ForensicLab X Enterprise
27million_eur.dat
Type: Unknown / data (unknown)
Size: 206569472 bytes
SHA256: 2bc3b298470c1b86fb3de0e8039b93c8eea1639ebaa93aeb11488d6869c4f562
Entropy (avg): 7.999825 bits/byte
Verdict: Sangat mungkin encrypted / random / proprietary blob
Likelihood encrypted/random: 85%
Signature Matches
| Type | Category | MIME | Offset |
|---|---|---|---|
| Tidak ada signature dikenali | |||
Charts
Assessment Summary
- Entropy sangat tinggi, mendekati ciphertext/random.
- Tidak ada blok 16-byte berulang (konsisten dengan cipher mode acak).
- Tidak ada header format publik yang dikenali di awal file.
- Distribusi byte relatif merata (chi-square rendah).
Statistik tidak bisa memastikan algoritma AES/ChaCha tanpa kunci/metadata.
Forensic Flags Risk 30
- MEDIUM [Suspicious_PDF_Action] PDF berisi JavaScript / auto-action.
- MEDIUM 18 file tertanam terdeteksi (BZIP2, GZIP, JPEG, Script shebang).
File Carving
Polyglot: tidak
Trailing/appended data: tidak
| Offset | Embedded type |
|---|---|
| 3466172 | BZIP2 |
| 5637854 | BZIP2 |
| 5837109 | Script shebang |
| 13124903 | BZIP2 |
| 13451739 | Script shebang |
| 17085291 | GZIP |
| 17730211 | Script shebang |
| 18518956 | JPEG |
| 21083785 | JPEG |
| 38038684 | Script shebang |
| 39743147 | GZIP |
| 40824875 | JPEG |
| 51223531 | Script shebang |
| 56206658 | JPEG |
| 59486190 | Script shebang |
| 59594556 | GZIP |
| 62479583 | Script shebang |
| 63247428 | JPEG |
IOC Extracted (35)
| ipv6 (1) | 0:e:C |
| domain (1) | f.uk |
| windows_path (32) | h:\y!m�pҡ��, e:\��N�T��x, G:\;zm������=��, A:\&5���ҋ� �,P, l:\�+ }��H% ̭$�E�1[uMk����[�Z趤���r�, P:\a3�}������{���, S:\����ܙ;�S듰�N %^-�lhs�����h0���7e����� k���62�E���㦹' T�P ϋNs#���+��, m:\������o ���[$�ڃ�z r |
| unc_path (1) | \\7\ޣ�$)�S ��q�^�OBJ�8�����U3WPŭEJ��L�����w��y'�l��07 |
Plugins
| Plugin | Hasil |
|---|---|
| Custom Keyword Rules | 0 flag |
| Double Extension Detector | 0 flag |
MITRE ATT&CK
| Teknik | Nama | Taktik | Bukti |
|---|---|---|---|
T1204.002 | User Execution: Malicious File | Execution | Suspicious_PDF_Action (raw) |
Fuzzy Hash (ssdeep-style)
3145728:qXBJGddQWn0QzmONoQXC3PrXy4fahdBeiAJWFpa/liAHzqFz0it:qTidQC0QzfyD3P+4+BeiAwaVqFwit
Bandingkan dengan file lain untuk mengukur kemiripan.
