Clean
0/100
Nothing scored against this sample. A run reads as suspicious from 35.
Why this verdict
Every layer that ran completed without scoring anything against this sample.
Analysis layers
Structure
What the file is made of: headers, imports, how it was built and whether it was signed.
Sections & resources
How the file is laid out in memory, and what is embedded in it: section roles, access rights, entropy and every resource entry.
Signatures & packing
What matched and what is hidden: YARA rules, capa capabilities, family attribution, packer detection, unpacked payloads and recovered configuration.
Strings
The readable content: embedded secrets, flagged strings and everything extraction recovered.
Code
What the sample would execute: the emulated API call sequence, and the disassembled entry point.
Packer detection looks at a program's entry point, sections and entropy. This file is not a program image, so there was nothing of that kind to assess.
ELF header
x86-64 · 64-bit| Type | ET_DYN |
|---|---|
| Machine | x86-64 (little-endian) |
| Entry point | 0x1230 |
| Interpreter | /lib64/ld-linux-x86-64.so.2 |
| Linkage | dynamic PIE has symbols |
| Hardening | NX full RELRO |
ELF sections
31 total| Name | Type | Size | Flags | Entropy |
|---|---|---|---|---|
| - | SHT_NULL | 0.0 B | - | |
| .interp | SHT_PROGBITS | 28.0 B | ALLOC | 3.9408 |
| .note.gnu.property | SHT_NOTE | 48.0 B | ALLOC | 1.9345 |
| .note.gnu.build-id | SHT_NOTE | 36.0 B | ALLOC | 4.2472 |
| .note.ABI-tag | SHT_NOTE | 32.0 B | ALLOC | 1.5613 |
| .gnu.hash | SHT_GNU_HASH | 40.0 B | ALLOC | 2.471 |
| .dynsym | SHT_DYNSYM | 336.0 B | ALLOC | 0.7866 |
| .dynstr | SHT_STRTAB | 227.0 B | ALLOC | 4.7515 |
| .gnu.version | SHT_GNU_versym | 28.0 B | ALLOC | 1.8427 |
| .gnu.version_r | SHT_GNU_verneed | 80.0 B | ALLOC | 2.6329 |
| .rela.dyn | SHT_RELA | 216.0 B | ALLOC | 1.4338 |
| .rela.plt | SHT_RELA | 168.0 B | ALLOC | 1.2173 |
| .init | SHT_PROGBITS | 27.0 B | ALLOCEXECINSTR | 4.2364 |
| .plt | SHT_PROGBITS | 128.0 B | ALLOCEXECINSTR | 3.9064 |
| .plt.got | SHT_PROGBITS | 16.0 B | ALLOCEXECINSTR | 3.375 |
| .plt.sec | SHT_PROGBITS | 112.0 B | ALLOCEXECINSTR | 3.5505 |
| .text | SHT_PROGBITS | 505.0 B | ALLOCEXECINSTR | 5.5051 |
| .fini | SHT_PROGBITS | 13.0 B | ALLOCEXECINSTR | 3.2389 |
| .rodata | SHT_PROGBITS | 61.0 B | ALLOC | 4.6601 |
| .eh_frame_hdr | SHT_PROGBITS | 60.0 B | ALLOC | 3.0892 |
| .eh_frame | SHT_PROGBITS | 228.0 B | ALLOC | 4.1368 |
| .init_array | SHT_INIT_ARRAY | 8.0 B | WRITEALLOC | 1.0613 |
| .fini_array | SHT_FINI_ARRAY | 8.0 B | WRITEALLOC | 1.0613 |
| .dynamic | SHT_DYNAMIC | 496.0 B | WRITEALLOC | 1.4484 |
| .got | SHT_PROGBITS | 120.0 B | WRITEALLOC | 0.9361 |
| .data | SHT_PROGBITS | 16.0 B | WRITEALLOC | 0.6686 |
| .bss | SHT_NOBITS | 16.0 B | WRITEALLOC | - |
| .comment | SHT_PROGBITS | 45.0 B | 4.1278 |
|
| .symtab | SHT_SYMTAB | 1.0 KB | 1.6872 |
|
| .strtab | SHT_STRTAB | 634.0 B | 4.9668 |
|
| .shstrtab | SHT_STRTAB | 282.0 B | 4.2703 |
Needed libraries
1Imported symbols
12Extracted strings
showing 75- /lib64/ld-linux-x86-64.so.2
- fgets
- perror
- __stack_chk_fail
- __printf_chk
- fopen
- stdout
- __libc_start_main
- __cxa_finalize
- fputs
- libc.so.6
- GLIBC_2.3.4
- GLIBC_2.4
- GLIBC_2.2.5
- GLIBC_2.34
- _ITM_deregisterTMCloneTable
- _ITM_registerTMCloneTable
- ;Namet
- /proc/self/status
- open
- Name
- argv[0]=%s argc=%d\n
- Scrt1.o
- __abi_tag
- procinfo.c
- main.cold
- deregister_tm_clones
- completed.0
