Edit tour
Linux
Analysis Report
logo.gif
Overview
General Information
| Sample name: | logo.gif |
| Analysis ID: | 1380521 |
| MD5: | 684db6154468a492e65e750ef4f9f1be |
| SHA1: | abeb0bae218e6f1d2afe03d04d133852902e8367 |
| SHA256: | 1b26e14bc1b9f8b22d6780651e38f641d79ee3799fc673e055b33880b6b25b7b |
| Infos: | |
 | |
Detection
| Score: | 1 |
| Range: | 0 - 100 |
| Whitelisted: | false |
Signatures
Creates hidden files and/or directories
Uses the "uname" system call to query kernel version information (possible evasion)
Classification
| Joe Sandbox version: | 39.0.0 Ruby |
| Analysis ID: | 1380521 |
| Start date and time: | 2024-01-24 17:59:18 +01:00 |
| Joe Sandbox product: | CloudBasic |
| Overall analysis duration: | 0h 6m 13s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultlinuxfilecookbook.jbs |
| Analysis system description: | Ubuntu Linux 16.04 x64 (Kernel 4.4.0-116, Firefox 88.0, Document Viewer 3.18.2, LibreOffice 5.1.6.2, OpenJDK 1.8.0_171) |
| Analysis Mode: | default |
| Sample name: | logo.gif |
| Detection: | CLEAN |
| Classification: | clean1.linGIF@0/0@0/0 |
- VT rate limit hit for: logo.gif
| Command: | xdg-open "/tmp/logo.gif" |
| PID: | 4710 |
| Exit Code: | 0 |
| Exit Code Info: | |
| Killed: | False |
| Standard Output: | |
| Standard Error: |
⊘No yara matches
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Classification label: | ||
| Source: | Directory: | Jump to behavior | ||
| Source: | Directory: | Jump to behavior | ||
| Source: | Directory: | Jump to behavior | ||
| Source: | Directory: | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Reconnaissance | Resource Development | Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Command and Control | Exfiltration | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Gather Victim Identity Information | Acquire Infrastructure | Valid Accounts | Windows Management Instrumentation | Path Interception | Path Interception | 1 Hidden Files and Directories | OS Credential Dumping | 11 Security Software Discovery | Remote Services | Data from Local System | Data Obfuscation | Exfiltration Over Other Network Medium | Abuse Accessibility Features |
⊘No configs have been found
Is Dropped
Number of created Files
Is malicious
InternetThis section contains all screenshots as thumbnails, including those not shown in the slideshow.
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No Antivirus matches
⊘No created / dropped files found
| File type: | |
| Entropy (8bit): | 5.536235702258042 |
| TrID: |
|
| File name: | logo.gif |
| File size: | 8'882'314 bytes |
| MD5: | 684db6154468a492e65e750ef4f9f1be |
| SHA1: | abeb0bae218e6f1d2afe03d04d133852902e8367 |
| SHA256: | 1b26e14bc1b9f8b22d6780651e38f641d79ee3799fc673e055b33880b6b25b7b |
| SHA512: | 4bb2c6adde07e90c180895474e6883cc4faf8ed85fff81479ba4e5df942868ad0ee283c145a0d74557a046e03e7282aac1e08eac990870f26389c1894c9120b9 |
| SSDEEP: | 49152:GtHxXfEMYFWoQR5Lgoc0oCRVoB5h+rN5/N201jZwO5Si6NBVf9yIBnMD9PE2ntzh:g |
| TLSH: | 08962B3D8C422E2E7BA328ED1EDED6D11E0C6B5F78A6D406AD05418417B1EB725DB0CE |
| File Content Preview: | GIFc2NoZW1hCgl2YzAKCQlhZG1pblJlY292ZXJ5CgkJCWV4cGlyZXM9WzBdCgkJCXJvbGU9W10KCQkJ.c2Vzc2lvbj1bXQoJCQl0b2tlbj1bXQoJCUFkbWluVUlCYW5uZXJmbGFncz1bQRRdCgkJQWRtaW5V.aVNldHRpbmc9WzBdCgkJYWR2YW5jZWRfY2xpZW50X2NvbmZpZwoJCQljbGllbnRfdWlfbW9kZT1b.Y2xhc3NpY10KCQkJY29uZ |
⊘No network behavior found
System Behavior
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/exo-open |
| Arguments: | exo-open /tmp/logo.gif |
| File size: | 22856 bytes |
| MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/exo-open |
| Arguments: | - |
| File size: | 22856 bytes |
| MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/dbus-launch |
| Arguments: | dbus-launch --autolaunch=11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr |
| File size: | 26616 bytes |
| MD5 hash: | e4a469f27d130d783c21ce9c1c4456c3 |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/exo-open |
| Arguments: | - |
| File size: | 22856 bytes |
| MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/exo-open |
| Arguments: | - |
| File size: | 22856 bytes |
| MD5 hash: | 39c5fa78f1cb3d950b9944f784018d3a |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/ristretto |
| Arguments: | ristretto /tmp/logo.gif |
| File size: | 225576 bytes |
| MD5 hash: | 15778690113a3fdfd05834ed1877e667 |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/ristretto |
| Arguments: | - |
| File size: | 225576 bytes |
| MD5 hash: | 15778690113a3fdfd05834ed1877e667 |
| Start time (UTC): | 16:59:57 |
| Start date (UTC): | 24/01/2024 |
| Path: | /usr/bin/dbus-launch |
| Arguments: | dbus-launch --autolaunch 11ced2f07072c6ae389b731c5cc84014 --binary-syntax --close-stderr |
| File size: | 26616 bytes |
| MD5 hash: | e4a469f27d130d783c21ce9c1c4456c3 |