Raw JSON
{
"file": {
"path": "/root/27million_eur.dat",
"name": "27million_eur.dat",
"size_bytes": 206569472
},
"file_type": {
"detected": [],
"primary": null,
"primary_type": "Unknown / data",
"primary_category": "unknown",
"declared_extension": "dat",
"extension_match": null,
"mismatch_warning": "",
"packer_hints": [],
"is_text": false
},
"hashes": {
"md5": "90004b12ed944388ce3d545d279d9028",
"sha1": "81a1756826bafd8000a46987bcc8d73480440e00",
"sha256": "2bc3b298470c1b86fb3de0e8039b93c8eea1639ebaa93aeb11488d6869c4f562",
"sha512": "e3255c25d57acfcee3fa65922229afc12b9e7578462e8f34e9b945c79df01cc9c0f703c0966e5a77aca3077d431f3b08e6913df6acc33259df9b1be79f501c82"
},
"entropy": {
"average": 7.999824676890765,
"min": 7.999776301575872,
"max": 7.999862163700134,
"window_size": 1048576
},
"entropy_windows": [
{
"window": 0,
"offset": 0,
"size": 1048576,
"entropy": 7.999839135532916
},
{
"window": 1,
"offset": 1048576,
"size": 1048576,
"entropy": 7.999835643764108
},
{
"window": 2,
"offset": 2097152,
"size": 1048576,
"entropy": 7.999811461497566
},
{
"window": 3,
"offset": 3145728,
"size": 1048576,
"entropy": 7.999812682366729
},
{
"window": 4,
"offset": 4194304,
"size": 1048576,
"entropy": 7.9998130999610275
},
{
"window": 5,
"offset": 5242880,
"size": 1048576,
"entropy": 7.999800401927709
},
{
"window": 6,
"offset": 6291456,
"size": 1048576,
"entropy": 7.999827276810429
},
{
"window": 7,
"offset": 7340032,
"size": 1048576,
"entropy": 7.9998425287782755
},
{
"window": 8,
"offset": 8388608,
"size": 1048576,
"entropy": 7.9998277715014705
},
{
"window": 9,
"offset": 9437184,
"size": 1048576,
"entropy": 7.999827513425767
},
{
"window": 10,
"offset": 10485760,
"size": 1048576,
"entropy": 7.999801654624558
},
{
"window": 11,
"offset": 11534336,
"size": 1048576,
"entropy": 7.999849495335252
},
{
"window": 12,
"offset": 12582912,
"size": 1048576,
"entropy": 7.999857673874036
},
{
"window": 13,
"offset": 13631488,
"size": 1048576,
"entropy": 7.999839341526333
},
{
"window": 14,
"offset": 14680064,
"size": 1048576,
"entropy": 7.999833838110955
},
{
"window": 15,
"offset": 15728640,
"size": 1048576,
"entropy": 7.999814749034794
},
{
"window": 16,
"offset": 16777216,
"size": 1048576,
"entropy": 7.999815732646465
},
{
"window": 17,
"offset": 17825792,
"size": 1048576,
"entropy": 7.999823694953092
},
{
"window": 18,
"offset": 18874368,
"size": 1048576,
"entropy": 7.9998254567328315
},
{
"window": 19,
"offset": 19922944,
"size": 1048576,
"entropy": 7.999825411791543
},
{
"window": 20,
"offset": 20971520,
"size": 1048576,
"entropy": 7.999830246946652
},
{
"window": 21,
"offset": 22020096,
"size": 1048576,
"entropy": 7.9998455189793365
},
{
"window": 22,
"offset": 23068672,
"size": 1048576,
"entropy": 7.999850641340564
},
{
"window": 23,
"offset": 24117248,
"size": 1048576,
"entropy": 7.9998350116538965
},
{
"window": 24,
"offset": 25165824,
"size": 1048576,
"entropy": 7.9998188929679195
},
{
"window": 25,
"offset": 26214400,
"size": 1048576,
"entropy": 7.999827225804619
},
{
"window": 26,
"offset": 27262976,
"size": 1048576,
"entropy": 7.999811456189105
},
{
"window": 27,
"offset": 28311552,
"size": 1048576,
"entropy": 7.999809048241209
},
{
"window": 28,
"offset": 29360128,
"size": 1048576,
"entropy": 7.999811978972648
},
{
"window": 29,
"offset": 30408704,
"size": 1048576,
"entropy": 7.999825215653469
},
{
"window": 30,
