Borion.dlltigerrat analysis report - Suspicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

32.0sto launch

55telemetry events

34observed

65agent notes

Suspicious

43/100

8 points past the suspicious line at 35, 27 short of malicious at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+35

Malware family

Identified as Tiger RAT (possible confidence, named by static_yara)

Static analysis

1 high-risk capability bucket(s): Process injection
Local ML score 88.9 is not charged on its own: it separates signed from unsigned software, so it corroborates measured evidence and never replaces it

Model review

findings review (advisory, not scored): malicious - dll executed via regsvr32, tigerrat signature family match, high static risk score, registry state writes

Model reading

Measured SUSPICIOUS43 of 100

Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

Reads this report's derived findings, never the sample itself.

A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

Other high-severity findings

HIGH Thread-context hijack injection (SetThreadContext)

Analysis layers

Static ran moved the score

Dynamic ran no points

Threat intel local feeds only no points

AI not included

Sample

TypeFile

MIMEapplication/vnd.microsoft.portable-executable

Run conditions

Sandbox OSWindows 10

EnvironmentWorkgroup

InternetIsolated

Execution140s

Guest hardware2 vCPU4095 MB RAM

Malware family

1 independent source

Tiger RAT possible

Named by a single source. Treat it as a lead rather than a classification.

Layer	Source	What it matched
static_yara	rule corpus	TigerRAT_pe_yaraify

Detection signatures

14 detected · 9 withheld as common

Severity	Detection	Evidence	Layer
HIGH	Download-and-run via URLMon (URLDownloadToFile) MITRE T1105	import urlmon.dll!URLDownloadToFileA	static
HIGH	Thread-context hijack injection (SetThreadContext) MITRE T1055.003	import api-ms-win-core-processthreads-l1-1-1.dll!SetThreadContext requires setthreadcontext import api-ms-win-core-processthreads-l1-1-1.dll!GetThreadContext requires getthreadcontext	static
MED	Opens/suspends remote threads MITRE T1055	import api-ms-win-core-processthreads-l1-1-0.dll!OpenThread requires openthread import api-ms-win-core-processthreads-l1-1-0.dll!SuspendThread requires suspendthread	static
MED	TLS callback (pre-main execution) MITRE T1055	pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point	static
MED	Writes the clipboard (hijack/replace) MITRE T1115	import user32.dll!SetClipboardData	static
LOW	Deletes files/backups (WriteFile + DeleteFile recursion) MITRE T1485 seen in 14% of benign software	import api-ms-win-core-file-l1-1-0.dll!DeleteFileW requires deletefile import api-ms-win-core-file-l1-1-0.dll!FindNextFileW requires findnextfile	static
LOW	Direct memory execution (VirtualProtect + memory copy) MITRE T1055 seen in 9% of benign software	import api-ms-win-core-memory-l1-1-0.dll!VirtualProtect requires virtualprotect import api-ms-win-core-memory-l1-1-0.dll!VirtualAlloc requires virtualalloc	static
LOW	Enumerates running processes MITRE T1057	import api-ms-win-core-toolhelp-l1-1-0.dll!CreateToolhelp32Snapshot	static
LOW	Executable heap allocation (GlobalAlloc + VirtualProtect) MITRE T1055 seen in 6% of benign software	import api-ms-win-core-heap-l2-1-0.dll!GlobalAlloc requires globalalloc import api-ms-win-core-memory-l1-1-0.dll!VirtualProtect requires virtualprotect	static
LOW	Network communication capability MITRE T1071 seen in 6% of benign software	capability urldownloadtofilea capability: network	static
LOW	Process-injection capability MITRE T1055 seen in 5% of benign software	capability getthreadcontext capability: injection capability setthreadcontext capability: injection	static
LOW	Reflective/manual DLL load pattern MITRE T1620 seen in 8% of benign software	import api-ms-win-core-memory-l1-1-0.dll!VirtualAlloc requires virtualalloc import api-ms-win-core-libraryloader-l1-2-0.dll!GetProcAddress requires getprocaddress import api-ms-win-core-libraryloader-l1-2-0.dll!LoadLibraryExW requires loadlibrary import api-ms-win-core-processthreads-l1-1-0.dll!CreateThread requires createthread	static
LOW	Screen-capture capability MITRE T1113 seen in 8% of benign software	capability openclipboard capability: screen_capture	static
LOW	Unsigned DLL	signature no Authenticode signature	static

Withheld: 9 rules fired and were not reported above

These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software

Anti-debugging capability fires on 65% of benign software

Dynamic API resolution (obfuscation) fires on 65% of benign software

Anti-debug: checks for a debugger fires on 60% of benign software

Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software

Reads its own startup info (parent/desktop check) fires on 36% of benign software

Executes external code / commands fires on 30% of benign software

Queries system information (host recon) fires on 25% of benign software

Enumerates files recursively (staging/collection) fires on 21% of benign software

What the tests returned

9 tests

Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

Test	Result
Persistence mechanisms	none established at runtime
Cross-process injection	none observed
Payloads written to disk	none observed
Network connections	not tested - this run had no route out, so an empty network section is a property of the run and not an observation about the sample
Behavioural rule matches (Sigma)	none observed
Known-malicious hash (reputation sources)	no source reported this file
Local anti-virus engine	reported no detection
Capability analysis of the file's code	not checked - the check did not produce a usable result
Anti-analysis / evasion checks	not measured on this run - no in-process API monitor reported in, so the runtime anti-debug and anti-VM calls were never watched

Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

Arguing against malice

The local anti-virus engine reported no detection.
No reputation source reported this file as malicious.

How much weight this carries

Structure only. Structural evidence only. Nothing matching this verdict was seen running. The one fact that decided it: capability analysis of the file's imports.