- __do_global_dtors_aux_fini_array_entry
- frame_dummy
- __frame_dummy_init_array_entry
- _DYNAMIC
- _GLOBAL_OFFSET_TABLE_
- __libc_start_main@GLIBC_2.34
- stdout@GLIBC_2.2.5
- _edata
- _fini
- __stack_chk_fail@GLIBC_2.4
- fgets@GLIBC_2.2.5
- __data_start
- __dso_handle
- _IO_stdin_used
- __bss_start
- main
- __printf_chk@GLIBC_2.3.4
- fopen@GLIBC_2.2.5
- perror@GLIBC_2.2.5
- __cxa_finalize@GLIBC_2.2.5
- _init
- .strtab
- .shstrtab
- .interp
- .note.gnu.property
- .note.gnu.build-id
- .note.ABI-tag
- .gnu.hash
- .dynstr
- .gnu.version
- .gnu.version_r
- .rela.dyn
- .rela.plt
- .init
- .plt.got
- .plt.sec
- .text
- .fini
- .rodata
- .eh_frame_hdr
- .eh_frame
- .init_array
- .fini_array
- .dynamic
- .data
- .bss
- .comment
No strings match this filter.
Stack and decoded strings were not recovered: string emulation failed on this file. Only literal strings present in the file are listed above.
Nothing in this view
This sample produced no results for this part of the static analysis.
VM console
headless guestThe Linux sandbox runs a server image with no desktop, so there is no screen to record - this is the boot console, kept because a kernel panic or an out-of-memory kill would show up here and in no other layer. What the sample did is under Behavior, File & registry and Network, captured from the syscall trace rather than from pixels.
Behavior summary
1 process(es) observed
MITRE ATT&CK
2 techniquesSyscall summary
top calls| brk | 3 |
|---|---|
| mmap | 8 |
| access | 1 |
| execve | 1 |
| munmap | 1 |
| openat | 3 |
| mprotect | 3 |
| exit_group | 1 |
Persistence & evasion
No persistence or evasion behavior observed.
No network activity - the run was isolated
This detonation was given no internet connection, so a sample that wanted to reach out could not. An empty section here says nothing about whether it tried.
Process tree
What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.
procinfo
1 processAttributed activity
Established mechanisms
cleanNo persistence established
None of the 90 auto-start methods below were established during this run.
Detection coverage
0 / 90Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.
- Active Setup Installed Component T1547.014 clean
- Explorer Delay-Load Object T1547.001 clean
- Explorer Run Key T1547.001 clean
- Explorer SharedTaskScheduler T1547.001 clean
- Group Policy Extension DLL T1547.004 clean
- Group Policy Run Key T1547.001 clean
- Logon Script T1037.001 clean
- RDP WDS Startup Program T1547.001 clean
- Registry Run Key T1547.001 clean
- Registry RunEx Key T1547.001 clean
- Registry RunOnce Key T1547.001 clean
- Registry RunOnceEx Key T1547.001 clean
- Registry RunServices Key T1547.001 clean
- Startup Folder Item T1547.001 clean
- Startup Folder Redirection T1547.001 clean
- Terminal Services Initial Program T1547.001 clean
- Winlogon GINA DLL T1547.004 clean
- Winlogon MPNotify Value T1547.004 clean
- Winlogon Notify Package T1547.004 clean
- Winlogon Shell Value T1547.004 clean
- Winlogon Taskman Value T1547.004 clean
- Winlogon Userinit Value T1547.004 clean
- BITS Job T1197 clean
- Print Monitor DLL T1547.010 clean
- Print Processor DLL T1547.012 clean
- Scheduled Task T1053.005 clean
- Scheduled Task Registry Implant T1053.005 clean
- Service Control Manager Security Descriptor T1574.011 clean
- Service DLL Hijack T1543.003 clean
- Time Provider DLL T1547.003 clean
- Windows Service Creation T1543.003 clean
- .NET Managed Debugger T1546.012 clean