"offset": 31457280,
"size": 1048576,
"entropy": 7.999830396121632
},
{
"window": 31,
"offset": 32505856,
"size": 1048576,
"entropy": 7.999838118798676
},
{
"window": 32,
"offset": 33554432,
"size": 1048576,
"entropy": 7.999843817385929
},
{
"window": 33,
"offset": 34603008,
"size": 1048576,
"entropy": 7.999840610502026
},
{
"window": 34,
"offset": 35651584,
"size": 1048576,
"entropy": 7.999806191822325
},
{
"window": 35,
"offset": 36700160,
"size": 1048576,
"entropy": 7.999856262144453
},
{
"window": 36,
"offset": 37748736,
"size": 1048576,
"entropy": 7.999817165478864
},
{
"window": 37,
"offset": 38797312,
"size": 1048576,
"entropy": 7.999814273312553
},
{
"window": 38,
"offset": 39845888,
"size": 1048576,
"entropy": 7.999824375217673
},
{
"window": 39,
"offset": 40894464,
"size": 1048576,
"entropy": 7.99981359184179
},
{
"window": 40,
"offset": 41943040,
"size": 1048576,
"entropy": 7.999820957961888
},
{
"window": 41,
"offset": 42991616,
"size": 1048576,
"entropy": 7.99980622077865
},
{
"window": 42,
"offset": 44040192,
"size": 1048576,
"entropy": 7.99984991361788
},
{
"window": 43,
"offset": 45088768,
"size": 1048576,
"entropy": 7.999798802262479
},
{
"window": 44,
"offset": 46137344,
"size": 1048576,
"entropy": 7.999787489890833
},
{
"window": 45,
"offset": 47185920,
"size": 1048576,
"entropy": 7.999819212227204
},
{
"window": 46,
"offset": 48234496,
"size": 1048576,
"entropy": 7.999809724024117
},
{
"window": 47,
"offset": 49283072,
"size": 1048576,
"entropy": 7.999839774993123
},
{
"window": 48,
"offset": 50331648,
"size": 1048576,
"entropy": 7.999841536517411
},
{
"window": 49,
"offset": 51380224,
"size": 1048576,
"entropy": 7.999819863094732
},
{
"window": 50,
"offset": 52428800,
"size": 1048576,
"entropy": 7.999827254947933
},
{
"window": 51,
"offset": 53477376,
"size": 1048576,
"entropy": 7.999830527669763
},
{
"window": 52,
"offset": 54525952,
"size": 1048576,
"entropy": 7.999851349057921
},
{
"window": 53,
"offset": 55574528,
"size": 1048576,
"entropy": 7.999792977867697
},
{
"window": 54,
"offset": 56623104,
"size": 1048576,
"entropy": 7.999822950601774
},
{
"window": 55,
"offset": 57671680,
"size": 1048576,
"entropy": 7.99985004457595
},
{
"window": 56,
"offset": 58720256,
"size": 1048576,
"entropy": 7.999832931539727
},
{
"window": 57,
"offset": 59768832,
"size": 1048576,
"entropy": 7.9998407829382225
},
{
"window": 58,
"offset": 60817408,
"size": 1048576,
"entropy": 7.9998300527735795
},
{
"window": 59,
"offset": 61865984,
"size": 1048576,
"entropy": 7.999783435384713
},
{
"window": 60,
"offset": 62914560,
"size": 1048576,
"entropy": 7.999813991237548
},
{
"window": 61,
"offset": 63963136,
"size": 1048576,
"entropy": 7.999847205563547
},
{
"window": 62,
"offset": 65011712,
"size": 1048576,
"entropy": 7.999832936575717
},
{
"window": 63,
"offset": 66060288,
"size": 1048576,
"entropy": 7.999832748386344
},
{
"window": 64,
"offset": 67108864,
"size": 1048576,
"entropy": 7.999849535107935
},
{
"window": 65,
"offset": 68157440,
"size": 1048576,
"entropy": 7.99981181844985
},
{
"window": 66,
"offset": 69206016,
"size": 1048576,
"entropy": 7.999812818824013
},
{
"window": 67,
"offset": 70254592,
"size": 1048576,
"entropy": 7.9998283691064405
},
{
"window": 68,
"offset": 71303168,
"size": 1048576,
"entropy": 7.999835920623493
},
{
"window": 69,
"offset": 72351744,
"size": 1048576,