Instrument coverage

0 of 4 measured

What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

Layer	Ran	What that means
Runtime anti-analysis watch	not measured	Not measured. No in-process monitor reported in on this run, so the runtime anti-debug and anti-VM calls were never watched and an empty list is not a finding about the sample.
API call sequence	not measured	Not measured. No anti-analysis hook armed on this run, so this sequence carries interpreter spawns only and an empty one does not mean the sample called no APIs.
Explicit module loads	not measured	Not measured. No in-process monitor reported in on this run, so no module load could be recorded and an empty list does not mean the sample loaded nothing.
Network capture	not on this plan	Not included on this scan's plan.
Live kernel introspection	not measured	Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

Structure

What the file is made of: headers, imports, how it was built and whether it was signed.

Signature

Microsoft Visual C/C++(19.36.35724)[C++]

Not packed Unsigned

CompilerMicrosoft Visual C/C++(19.36.35724)[C++]

LinkerMicrosoft Linker(14.36.35724)

Identity

File

typedynamic library (DLL)

size6.8 MB

file arch64-bit (x64)

subsystemGUI

entropy5.4524

date2026-02-21 17:31:57 UTC

languageEN

Antivirus engine

no signature matched signature set 28155 - 3.6M signatures

Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

Signature set	Value
Set version	28155
Signatures in the set	3,642,872
Set published	16 Oct 2026 06:24 +0000
Age when this file was scanned	same day

A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

Local ML assessment

88.9 of 100 8 strongest of 2568 features

A gradient-boosted model running entirely on this host scored this file 88.9 of 100 on structure alone: its headers, sections, imports, strings and signature. The file was not executed and nothing about it left this machine.

Read this as corroboration and not as a verdict. Measured across this corpus the model separates signed software from unsigned software more sharply than malicious from benign, so it is charged at most 15 of 100 verdict points and only on top of evidence this report measured for itself. The eight features below are the ones that moved it furthest.

Structural feature	What it means	Pushes	Weight
image flag dll	Image flag: a library rather than a program	towards benign	-1.3760
resource directory size	Size of the resource table (480)	towards malicious	+1.0104
optional.checksum	Header checksum, which is zero on most files that were never signed (0)	towards malicious	+0.6123
feature column 2478	When a timestamp authority countersigned the signature	towards malicious	+0.5828
imported library urlmon.dll	Imports from urlmon.dll	towards malicious	+0.5718
export directory size	Size of the export table	towards malicious	+0.5689
parser warning: Suspicious flags set for section...	Header defect reported by the parse: Suspicious flags set for section... (0)	towards benign	-0.5372
debug directory address	Location of the debug table (4881920)	towards benign	-0.3114

A weight is a log-odds nudge away from the model's own baseline, not a percentage point. Where a feature names a section, an import or a build id, the number beside it is the model's own hashed cell for that name rather than a measurement of the file: two names can share one cell and the sign comes from the hash, so no number is shown for those rows.

Packing

Not packed

This file's code is readable on disk - nothing is compressed or encrypted around it.

8/100

packer confidence

Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.

Indicators weighed 1 signal

TLS callback present

Family configuration search

Incomplete

3 of this platform's 71 family parsers could not decode this file, and none produced a configuration. A parser that carries no signature of its own is handed every file, and every parser that has ever failed here is one of those, so a failure is usually a decoder meeting a family it was not written for rather than a reading about this sample. Where the two numbers below differ, a signature did match and its decoder then returned nothing. The absence of a configuration is not evidence that none is present.

Parsers available	71
Returned a result	4
Failed to decode	3

Capabilities

9 behaviour buckets · 2 high-risk

Severity	Capability	MITRE	APIs
high	Process injection Writes and runs code inside another process	T1055.012	getthreadcontext, setthreadcontext
high	Anti-debugging Detects or obstructs a debugger	T1622	isdebuggerpresent
med	Evasion / stalling Sleeps, times, or otherwise stalls analysis	T1497, T1497.003	getsystemtimeasfiletime, queryperformancecounter, sleep
med	Ransomware behaviour Enumerates + encrypts files, deletes backups	T1083	findfirstfilew, findnextfilew
med	Code execution Creates processes / runs commands or shellcode	T1106	createthread
med	Dynamic API resolution Resolves APIs at runtime (obfuscation)	T1129	getprocaddress
med	Screen capture Grabs the screen / clipboard	T1115	openclipboard
med	Network / C2 Opens sockets, HTTP or downloads payloads	T1105	urldownloadtofilea
low	Discovery Enumerates the host, users, processes or network	T1057, T1082	createtoolhelp32snapshot, getsysteminfo

Security mitigations

partial posture

ON ASLR (DynamicBase)

ON High-entropy ASLR (64-bit)

ON DEP / NX (NxCompat)

OFF Control Flow Guard

OFF SafeSEH

ON Stack cookies (GS)

OFF Force Integrity

OFF AppContainer isolation

OFF Authenticode signed

Rich header (toolchain)

richhash 38698b437aac9e80

Tool	Build	Uses
Export 14.10	33145	192
Cvtres 14.10	33145	43
Utc1900 (VS2017)	33145	22
Cvtres 14.10	35403	15
Utc1900 (VS2017)	35403	12
Export 14.10	35403	99
prodid_147	30729	72
Utc1900 (VS2017)	33145	13
Import (linker)	0	194
Cvtres 14.10	35724	4
Export 14.10	35724	313
Implib	35724	1
AliasObj 14.10	35724	1