- Accessibility Tool Hijack T1546.008 clean
- AeDebug Postmortem Debugger T1546.012 clean
- App Paths Hijack T1546.012 clean
- Application Shim Database T1546.011 clean
- Boot Verification Program T1547.002 clean
- Command Processor AutoRun T1546.011 clean
- Explorer Load Value T1547.001 clean
- Explorer MyComputer Tool Hijack T1546.001 clean
- Registry Image File Execution Options T1546.012 clean
- Screensaver Hijack T1546.002 clean
- Setup ErrorHandler Script T1546 clean
- Shell Open Command Hijack T1546.001 clean
- SilentProcessExit Monitor T1546.012 clean
- Telemetry Controller Command T1546.015 clean
- WER ReflectDebugger T1546.012 clean
- Windows Error Reporting Debugger T1546.012 clean
- .NET CLR Profiler DLL T1574.012 clean
- .NET Startup Hook DLL T1574 clean
- AppCert DLLs T1546.009 clean
- AppInit DLLs T1546.010 clean
- AutodialDLL Winsock Injection T1546.006 clean
- DLL Search-Order Hijack T1574.001 T1574.002 clean
- DNS Server Plugin DLL T1574.001 clean
- HTML Help Helper DLL T1546 clean
- KnownDLLs Manipulation T1574.001 clean
- Natural Language Platform DLL Override T1546 clean
- Netsh Helper DLL T1546.007 clean
- Winsock Layered Service Provider T1546.006 clean
- Browser Extension T1176 clean
- Browser Helper Object T1176 clean
- COM Server Hijack T1546.015 clean
- HTML Help COM Object Hijack T1546.015 clean
- Shell Context Menu Handler T1546.001 clean
- Shell Extension Handler T1546.001 clean
- Account RID Hijack T1098 clean
- AMSI Provider T1562.001 clean
- Credential Provider T1547.014 clean
- DSRM Admin Logon Backdoor T1556 clean
- Hidden Local Account T1136.001 clean
- LSA Authentication Package T1547.002 clean
- LSA Extension DLL T1547.005 clean
- LSA Notification Package T1547.005 clean
- LSA Security Package T1547.005 clean
- Network Provider DLL T1556.008 clean
- Security Support Provider T1547.005 clean
- Netsh Port Proxy T1090.001 clean
- Office Add-in T1137.006 clean
- Office Executable Sideload T1574.002 clean
- Office Startup Template T1137.001 clean
- Office Test Key T1137.002 clean
- Power Automate Flow T1546 clean
- PowerShell Profile T1546.013 clean
- Windows Terminal Startup Action T1546 clean
- WMI Event Subscription T1546.003 clean
- BootExecute Native Image T1547.002 clean
- PlatformExecute Native Image T1547.002 clean
- SetupExecute Native Image T1547.002 clean
- UEFI / Bootkit Artifact T1542.003 T1542.001 clean
File activity summary
File & registry ops
3 file · 0 registry · sample scope
| Operation | Target | Process | |
|---|---|---|---|
| read |
/etc/ld.so.cache
|
- pid 681 | 21:25:10.345117 |
| read |
/lib/x86_64-linux-gnu/libc.so.6
|
- pid 681 | 21:25:10.348763 |
| read |
/proc/self/status
|
- pid 681 | 21:25:10.359782 |
No operations match your filter.
File reputation
6 clear · 1 could not answer| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| VirusTotal | File hash | cannot access | rate limited (free-tier quota) | live lookup |
| MalwareBazaar | File hash | not found | - | live lookup |
| filescan.io | File hash | no detections | - | live lookup |
| MalwareBazaar hash feed | File hash | clean | not in feed | 2,535 records 5 minutes ago |
| MalwareBazaar ransomware feed | File hash | clean | not in feed | 8,271 records 4 hours ago |
| ThreatFox hash IOCs | File hash | clean | not in feed | 1,632 records 6 minutes ago |
| URLhaus payload hashes | File hash | clean | not in feed | 1,474 records 5 minutes ago |
Hash lookups only - the sample itself is never uploaded to any third party.