"entropy": 7.999823339848764
},
{
"window": 70,
"offset": 73400320,
"size": 1048576,
"entropy": 7.999837121795263
},
{
"window": 71,
"offset": 74448896,
"size": 1048576,
"entropy": 7.999822053375173
},
{
"window": 72,
"offset": 75497472,
"size": 1048576,
"entropy": 7.9998171020202165
},
{
"window": 73,
"offset": 76546048,
"size": 1048576,
"entropy": 7.999846229697316
},
{
"window": 74,
"offset": 77594624,
"size": 1048576,
"entropy": 7.999838363440697
},
{
"window": 75,
"offset": 78643200,
"size": 1048576,
"entropy": 7.999819665107973
},
{
"window": 76,
"offset": 79691776,
"size": 1048576,
"entropy": 7.999804592804075
},
{
"window": 77,
"offset": 80740352,
"size": 1048576,
"entropy": 7.999801712948719
},
{
"window": 78,
"offset": 81788928,
"size": 1048576,
"entropy": 7.9998248740415985
},
{
"window": 79,
"offset": 82837504,
"size": 1048576,
"entropy": 7.999792547564262
},
{
"window": 80,
"offset": 83886080,
"size": 1048576,
"entropy": 7.999797656329293
},
{
"window": 81,
"offset": 84934656,
"size": 1048576,
"entropy": 7.999793051613878
},
{
"window": 82,
"offset": 85983232,
"size": 1048576,
"entropy": 7.999801456820435
},
{
"window": 83,
"offset": 87031808,
"size": 1048576,
"entropy": 7.999819049617398
},
{
"window": 84,
"offset": 88080384,
"size": 1048576,
"entropy": 7.99982497624303
},
{
"window": 85,
"offset": 89128960,
"size": 1048576,
"entropy": 7.999810323606203
},
{
"window": 86,
"offset": 90177536,
"size": 1048576,
"entropy": 7.999803890546166
},
{
"window": 87,
"offset": 91226112,
"size": 1048576,
"entropy": 7.999839291403142
},
{
"window": 88,
"offset": 92274688,
"size": 1048576,
"entropy": 7.999844416374893
},
{
"window": 89,
"offset": 93323264,
"size": 1048576,
"entropy": 7.999807128246545
},
{
"window": 90,
"offset": 94371840,
"size": 1048576,
"entropy": 7.999838399889511
},
{
"window": 91,
"offset": 95420416,
"size": 1048576,
"entropy": 7.9998110429848515
},
{
"window": 92,
"offset": 96468992,
"size": 1048576,
"entropy": 7.99980810579431
},
{
"window": 93,
"offset": 97517568,
"size": 1048576,
"entropy": 7.999819203811614
},
{
"window": 94,
"offset": 98566144,
"size": 1048576,
"entropy": 7.99980888700173
},
{
"window": 95,
"offset": 99614720,
"size": 1048576,
"entropy": 7.999848431952452
},
{
"window": 96,
"offset": 100663296,
"size": 1048576,
"entropy": 7.99981066481553
},
{
"window": 97,
"offset": 101711872,
"size": 1048576,
"entropy": 7.999829076192553
},
{
"window": 98,
"offset": 102760448,
"size": 1048576,
"entropy": 7.999862163700134
},
{
"window": 99,
"offset": 103809024,
"size": 1048576,
"entropy": 7.999811295737066
},
{
"window": 100,
"offset": 104857600,
"size": 1048576,
"entropy": 7.999810414269725
},
{
"window": 101,
"offset": 105906176,
"size": 1048576,
"entropy": 7.999841110641905
},
{
"window": 102,
"offset": 106954752,
"size": 1048576,
"entropy": 7.999779850461853
},
{
"window": 103,
"offset": 108003328,
"size": 1048576,
"entropy": 7.999834830723659
},
{
"window": 104,
"offset": 109051904,
"size": 1048576,
"entropy": 7.999836858949902
},
{
"window": 105,
"offset": 110100480,
"size": 1048576,
"entropy": 7.999830629704568
},
{
"window": 106,
"offset": 111149056,
"size": 1048576,
"entropy": 7.999860393884398
},
{
"window": 107,
"offset": 112197632,
"size": 1048576,
"entropy": 7.999854998106426
},
{
"window": 108,
"offset": 113246208,
"size": 1048576,
"entropy": 7.99983674792738
