lib/x86_64-linux-gnu/libc.so.6
syscall_trace
 - pid 681 14:03:02.517009
write
/dev/tty
syscall_trace
 - pid 681 14:03:02.531218
read
/usr/lib/locale/locale-archive
syscall_trace
 - pid 681 14:03:02.531883
read
/usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
syscall_trace
 - pid 681 14:03:02.532417
read
/etc/nsswitch.conf
syscall_trace
 - pid 681 14:03:02.536629
read
/etc/passwd
syscall_trace
 - pid 681 14:03:02.536871

Threat intelligence

paid plan

Threat intelligence enrichment is a paid-plan layer. On a paid plan every extracted indicator - hashes, addresses, hostnames - is checked against the reputation services and the ingested feeds this platform refreshes on a schedule, and what is already known is flagged as known instead of being rediscovered by hand.

Nothing is being withheld from this report. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

AI analysis

paid plan

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the evasion read from them. The sample itself is never given to it.

Nothing is being withheld from this report. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 0 suspicious 2 info

File indicators

2
SeverityTypeIndicatorDescription
info sample_sha256 59474588a312b6b6e73e5a42a59bf71e62b55416b6c9d5e4a6e1c630c2a9ecd4 Submitted sample (SHA256)
info sample_md5 d7bc3ce3b6b7ac53ba2918a97d806418 Submitted sample (MD5)

MITRE ATT&CK

2 techniques
Execution
Native API
T1106
Execution
Command and Scripting Interpreter
T1059

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

No generated rules

Detection rules are auto-generated after analysis.

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2392

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

2 runs

This file has been analysed more than once. The report below is the run that found the most, which is not always the most recent one.

SubmittedEnvironmentVerdictScore
2026-09-08 14:02 Shown below Ubuntu 24.04 (Linux sandbox) Clean 8/100
2026-09-08 11:12 Windows 10 22H2 Clean 8/100