Sections

7 sections · the file's memory layout

Section	Virtual addr	Raw size	Virtual size	Access	Entropy
.textEP Executable code	0x1000	4.5 MB	4.5 MB	EXECUTEREAD	6.4474
.rdata Read-only data	0x477000	682.5 KB	682.1 KB	READ	5.5672
.data Initialised data	0x522000	1.5 MB	1.6 MB	READWRITE	0.0682
.pdata Exception unwind data	0x6b2000	80.0 KB	80.0 KB	READ	6.303
.fptable Non-standard section	0x6c6000	512.0 B	256.0 B	READWRITE	0.0
.rsrc Resources	0x6c7000	512.0 B	480.0 B	READ	4.7148
.reloc Base relocations	0x6c8000	21.5 KB	21.0 KB	READ	5.4221

code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

Imports

165 funcs / 38 DLLs · 10 suspicious

▸VERSION.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetFileVersionInfoSizeA	0x00477040	-	-
GetFileVersionInfoA	0x00477048	-	-
VerQueryValueA	0x00477050	-	-

▸api-ms-win-core-synch-l1-2-0.dll6 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
InitOnceBeginInitialize	0x00477560	-	-
SleepConditionVariableSRW	0x00477568	-	-
WakeAllConditionVariable	0x00477570	-	-
WakeConditionVariable	0x00477578	-	-
InitOnceComplete	0x00477580	-	-
Sleep	0x00477588	-	-

▸api-ms-win-core-processthreads-l1-1-0.dll13 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
ExitProcess	0x004773f0	-	-
GetCurrentThreadId	0x004773f8	-	-
OpenThread	0x00477400	-	-
SuspendThread	0x00477408	-	-
ResumeThread	0x00477410	-	-
GetCurrentProcessId	0x00477418	-	-
GetExitCodeThread	0x00477420	-	-
SwitchToThread	0x00477428	-	-
CreateThread	0x00477430	-	-
GetStartupInfoW	0x00477438	-	-
ExitThread	0x00477440	-	-
TerminateProcess	0x00477448	-	-
GetCurrentProcess	0x00477450	-	-

▸api-ms-win-core-libraryloader-l1-2-0.dll9 funcs 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetModuleFileNameA	0x004772b0	-	-
GetModuleFileNameW	0x004772b8	-	-
FreeLibraryAndExitThread	0x004772c0	-	-
GetModuleHandleW	0x004772c8	-	-
GetModuleHandleExW	0x004772d0	-	-
FreeLibrary	0x004772d8	-	-
GetProcAddress	0x004772e0	-	T1129
DisableThreadLibraryCalls	0x004772e8	-	-
LoadLibraryExW	0x004772f0	-	-

▸api-ms-win-core-sysinfo-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetSystemInfo	0x00477598	-	-
GetSystemTimeAsFileTime	0x004775a0	-	-

▸api-ms-win-core-processenvironment-l1-1-0.dll9 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
FreeEnvironmentStringsW	0x004773a0	-	-
SetStdHandle	0x004773a8	-	-
SetEnvironmentVariableW	0x004773b0	-	-
GetCommandLineA	0x004773b8	-	-
GetCommandLineW	0x004773c0	-	-
GetEnvironmentVariableA	0x004773c8	-	-
GetStdHandle	0x004773d0	-	-
GetEnvironmentStringsW	0x004773d8	-	-
GetCurrentDirectoryW	0x004773e0	-	-

▸api-ms-win-core-memory-l1-1-0.dll4 funcs 2 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
VirtualProtect	0x00477368	-	T1055
VirtualAlloc	0x00477370	-	T1055
VirtualQuery	0x00477378	-	-
VirtualFree	0x00477380	-	-

▸api-ms-win-core-heap-l2-1-0.dll3 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GlobalAlloc	0x00477260	-	-
GlobalFree	0x00477268	-	-
LocalFree	0x00477270	-	-

▸api-ms-win-core-heap-obsolete-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GlobalLock	0x00477280	-	-
GlobalUnlock	0x00477288	-	-

▸api-ms-win-core-handle-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CloseHandle	0x00477210	-	-

▸api-ms-win-core-errorhandling-l1-1-0.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetLastError	0x004770e0	-	-
SetLastError	0x004770e8	-	-
UnhandledExceptionFilter	0x004770f0	-	-
RaiseException	0x004770f8	-	-
SetUnhandledExceptionFilter	0x00477100	-	-

▸api-ms-win-core-heap-l1-1-0.dll7 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
HeapSize	0x00477220	-	-
GetProcessHeap	0x00477228	-	-
HeapAlloc	0x00477230	-	-
HeapDestroy	0x00477238	-	-
HeapReAlloc	0x00477240	-	-
HeapFree	0x00477248	-	-
HeapCreate	0x00477250	-	-

▸api-ms-win-core-processthreads-l1-1-1.dll4 funcs 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
IsProcessorFeaturePresent	0x00477460	-	-
FlushInstructionCache	0x00477468	-	-
SetThreadContext	0x00477470	-	T1055
GetThreadContext	0x00477478	-	-

▸api-ms-win-core-toolhelp-l1-1-0.dll3 funcs 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CreateToolhelp32Snapshot	0x00477610	-	T1057
Thread32First	0x00477618	-	-
Thread32Next	0x00477620	-	-

▸api-ms-win-core-string-l1-1-0.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CompareStringW	0x004774d8	-	-
GetStringTypeW	0x004774e0	-	-
CompareStringEx	0x004774e8	-	-
MultiByteToWideChar	0x004774f0	-	-
WideCharToMultiByte	0x004774f8	-	-

▸api-ms-win-core-console-l1-1-0.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
ReadConsoleW	0x00477070	-	-
WriteConsoleA	0x00477078	-	-
GetConsoleMode	0x00477080	-	-
GetConsoleOutputCP	0x00477088	-	-
WriteConsoleW	0x00477090	-	-