},
{
"window": 109,
"offset": 114294784,
"size": 1048576,
"entropy": 7.99986055268306
},
{
"window": 110,
"offset": 115343360,
"size": 1048576,
"entropy": 7.999827706311018
},
{
"window": 111,
"offset": 116391936,
"size": 1048576,
"entropy": 7.9998096311473645
},
{
"window": 112,
"offset": 117440512,
"size": 1048576,
"entropy": 7.99981737878719
},
{
"window": 113,
"offset": 118489088,
"size": 1048576,
"entropy": 7.999811550489299
},
{
"window": 114,
"offset": 119537664,
"size": 1048576,
"entropy": 7.999834639671723
},
{
"window": 115,
"offset": 120586240,
"size": 1048576,
"entropy": 7.999821880927468
},
{
"window": 116,
"offset": 121634816,
"size": 1048576,
"entropy": 7.999827431544972
},
{
"window": 117,
"offset": 122683392,
"size": 1048576,
"entropy": 7.999808693194541
},
{
"window": 118,
"offset": 123731968,
"size": 1048576,
"entropy": 7.999831145350387
},
{
"window": 119,
"offset": 124780544,
"size": 1048576,
"entropy": 7.99984774915025
},
{
"window": 120,
"offset": 125829120,
"size": 1048576,
"entropy": 7.999849479357473
},
{
"window": 121,
"offset": 126877696,
"size": 1048576,
"entropy": 7.999851855416503
},
{
"window": 122,
"offset": 127926272,
"size": 1048576,
"entropy": 7.9998213916380525
},
{
"window": 123,
"offset": 128974848,
"size": 1048576,
"entropy": 7.999815121888667
},
{
"window": 124,
"offset": 130023424,
"size": 1048576,
"entropy": 7.9998228923279235
},
{
"window": 125,
"offset": 131072000,
"size": 1048576,
"entropy": 7.99981874262338
},
{
"window": 126,
"offset": 132120576,
"size": 1048576,
"entropy": 7.999815172505425
},
{
"window": 127,
"offset": 133169152,
"size": 1048576,
"entropy": 7.999802276392711
},
{
"window": 128,
"offset": 134217728,
"size": 1048576,
"entropy": 7.9998581406841165
},
{
"window": 129,
"offset": 135266304,
"size": 1048576,
"entropy": 7.9998255167074515
},
{
"window": 130,
"offset": 136314880,
"size": 1048576,
"entropy": 7.999818557377101
},
{
"window": 131,
"offset": 137363456,
"size": 1048576,
"entropy": 7.999831887787279
},
{
"window": 132,
"offset": 138412032,
"size": 1048576,
"entropy": 7.999843910214334
},
{
"window": 133,
"offset": 139460608,
"size": 1048576,
"entropy": 7.999811242610033
},
{
"window": 134,
"offset": 140509184,
"size": 1048576,
"entropy": 7.999814390092162
},
{
"window": 135,
"offset": 141557760,
"size": 1048576,
"entropy": 7.999818982324574
},
{
"window": 136,
"offset": 142606336,
"size": 1048576,
"entropy": 7.999835929551048
},
{
"window": 137,
"offset": 143654912,
"size": 1048576,
"entropy": 7.999829167941433
},
{
"window": 138,
"offset": 144703488,
"size": 1048576,
"entropy": 7.999825973675119
},
{
"window": 139,
"offset": 145752064,
"size": 1048576,
"entropy": 7.9998301716544296
},
{
"window": 140,
"offset": 146800640,
"size": 1048576,
"entropy": 7.999826540408942
},
{
"window": 141,
"offset": 147849216,
"size": 1048576,
"entropy": 7.999840425639223
},
{
"window": 142,
"offset": 148897792,
"size": 1048576,
"entropy": 7.999835254855022
},
{
"window": 143,
"offset": 149946368,
"size": 1048576,
"entropy": 7.999818619636967
},
{
"window": 144,
"offset": 150994944,
"size": 1048576,
"entropy": 7.99981777197392
},
{
"window": 145,
"offset": 152043520,
"size": 1048576,
"entropy": 7.999811768634815
},
{
"window": 146,
"offset": 153092096,
"size": 1048576,
"entropy": 7.999832073475319
},
{
"window": 147,
"offset": 154140672,