Network indicators
0 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| blocklist.de | IP / domain / URL | not checked | no IP, domain or URL observed to check | 24.5k records 5 minutes ago |
| CINS Army | IP / domain / URL | not checked | no IP, domain or URL observed to check | 15k records 5 minutes ago |
| Emerging Threats | IP / domain / URL | not checked | no IP, domain or URL observed to check | 580 records 6 minutes ago |
| Feodo Tracker | IP / domain / URL | not checked | no IP, domain or URL observed to check | 5 records 6 minutes ago |
| IPsum | IP / domain / URL | not checked | no IP, domain or URL observed to check | 17.7k records 6 minutes ago |
| Phishing.Database | IP / domain / URL | not checked | no IP, domain or URL observed to check | 391.1k records 4 hours ago |
| ThreatFox | IP / domain / URL | not checked | no IP, domain or URL observed to check | 1,632 records 6 minutes ago |
| URLhaus | IP / domain / URL | not checked | no IP, domain or URL observed to check | 5,155 records 6 minutes ago |
TLS fingerprints
0 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| abuse.ch JA3 blocklist | JA3 / JA4 | not checked | no TLS client fingerprint observed | 97 records 16 hours ago |
| SSL blocklist | JA3 / JA4 | not checked | no TLS client fingerprint observed | 10.7k records 6 minutes ago |
Detection rules
2 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| Sigma rules | Behavior log | clean | - | 2,275 records 22 hours ago |
| YARA rules | Sample content | clean | no rule matched | 110 records 6 minutes ago |
Tooling catalogs
4 clear| Source | Checks | Result | Detail | Feed |
|---|---|---|---|---|
| LOLBAS | Process image paths | clean | 1 process image path, none masqueraded | 244 records 6 minutes ago |
| LOLBootloaders | File hash | clean | not a known vulnerable bootloader | 520 records 5 minutes ago |
| LOLDrivers | File hash | clean | not a known vulnerable driver | 2,306 records 6 minutes ago |
| LOLRMM | Names and domains | clean | 2 name/domain indicators checked, no remote-management tooling | 322 records 5 minutes ago |
Analyst narrative
The analysis indicates that the sample executed successfully within the sandbox environment. The following kill-chain elements were observed: 1. **Initial Access**: The sample was executed, but no specific indicators of initial access were identified in the provided data. 2. **Execution**: The sample utilized the `execve` system call, indicating that it executed a command or script. The behavior summary notes that one process was observed, specifically a process named "procinfo" with the command line `/var/tmp/procinfo`. 3. **Persistence**: There were no indicators of persistence mechanisms employed by the sample. 4. **Defense Evasion**: The analysis did not reveal any specific techniques used for defense evasion. 5. **Command and Control (C2)**: No network connections or communications with external servers were detected, indicating a lack of C2 activity. 6. **Impact**: The impact of the sample could not be determined as there were no actions taken that would indicate a harmful effect. In summary, while the sample executed and demonstrated some capabilities, the lack of persistence, defense evasion, C2 activity, and observable impact limits the conclusions that can be drawn about its intent or potential threat level. The overall verdict is inconclusive due to insufficient evidence of malicious behavior.
Evasion analysis
No evasive checkpoints detected.
File indicators
2| Severity | Type | Indicator | Description |
|---|---|---|---|
| info | sample_sha256 | 8ccffd718e26a65a747f47b7526e1552addb026dfe9aca6d4d7623414815b2b1 | Submitted sample (SHA256) |
| info | sample_md5 | e368b9e30504d6058f897346a9d62494 | Submitted sample (MD5) |
MITRE ATT&CK
2 techniquesSigma detections
0 matches of 2275 rulesThe Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.
Generated rules
No generated rules
Detection rules are auto-generated after analysis.
Extracted files
What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.
No extracted files
Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.
Export & download
/s/2370The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.
AI analysis report
An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).
Headers
Body
Headers
Body
You are about to download the raw, live sample. It is real, potentially destructive malware and can harm your machine if opened or run. Only handle it inside an isolated analysis environment.
Delivered as a ZIP encrypted with the password infected so the bytes are never handled unprotected.
Report this analysis
Analysis reports are produced automatically from files, addresses and text submitted by visitors. If this one publishes your material, identifies you, or should not be public for any other reason, tell us why and an administrator will review it.
Public analyses of this file
1 run| Submitted | Environment | Verdict | Score |
|---|---|---|---|
| 2026-09-07 21:21 Shown below | Static analysis | Clean | 0/100 |