▸api-ms-win-core-file-l1-1-0.dll19 funcs 2 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
FindFirstFileW	0x00477138	-	T1083
WriteFile	0x00477140	-	-
GetFileSizeEx	0x00477148	-	-
ReadFile	0x00477150	-	-
FindNextFileW	0x00477158	-	T1083
FlushFileBuffers	0x00477160	-	-
FindFirstFileExW	0x00477168	-	-
FindClose	0x00477170	-	-
GetFileType	0x00477178	-	-
CreateFileW	0x00477180	-	-
GetDriveTypeW	0x00477188	-	-
GetFileInformationByHandle	0x00477190	-	-
SetFileInformationByHandle	0x00477198	-	-
GetFullPathNameW	0x004771a0	-	-
DeleteFileW	0x004771a8	-	-
SetEndOfFile	0x004771b0	-	-
GetFileAttributesExW	0x004771b8	-	-
SetFilePointerEx	0x004771c0	-	-
CreateDirectoryW	0x004771c8	-	-

▸api-ms-win-core-timezone-l1-1-0.dll4 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetDynamicTimeZoneInformation	0x004775e8	-	-
SystemTimeToTzSpecificLocalTime	0x004775f0	-	-
GetTimeZoneInformation	0x004775f8	-	-
FileTimeToSystemTime	0x00477600	-	-

▸api-ms-win-core-console-l2-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetConsoleScreenBufferInfo	0x004770a0	-	-
SetConsoleTextAttribute	0x004770a8	-	-

▸KERNEL32.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
IsBadReadPtr	0x00477000	-	-

▸USER32.dll5 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
SetClipboardData	0x00477010	-	-
DefWindowProcA	0x00477018	-	-
OpenClipboard	0x00477020	-	-
CloseClipboard	0x00477028	-	-
EmptyClipboard	0x00477030	-	-

▸urlmon.dll1 func 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
URLDownloadToFileA	0x00477648	-	T1105

▸WINMM.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
PlaySoundA	0x00477060	-	-

▸api-ms-win-core-localization-l1-2-0.dll12 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetLocaleInfoEx	0x00477300	-	-
LCMapStringEx	0x00477308	-	-
FormatMessageA	0x00477310	-	-
GetUserDefaultLCID	0x00477318	-	-
IsValidCodePage	0x00477320	-	-
LCMapStringW	0x00477328	-	-
GetLocaleInfoW	0x00477330	-	-
IsValidLocale	0x00477338	-	-
GetCPInfo	0x00477340	-	-
GetOEMCP	0x00477348	-	-
GetACP	0x00477350	-	-
EnumSystemLocalesW	0x00477358	-	-

▸api-ms-win-core-file-l1-2-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CreateFile2	0x004771d8	-	-

▸api-ms-win-core-file-l1-2-2.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
AreFileApisANSI	0x004771e8	-	-

▸api-ms-win-core-file-l2-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CopyFile2	0x004771f8	-	-
GetFileInformationByHandleEx	0x00477200	-	-

▸api-ms-win-core-rtlsupport-l1-1-0.dll6 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
RtlUnwind	0x004774a0	yes	-
RtlCaptureContext	0x004774a8	yes	-
RtlLookupFunctionEntry	0x004774b0	yes	-
RtlUnwindEx	0x004774b8	yes	-
RtlVirtualUnwind	0x004774c0	yes	-
RtlPcToFileHeader	0x004774c8	yes	-

▸api-ms-win-core-synch-l1-1-0.dll10 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
LeaveCriticalSection	0x00477508	-	-
AcquireSRWLockExclusive	0x00477510	-	-
ReleaseSRWLockExclusive	0x00477518	-	-
TryAcquireSRWLockExclusive	0x00477520	-	-
WaitForSingleObjectEx	0x00477528	-	-
InitializeCriticalSectionEx	0x00477530	-	-
DeleteCriticalSection	0x00477538	-	-
AcquireSRWLockShared	0x00477540	-	-
ReleaseSRWLockShared	0x00477548	-	-
EnterCriticalSection	0x00477550	-	-

▸api-ms-win-core-threadpool-l1-2-0.dll4 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
CreateThreadpoolWork	0x004775c0	-	-
SubmitThreadpoolWork	0x004775c8	-	-
FreeLibraryWhenCallbackReturns	0x004775d0	-	-
CloseThreadpoolWork	0x004775d8	-	-

▸api-ms-win-core-profile-l1-1-0.dll2 funcs 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
QueryPerformanceCounter	0x00477488	-	T1497
QueryPerformanceFrequency	0x00477490	-	-

▸api-ms-win-core-sysinfo-l1-2-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetSystemTimePreciseAsFileTime	0x004775b0	-	-

▸api-ms-win-core-util-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
EncodePointer	0x00477630	-	-
DecodePointer	0x00477638	-	-

▸api-ms-win-core-interlocked-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
InitializeSListHead	0x00477298	-	-
InterlockedFlushSList	0x004772a0	-	-

▸api-ms-win-core-fibers-l1-1-0.dll4 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
FlsSetValue	0x00477110	-	-
FlsFree	0x00477118	-	-
FlsAlloc	0x00477120	-	-
FlsGetValue	0x00477128	-	-

▸api-ms-win-core-namedpipe-l1-1-0.dll1 func

Name	File RVA	Is undocumented	MITRE (tactic - technique)
PeekNamedPipe	0x00477390	-	-

▸api-ms-win-core-debug-l1-1-0.dll1 func 1 suspicious

Name	File RVA	Is undocumented	MITRE (tactic - technique)
IsDebuggerPresent	0x004770d0	-	T1622

▸api-ms-win-core-datetime-l1-1-0.dll2 funcs

Name	File RVA	Is undocumented	MITRE (tactic - technique)
GetTimeFormatW	0x004770b8	-	-
GetDateFormatW	0x004770c0	-	-

Binary metadata

what the headers declare about this build

Resource langs	EN
Debug info	yes
TLS callbacks	yes

Code signing

Unsigned

This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

Resources

Resource Hacker view

Manifest1

▸Manifest1

2EN

Select a resource from the tree to inspect its language, size, RVA offset, MD5, entropy and detected content signature - like opening the binary in Resource Hacker.