"size": 1048576,
"entropy": 7.999813730147622
},
{
"window": 148,
"offset": 155189248,
"size": 1048576,
"entropy": 7.999817177341725
},
{
"window": 149,
"offset": 156237824,
"size": 1048576,
"entropy": 7.999852461067442
},
{
"window": 150,
"offset": 157286400,
"size": 1048576,
"entropy": 7.999826115636571
},
{
"window": 151,
"offset": 158334976,
"size": 1048576,
"entropy": 7.999820248054226
},
{
"window": 152,
"offset": 159383552,
"size": 1048576,
"entropy": 7.999834384593732
},
{
"window": 153,
"offset": 160432128,
"size": 1048576,
"entropy": 7.999799217415857
},
{
"window": 154,
"offset": 161480704,
"size": 1048576,
"entropy": 7.9998222086537485
},
{
"window": 155,
"offset": 162529280,
"size": 1048576,
"entropy": 7.99984824385012
},
{
"window": 156,
"offset": 163577856,
"size": 1048576,
"entropy": 7.999832721795778
},
{
"window": 157,
"offset": 164626432,
"size": 1048576,
"entropy": 7.999830214183459
},
{
"window": 158,
"offset": 165675008,
"size": 1048576,
"entropy": 7.999799166541802
},
{
"window": 159,
"offset": 166723584,
"size": 1048576,
"entropy": 7.9998569235915955
},
{
"window": 160,
"offset": 167772160,
"size": 1048576,
"entropy": 7.999826052315262
},
{
"window": 161,
"offset": 168820736,
"size": 1048576,
"entropy": 7.999801599118276
},
{
"window": 162,
"offset": 169869312,
"size": 1048576,
"entropy": 7.999808131533221
},
{
"window": 163,
"offset": 170917888,
"size": 1048576,
"entropy": 7.999811179048851
},
{
"window": 164,
"offset": 171966464,
"size": 1048576,
"entropy": 7.999837544965177
},
{
"window": 165,
"offset": 173015040,
"size": 1048576,
"entropy": 7.999819220614768
},
{
"window": 166,
"offset": 174063616,
"size": 1048576,
"entropy": 7.99981214526277
},
{
"window": 167,
"offset": 175112192,
"size": 1048576,
"entropy": 7.99979528549815
},
{
"window": 168,
"offset": 176160768,
"size": 1048576,
"entropy": 7.999838133809599
},
{
"window": 169,
"offset": 177209344,
"size": 1048576,
"entropy": 7.9998252901331295
},
{
"window": 170,
"offset": 178257920,
"size": 1048576,
"entropy": 7.999836684536365
},
{
"window": 171,
"offset": 179306496,
"size": 1048576,
"entropy": 7.999821485370782
},
{
"window": 172,
"offset": 180355072,
"size": 1048576,
"entropy": 7.999809279114925
},
{
"window": 173,
"offset": 181403648,
"size": 1048576,
"entropy": 7.999798866930965
},
{
"window": 174,
"offset": 182452224,
"size": 1048576,
"entropy": 7.999824281453396
},
{
"window": 175,
"offset": 183500800,
"size": 1048576,
"entropy": 7.999828024829872
},
{
"window": 176,
"offset": 184549376,
"size": 1048576,
"entropy": 7.999839233263917
},
{
"window": 177,
"offset": 185597952,
"size": 1048576,
"entropy": 7.999818764649394
},
{
"window": 178,
"offset": 186646528,
"size": 1048576,
"entropy": 7.999843819228999
},
{
"window": 179,
"offset": 187695104,
"size": 1048576,
"entropy": 7.999844352645226
},
{
"window": 180,
"offset": 188743680,
"size": 1048576,
"entropy": 7.999816556484689
},
{
"window": 181,
"offset": 189792256,
"size": 1048576,
"entropy": 7.999817874467623
},
{
"window": 182,
"offset": 190840832,
"size": 1048576,
"entropy": 7.999834233035825
},
{
"window": 183,
"offset": 191889408,
"size": 1048576,
"entropy": 7.9998167316394975
},
{
"window": 184,
"offset": 192937984,
"size": 1048576,
"entropy": 7.999828140996686
},
{
"window": 185,
"offset": 193986560,
"size": 1048576,
"entropy": 7.999796727231682