Manifest 2 Download

Type	Manifest
Name / ID	2
Language	EN
Size	381.0 B
RVA offset	0x6c7060
Content signature	XML manifest
MD5	1e4a89b11eae0fcf8bb5fdd5ec3b6f61
Entropy	4.912

Application manifest

<?xml version='1.0' encoding='UTF-8' standalone='yes'?>
<assembly xmlns='urn:schemas-microsoft-com:asm.v1' manifestVersion='1.0'>
  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v3">
    <security>
      <requestedPrivileges>
        <requestedExecutionLevel level='asInvoker' uiAccess='false' />
      </requestedPrivileges>
    </security>
  </trustInfo>
</assembly>

Threat classification

Signature family candidates

Family	Agreeing rules	Matched rules	Disposition
Tiger RAT	1	TigerRAT_pe_yaraify	Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

Capability detection

not completed

The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file.

Signature matches

1 finding · 5 file properties · 0 scored

Rule	What it matched	Corpus	Weight
TigerRAT_pe_yaraify rule dated 2026-08-21	YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits 1 of 1 string matched $c0 \x0f\xb6\x08B\x0f\xb6\x14\x00+\xcau\x07H\xff\xc0\x85\xd2u\xed at 0x367f6b · 2 hits	Tier 1 - curated family set licence-gated and benign-tested; may name a malware family	SCORED 0 Scored 0: the rule declares no category. No branch of the score model reads it. Names Tiger RAT, but one rule cannot establish a family: two independent rules must agree, so this named nothing.

File properties - not findings

IsPE64IsDLLIsWindowsGUIHasDebugDataHasRichSignature

These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

None of the rules above moved the score. The score model reads four rule categories - anti-vm, anti-debug, dropper and packer - and a rule outside them can match, and be worth reading, without being evidence the verdict is built on.

Extracted strings

showing 200 of 287

!This program cannot be run in DOS mode.
Rich
.text
`.rdata
@.data
.pdata
@.fptable
.rsrc
@.reloc
@USVWATAUAVAWH
VWATAUAVH
t$ UWATAVAWH
.conu
USVWH
@SUAT
QPIc
@USVWH
I%EsaeI
D$4OTA
UWATAVAWH
M;Apt
@SVATAVH
p UWATAVAWH
5.tR
uLH;A
t$ AVH
VWATAVAWH
t.fff
@SATAVAWH
uSH;B
)@USVWATAVAWH
l$ VWATAVAWH
USVWATAUAVAWH
@USVWATAVAWH
Z\\H
trH+A
D$ trueA
D$ nullA
USATAWH
@SWATAUH
x/l$lsH
t$ ATAVAWH
l$ ATAVAWH
\$ UVWATAVH
@UWATAUAWH
ATAWH
fishing_A
VATAUH
@SWATAUAWH
A`H;Aht
UWATAUAWH
u.eH
VATAVH
SATH
l$ VWATAUAVH
l$ WATAVH
UWATAUAVH
R@I;RHt
emeru
iron_swoH+
h VWATAVAWH
C`8Cat
T$HH;T$PtTH
@USATH
UVATAUAVH
USWATAVAWH
shulker_
copper_cH+
hestH+
shulker_H+
alnum
alpha
blank
cntrl
digit
graph
lower
print
space
upper
xdigit
3ADEHILMfrtu
E1RKyg
!x-sys-default-locale
minkernel\crts\ucrt\inc\corecrt_internal_strtox.h
__crt_strtox::floating_point_value::as_double
_is_double
__crt_strtox::floating_point_value::as_float
!_is_double
(null)
.exe
.cmd
.bat
.com
mscoree.dll
LC_ALL
LC_COLLATE
LC_CTYPE
LC_MONETARY
LC_NUMERIC
LC_TIME
Monday
Wednesday
Thursday
Friday
Saturday
January
March
April
June
July
August
September
October
November
December
api-ms-win-core-datetime-l1-1-1
api-ms-win-core-fibers-l1-1-2
api-ms-win-core-file-l1-2-4
api-ms-win-core-file-l1-2-2
api-ms-win-core-file-l2-1-4
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-synch-l1-2-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
kernel32
kernelbase
ntdll
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-
american
american english
american-english
australian
belgian
canadian
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
dutch-belgian
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
french-belgian
french-canadian
french-luxembourg
french-swiss
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
irish-english
italian-swiss
norwegian
norwegian-bokmal
norwegian-nynorsk
portuguese-brazilian
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
swedish-finland
swiss
america

Stack and decoded strings were not recovered: it did not finish within the time allowed. Only literal strings present in the file are listed above.

Disassembly

entry point · x64 · 60 insns (listing capped)

AddressBytesMnemonicOperands

0x180365b0048895c2408movqword ptr [rsp + 8], rbx

0x180365b054889742410movqword ptr [rsp + 0x10], rsi

0x180365b0a57pushrdi

0x180365b0b4883ec20subrsp, 0x20

0x180365b0f498bf8movrdi, r8

0x180365b128bdamovebx, edx

0x180365b14488bf1movrsi, rcx

0x180365b1783fa01cmpedx, 1

0x180365b1a7505jne0x180365b21

0x180365b1ce857000000call0x180365b78

0x180365b214c8bc7movr8, rdi

0x180365b248bd3movedx, ebx

0x180365b26488bcemovrcx, rsi

0x180365b29488b5c2430movrbx, qword ptr [rsp + 0x30]

0x180365b2e488b742438movrsi, qword ptr [rsp + 0x38]

0x180365b334883c420addrsp, 0x20

0x180365b375fpoprdi

0x180365b38e99bfeffffjmp0x1803659d8

0x180365b3dccint3

0x180365b3eccint3

0x180365b3fccint3

0x180365b40e96b9c0000jmp0x18036f7b0

0x180365b45ccint3

0x180365b46ccint3

0x180365b47ccint3

0x180365b4833c0xoreax, eax

0x180365b4a3905e8c33400cmpdword ptr [rip + 0x34c3e8], eax

0x180365b500f95c0setneal

0x180365b53c3ret

0x180365b54c70556b8340000000000movdword ptr [rip + 0x34b856], 0

0x180365b5ec3ret

0x180365b5fccint3

0x180365b608bc9movecx, ecx

0x180365b62cd29int0x29

0x180365b64c3ret

0x180365b65ccint3

0x180365b66ccint3

0x180365b67ccint3

0x180365b68b902000000movecx, 2

0x180365b6dcd29int0x29

0x180365b6fc3ret

0x180365b70b908000000movecx, 8

0x180365b75cd29int0x29

0x180365b77c3ret

0x180365b7848895c2418movqword ptr [rsp + 0x18], rbx

0x180365b7d55pushrbp

0x180365b7e488becmovrbp, rsp

0x180365b814883ec30subrsp, 0x30

0x180365b85488b05746f3400movrax, qword ptr [rip + 0x346f74]

0x180365b8c48bb32a2df2d992b0000movabsrbx, 0x2b992ddfa232

0x180365b96483bc3cmprax, rbx

0x180365b997577jne0x180365c12

0x180365b9b488d4d10learcx, [rbp + 0x10]

0x180365b9f48c7451000000000movqword ptr [rbp + 0x10], 0

0x180365ba7ff15f3191100callqword ptr [rip + 0x1119f3]

0x180365bad488b4510movrax, qword ptr [rbp + 0x10]

0x180365bb1488945f0movqword ptr [rbp - 0x10], rax

0x180365bb5ff153d181100callqword ptr [rip + 0x11183d]

0x180365bbb8bc0moveax, eax

0x180365bbd483145f0xorqword ptr [rbp - 0x10], rax

callbranchretstackarithregisterimmediatememory

Import fingerprint

no related sample

Fingerprint	96:ismn4ZhT2UNmCEpjbUKyw9ftUbdkgqAfC3w48hNhRABxB5UQ8im5LRnRKRwMILut:ismn8hT1mCOvH3wm0FnEwXY
Imports read	165 functions from 38 libraries (165 distinct)
Comparable	yes
Compared against	52 stored samples

Samples built on the same import table

No stored sample you can see shares this import table.

Screen recording

19 frames · screen recording · 140s

1 / 19

0:00 · 1/19

Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

Behavior summary

ran 140s

1 process(es) observed

Launchedregsvr32.exe /s "C:\Users\user\Desktop\Borion.dll"

Privilegestandard

Telemetry sources: Kernel ETW (160 of 422 events) Process audit: 1keydiff: 13

Evasion / anti-analysis checks

1 check

MED

Anti-debug API imports static-api

MITRE T1622 · getthreadcontext, isdebuggerpresent

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

No WMI attributed to the sample. The WMI-Activity trace was running and recorded 923 operations on the machine during the run; none of them came from the sample's process tree.

Command lines, unwrapped

1 read

1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

Network activity

The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

See plans Create an account

Process tree

What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

1process

Borion.dll

1 process

Attributed activity

Not attributed to any process

1 kind

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Registry operations13

0Mechanisms found

90Methods checked

0ATT&CK techniques

NONEHighest severity

Persistence mechanisms

clean

No persistence established

None of the 90 auto-start methods below were established during this run.

Detection coverage

0 / 90

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

Logon & Startup 22 clean

Active Setup Installed Component T1547.014 clean
Explorer Delay-Load Object T1547.001 clean
Explorer Run Key T1547.001 clean
Explorer SharedTaskScheduler T1547.001 clean
Group Policy Extension DLL T1547.004 clean
Group Policy Run Key T1547.001 clean
Logon Script T1037.001 clean
RDP WDS Startup Program T1547.001 clean
Registry Run Key T1547.001 clean
Registry RunEx Key T1547.001 clean
Registry RunOnce Key T1547.001 clean
Registry RunOnceEx Key T1547.001 clean
Registry RunServices Key T1547.001 clean
Startup Folder Item T1547.001 clean
Startup Folder Redirection T1547.001 clean
Terminal Services Initial Program T1547.001 clean
Winlogon GINA DLL T1547.004 clean
Winlogon MPNotify Value T1547.004 clean
Winlogon Notify Package T1547.004 clean
Winlogon Shell Value T1547.004 clean
Winlogon Taskman Value T1547.004 clean
Winlogon Userinit Value T1547.004 clean

Services & Tasks 9 clean

BITS Job T1197 clean
Print Monitor DLL T1547.010 clean
Print Processor DLL T1547.012 clean
Scheduled Task T1053.005 clean
Scheduled Task Registry Implant T1053.005 clean
Service Control Manager Security Descriptor T1574.011 clean
Service DLL Hijack T1543.003 clean
Time Provider DLL T1547.003 clean
Windows Service Creation T1543.003 clean

Execution Hijack 17 clean

.NET Managed Debugger T1546.012 clean
Accessibility Tool Hijack T1546.008 clean
AeDebug Postmortem Debugger T1546.012 clean
App Paths Hijack T1546.012 clean
Application Shim Database T1546.011 clean
Boot Verification Program T1547.002 clean
Command Processor AutoRun T1546.011 clean
Explorer Load Value T1547.001 clean
Explorer MyComputer Tool Hijack T1546.001 clean
Registry Image File Execution Options T1546.012 clean
Screensaver Hijack T1546.002 clean
Setup ErrorHandler Script T1546 clean
Shell Open Command Hijack T1546.001 clean
SilentProcessExit Monitor T1546.012 clean
Telemetry Controller Command T1546.015 clean
WER ReflectDebugger T1546.012 clean
Windows Error Reporting Debugger T1546.012 clean