},
{
"window": 186,
"offset": 195035136,
"size": 1048576,
"entropy": 7.999776301575872
},
{
"window": 187,
"offset": 196083712,
"size": 1048576,
"entropy": 7.9998442539473915
},
{
"window": 188,
"offset": 197132288,
"size": 1048576,
"entropy": 7.999824914561575
},
{
"window": 189,
"offset": 198180864,
"size": 1048576,
"entropy": 7.999834774832414
},
{
"window": 190,
"offset": 199229440,
"size": 1048576,
"entropy": 7.999837299583715
},
{
"window": 191,
"offset": 200278016,
"size": 1048576,
"entropy": 7.999803751304196
},
{
"window": 192,
"offset": 201326592,
"size": 1048576,
"entropy": 7.999823833860085
},
{
"window": 193,
"offset": 202375168,
"size": 1048576,
"entropy": 7.999816972176684
},
{
"window": 194,
"offset": 203423744,
"size": 1048576,
"entropy": 7.999812912056542
},
{
"window": 195,
"offset": 204472320,
"size": 1048576,
"entropy": 7.999837592965245
},
{
"window": 196,
"offset": 205520896,
"size": 1048576,
"entropy": 7.99982697274783
}
],
"byte_histogram": {
"total": 206569472,
"histogram": {
"00": 806822,
"01": 805495,
"02": 807698,
"03": 806402,
"04": 806540,
"05": 808076,
"06": 806700,
"07": 807331,
"08": 806395,
"09": 807290,
"0a": 807176,
"0b": 807785,
"0c": 806490,
"0d": 807554,
"0e": 807156,
"0f": 806577,
"10": 806643,
"11": 806595,
"12": 807799,
"13": 807025,
"14": 807259,
"15": 807029,
"16": 807522,
"17": 805772,
"18": 806280,
"19": 805698,
"1a": 806097,
"1b": 805748,
"1c": 807407,
"1d": 807998,
"1e": 807955,
"1f": 806891,
"20": 808163,
"21": 807129,
"22": 806368,
"23": 807045,
"24": 807050,
"25": 806492,
"26": 807906,
"27": 807450,
"28": 808366,
"29": 808606,
"2a": 808851,
"2b": 807411,
"2c": 805043,
"2d": 807851,
"2e": 806433,
"2f": 808111,
"30": 807881,
"31": 807604,
"32": 807884,
"33": 807380,
"34": 805976,
"35": 808490,
"36": 806114,
"37": 804976,
"38": 808923,
"39": 805255,
"3a": 805321,
"3b": 806769,
"3c": 807320,
"3d": 807000,
"3e": 807304,
"3f": 806024,
"40": 806215,
"41": 807059,
"42": 807643,
"43": 807107,
"44": 809650,
"45": 806248,
"46": 805358,
"47": 806261,
"48": 807864,
"49": 808468,
"4a": 806165,
"4b": 806807,
"4c": 807691,
"4d": 806750,
"4e": 807722,
"4f": 807906,
"50": 807412,
"51": 806881,
"52": 808272,
"53": 806950,
"54": 807671,
"55": 805533,
"56": 807690,
"57": 805921,
"58": 807846,
"59": 806427,
"5a": 806495,
"5b": 807336,
"5c": 805979,
"5d": 808251,
"5e": 806531,
"5f": 808271,
"60": 807671,
"61": 807344,
"62": 807124,
"63": 808766,
"64": 807190,
"65": 807041,
"66": 806516,
"67": 806251,
"68": 806229,
"69": 807132,
"6a": 807248,
"6b": 807003,
"6c": 807045,
"6d": 808650,
"6e": 806895,
"6f": 806733,
"70": 805778,
"71": 806687,
"72": 805425,
"73": 808065,
"74": 805983,
"75": 807488,
"76": 805791,
"77": 806560,
"78": 806409,
"79": 806880,
"7a": 809113,
"7b": 805933,
"7c": 805893,
"7d": 806733,
"7e": 806645,
"7f": 805600,
"80": 807202,
"81": 807843,
"82": 807401,
"83": 805433,
"84": 807020,
"85": 807218,
"86": 808497,
"87": 806692,
"88": 808259,
"89": 805644,
"8a": 806038,
"8b": 806774,
"8c": 808061,
"8d": 807618,
"8e": 805622,
"8f": 808479,
"90": 806746,
"91": 807202,
"92": 806545,
"93": 807241,
"94": 807582,
"95": 806441,
"96": 807273,
"97": 806247,
"98": 807214,
"99": 806121,
"9a": 807369,
"9b": 805050,
"9c": 807193,
"9d": 804651,
"9e": 805703,
"9f": 806447,
"a0": 807073,
"a1": 804877,
"a2": 806488,
"a3": 808111,
"a4": 807521,
"a5": 807368,
"a6": 807080,