DLL Load Order 12 clean

.NET CLR Profiler DLL T1574.012 clean
.NET Startup Hook DLL T1574 clean
AppCert DLLs T1546.009 clean
AppInit DLLs T1546.010 clean
AutodialDLL Winsock Injection T1546.006 clean
DLL Search-Order Hijack T1574.001 T1574.002 clean
DNS Server Plugin DLL T1574.001 clean
HTML Help Helper DLL T1546 clean
KnownDLLs Manipulation T1574.001 clean
Natural Language Platform DLL Override T1546 clean
Netsh Helper DLL T1546.007 clean
Winsock Layered Service Provider T1546.006 clean

COM & Browser 6 clean

Browser Extension T1176 clean
Browser Helper Object T1176 clean
COM Server Hijack T1546.015 clean
HTML Help COM Object Hijack T1546.015 clean
Shell Context Menu Handler T1546.001 clean
Shell Extension Handler T1546.001 clean

Security Providers & Accounts 11 clean

Account RID Hijack T1098 clean
AMSI Provider T1562.001 clean
Credential Provider T1547.014 clean
DSRM Admin Logon Backdoor T1556 clean
Hidden Local Account T1136.001 clean
LSA Authentication Package T1547.002 clean
LSA Extension DLL T1547.005 clean
LSA Notification Package T1547.005 clean
LSA Security Package T1547.005 clean
Network Provider DLL T1556.008 clean
Security Support Provider T1547.005 clean

Scripting & Applications 9 clean

Netsh Port Proxy T1090.001 clean
Office Add-in T1137.006 clean
Office Executable Sideload T1574.002 clean
Office Startup Template T1137.001 clean
Office Test Key T1137.002 clean
Power Automate Flow T1546 clean
PowerShell Profile T1546.013 clean
Windows Terminal Startup Action T1546 clean
WMI Event Subscription T1546.003 clean

Boot & Firmware 4 clean

BootExecute Native Image T1547.002 clean
PlatformExecute Native Image T1547.002 clean
SetupExecute Native Image T1547.002 clean
UEFI / Bootkit Artifact T1542.003 T1542.001 clean

File activity summary

create 0 write 0 modify 0 delete 0 rename 0

Dropped payload analysis

none kept

The sample ran and none of what it wrote was a payload this run kept and examined. That is a measured absence rather than an unasked question.

File & registry ops

0 file · 12 registry · sample scope

Files (0) Registry (12)

Operation	Target	Process
create	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\CA not the samplekernel trace	- pid 3424
create	Software\Policies\Microsoft\SystemCertificates\CA not the samplekernel trace	- pid 3424
create	Software\Microsoft\EnterpriseCertificates\CA not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\Disallowed not the samplekernel trace	- pid 3424
create	Software\Policies\Microsoft\SystemCertificates\Disallowed not the samplekernel trace	- pid 3424
create	Software\Microsoft\EnterpriseCertificates\Disallowed not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\Root not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\AuthRoot not the samplekernel trace	- pid 3424
create	Software\Policies\Microsoft\SystemCertificates\Root not the samplekernel trace	- pid 3424
create	Software\Microsoft\EnterpriseCertificates\Root not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\SmartCardRoot not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\TrustedPeople not the samplekernel trace	- pid 3424
create	Software\Policies\Microsoft\SystemCertificates\TrustedPeople not the samplekernel trace	- pid 3424
create	Software\Microsoft\EnterpriseCertificates\TrustedPeople not the samplekernel trace	- pid 3424
create	Software\Microsoft\SystemCertificates\trust not the samplekernel trace	- pid 3424
create	Software\Policies\Microsoft\SystemCertificates\trust not the samplekernel trace	- pid 3424
create	Software\Microsoft\EnterpriseCertificates\trust not the samplekernel trace	- pid 3424
create	SYSTEM\WaaS\WaaSMedic\State not the samplekernel trace	- pid 3424
create	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters not the samplekernel trace	- pid 3424
setvalue	Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing State = 146432 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State BlockUntilTimeStatus = 2026-10-17T21:06:12Z read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State FeatureAssessmentImpactLevel = 0 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State FeatureAssessmentOutOfDateDays = 0 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State FeatureAssessmentStatus = 0 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State FeatureTimestampOfLatestRun = 134366799803525665 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State QualityAssessmentImpactLevel = 1 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State QualityAssessmentOutOfDateDays = 1 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State QualityAssessmentStatus = 10 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State QualityTimestampOfLatestRun = 134366799803525665 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State MedicTaskProtected = -1 read backread back	-
setvalue	SYSTEM\WaaS\WaaSMedic\State AllPluginsIneffective = 0 read backread back	-
setvalue	Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters TrapPollTimeMilliSecs = 15000 read backread back	-

External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

1 reported a hit 9 answered no 13 had nothing to check

1Sources with a hit

10Sources queriedof 23 available

470.5kFeed records

0Could not answer

File reputation

4 clear · 3 not checked

Source	Checks	Result	Detail	Feed
MalwareBazaar hash feed	File hash	clean	not in feed	2,934 records 41 minutes ago
MalwareBazaar ransomware feed	File hash	clean	not in feed	3,348 records 4 hours ago
ThreatFox hash IOCs	File hash	clean	not in feed	1,146 records 41 minutes ago
URLhaus payload hashes	File hash	clean	not in feed	1,658 records 41 minutes ago
filescan.io	File hash	not checked	no hash lookup ran for this scan	live lookup
MalwareBazaar	File hash	not checked	no hash lookup ran for this scan	live lookup
VirusTotal	File hash	not checked	no hash lookup ran for this scan	live lookup

Hash lookups only - the sample itself is never uploaded to any third party.

Network indicators

nothing of this kind to check

Source	Checks	Result	Detail	Feed
blocklist.de	IP / domain / URL	not checked	no IP, domain or URL observed to check	27.6k records 41 minutes ago
CINS Army	IP / domain / URL	not checked	no IP, domain or URL observed to check	15k records 41 minutes ago
Emerging Threats	IP / domain / URL	not checked	no IP, domain or URL observed to check	482 records 41 minutes ago
Feodo Tracker	IP / domain / URL	not checked	no IP, domain or URL observed to check	5 records 41 minutes ago
IPsum	IP / domain / URL	not checked	no IP, domain or URL observed to check	19.7k records 41 minutes ago
Phishing.Database	IP / domain / URL	not checked	no IP, domain or URL observed to check	391.5k records 5 hours ago
ThreatFox	IP / domain / URL	not checked	no IP, domain or URL observed to check	1,146 records 41 minutes ago
URLhaus	IP / domain / URL	not checked	no IP, domain or URL observed to check	no records ingested

TLS fingerprints

nothing of this kind to check

Source	Checks	Result	Detail	Feed
JA3 / JA4 fingerprint blocklists	JA3 / JA4	not checked	no TLS client fingerprint observed	97 records 11 hours ago
SSL blocklist	Server certificate	not checked	no server certificate fingerprint is extracted to check	live lookup

Detection rules

1 of 2 listed

Source	Checks	Result	Detail	Feed
Signature rules	Sample content	1 match	TigerRAT_pe_yaraify	110 records 41 minutes ago
Sigma rules	Behavior log	clean	-	2,275 records 6 hours ago

Tooling catalogs

4 clear

Source	Checks	Result	Detail	Feed
LOLBAS	Process image paths	clean	1 process image path, none masqueraded	245 records 41 minutes ago
LOLBootloaders	File hash	clean	not a known vulnerable bootloader	520 records 41 minutes ago
LOLDrivers	File hash	clean	not a known vulnerable driver	2,333 records 41 minutes ago
LOLRMM	Names and domains	clean	2 name/domain indicators checked, no remote-management tooling	360 records 41 minutes ago

AI analysis

The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

See plans Create an account

0 malicious 3 suspicious 0 info

File indicators

Severity	Type	Indicator	Description
suspicious	sample_sha256	f817a885da4dccbf2fca45dbce77e035a232956a8c31faeb3dad303ee0f84c4b	Submitted sample (SHA256)
suspicious	sample_md5	4eced87926b262224a2b29b936ffdd7d	Submitted sample (MD5)
suspicious	imphash	5f92c68d428112b737eaa35d681bc811	Import table hash (imphash)

Sigma detections

0 matches of 2275 rules

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

Generated rules

Sigma: auto_file_2827_sigma_reg

Auto-generated

title: Auto-generated registry behavior rule (sandbox scan 2827)
id: sandbox-auto-2827-reg
status: experimental
description: Auto-generated from sandbox scan 2827
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'SYSTEM\WaaS\WaaSMedic\State'
            - 'Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters'
    condition: selection
level: medium

YARA: auto_file_2827_yara

Auto-generated

rule auto_file_2827_yara
{
    meta:
        description = "Auto-generated from scan 2827"
        author = "sandbox auto-generator"
        imphash = "5f92c68d428112b737eaa35d681bc811"
        anchors = "5 independent regions"
    strings:
        $s0 = "minkernel\\crts\\ucrt\\inc\\corecrt_internal_strtox.h" wide fullword
        $s1 = "api-ms-win-core-datetime-l1-1-1" wide fullword
        $s2 = "api-ms-win-core-sysinfo-l1-2-1" wide fullword
        $s3 = "portuguese-brazilian" wide fullword
        $s4 = "3ADEHILMfrtu" wide fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 28407808 and all of them
}

Extracted files

What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

No extracted files

Nothing was unpacked or carved out of this sample. Packed samples, documents with embedded objects and installers are the ones that usually produce artifacts here.

Export & download

/s/2827

ATT&CK Navigator STIX 2.1 MISP IOCs PCAP Get Sample

Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

AI analysis report

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

Public analyses of this file

1 run

Submitted	Environment	Verdict	Score
2026-10-17 06:05 Shown below	Windows 10 22H2	Suspicious	43/100

Borion.dlltigerrat analysis report - Suspicious

Run integrity

Why this verdict

Model reading

Analysis layers

Sample

Run conditions

Malware family

Detection signatures

What the tests returned

Arguing against malice

How much weight this carries

Instrument coverage

Structure

Sections & resources

Signatures & packing

Strings

Code

Antivirus engine

Local ML assessment

Family configuration search

Capabilities

Security mitigations

Rich header (toolchain)

Sections

Imports

Binary metadata

Code signing

Resources

Resources

Threat classification

Capability detection

Signature matches

Extracted strings

Disassembly

Nothing in this view

Import fingerprint

Screen recording

Behavior summary

Evasion / anti-analysis checks

Command lines, unwrapped

Network activity

Process tree

Borion.dll

Attributed activity

Not attributed to any process

Persistence mechanisms

No persistence established

Detection coverage

File activity summary

Dropped payload analysis

File & registry ops

File reputation

Network indicators

TLS fingerprints

Detection rules

Tooling catalogs

AI analysis

File indicators

Sigma detections

Generated rules

Sigma: auto_file_2827_sigma_reg

YARA: auto_file_2827_yara

Extracted files

No extracted files

Export & download

AI analysis report

Public analyses of this file