"a7": 807728,
"a8": 807286,
"a9": 805914,
"aa": 806933,
"ab": 807507,
"ac": 806695,
"ad": 805484,
"ae": 807000,
"af": 806443,
"b0": 807121,
"b1": 808417,
"b2": 806757,
"b3": 806360,
"b4": 807409,
"b5": 807373,
"b6": 806826,
"b7": 806952,
"b8": 804422,
"b9": 804827,
"ba": 806527,
"bb": 808001,
"bc": 806483,
"bd": 808164,
"be": 807635,
"bf": 805253,
"c0": 807279,
"c1": 805804,
"c2": 806770,
"c3": 807438,
"c4": 805948,
"c5": 806977,
"c6": 806627,
"c7": 807100,
"c8": 806784,
"c9": 805677,
"ca": 806536,
"cb": 808659,
"cc": 805992,
"cd": 806278,
"ce": 807179,
"cf": 806388,
"d0": 805843,
"d1": 807242,
"d2": 807379,
"d3": 806578,
"d4": 807552,
"d5": 808390,
"d6": 806332,
"d7": 805571,
"d8": 806251,
"d9": 806973,
"da": 805506,
"db": 805105,
"dc": 807308,
"dd": 807342,
"de": 807453,
"df": 806380,
"e0": 806394,
"e1": 808819,
"e2": 807404,
"e3": 807778,
"e4": 807589,
"e5": 805130,
"e6": 807673,
"e7": 807008,
"e8": 807022,
"e9": 807116,
"ea": 806415,
"eb": 806308,
"ec": 807477,
"ed": 806422,
"ee": 806196,
"ef": 806436,
"f0": 807580,
"f1": 805867,
"f2": 807413,
"f3": 806299,
"f4": 806079,
"f5": 807552,
"f6": 806720,
"f7": 807777,
"f8": 805515,
"f9": 807081,
"fa": 808417,
"fb": 807828,
"fc": 804863,
"fd": 807098,
"fe": 805808,
"ff": 806984
},
"chi_square": 270.03298253093277
},
"block_analysis": {
"8": {
"block_size": 8,
"total": 25821184,
"unique": 25821184,
"repeated": 0,
"max_repeat": 1,
"ecb_suspicion": false
},
"16": {
"block_size": 16,
"total": 12910592,
"unique": 12910592,
"repeated": 0,
"max_repeat": 1,
"ecb_suspicion": false
},
"32": {
"block_size": 32,
"total": 6455296,
"unique": 6455296,
"repeated": 0,
"max_repeat": 1,
"ecb_suspicion": false
},
"64": {
"block_size": 64,
"total": 3227648,
"unique": 3227648,
"repeated": 0,
"max_repeat": 1,
"ecb_suspicion": false
},
"128": {
"block_size": 128,
"total": 1613824,
"unique": 1613824,
"repeated": 0,
"max_repeat": 1,
"ecb_suspicion": false
}
},
"strings_sample": [
"~T:3aWlRv!",
"R\\}!vUL&}",
"t/[uEjGt",
"F5L?G`'8M",
"0PhmQ:F\"",
"9>A-)99<",
"qz@SrLMZo",
"8b^)zZU ",
"wZA\\-`EW2`",
"lb=V|29=",
"]l<h0al?",
"AKZ|3ESA^",
"`CQo);sG",
"k0>zvtXO^R",
"Snw.=cUji[",
"Wtv-#&m&",
"/iq)\\RH%k",
"!.C6NyK7",
"r ;PT-)f",
"QV .@8OI",
"auxTE}7&",
"hD}}WE2Bz",
"j5kCBwjQ",
"RIy?y#&oM",
"o:$v<PDo%",
"#O/0nbML",
"vj T;t$H",
"r\\Zm&SbZ",
"H >wMn0Q",
"bd7D#Y3#",
"9[a[7`z9",
"-Z|FKAl*",
"Sz, !?yf",
"Bh~:He,^",
"jrVG+`85:",
"k }9jn[!",
"va@\\2\"goX5",
"5r+;X\\-\"p:",
"I|K0wQI6",
"(]2(T!De",
"?GFvHz//",
"v:H*%WdxL.",
"#0MpE(oz81ob",
"zkY<j*C[",
"c>QO?uD=",
"8I&C{_4g",
" ,S}x9JJf",
"j'd'3<lD",
"L{O<%$a~P",
".*nOY.;<\\0",
",;|%9~]9",
"gX69[NRD",
"B;Lz[$'/`",
"[MQ&ZP,<xWn",
"PFIIk/;w",
"a=kl!1,w",
"j-\\6Z/0F",
"/dfVSEN6",
"`_gf ]UE",
"4fJID~K7W",
"z%S0-4U9",
";=>{Bj<BtV",
"2Igg7;rou",
"Q;kbNxF#",
"7gTEK~i!",
"NO(#kWnt",
"9.q{<qA?",
"z!M?_ qx",
"rce~ |16D",
"xpP'fr<>:",
"'-VqvV|\"",
"AKDwqR]R])",
"l#VxpFu,",
"@KUKtn.E",
"9!h5`yJhDXY",
"sZ57!GYC",
"n5k>`[|yi",
"Z38D$tIe",
"Xb*7I-:~2n",
",qnnC:tf{",
"94GTAwrw",
"p_ebhPk0c",
"@2\\pH:_/",
";{\\oA^G=\"9",
"\\Q_ku' hC",
"4fu4J5V|",
"*1W1zG}''",
"a*ufyK2m",
";1]Rml):l",
"-8R,f`V4F",
"{cKk1jStoya",
"]LmD~?Q8",
" bKd11ON`",
"=/RTuz+%[qn",
"Pc/n?^Rl,A",
"n<0-s$/p0",
"UG>,B=~SG",
"\\Xd^K==^",
"gyvMEGyX",
"7w)7xc!&QP<",
"iH<oL9|[T",
"i6}D.OVse",
"Rz=uv~?R51hL",
"q90b\"\\*T",
".%b8U1}L",
"t=LH,i$lU",
"W;a?I7 b%",
":ZPZO\\j-&",
"ux 7rq8O/",
"mBU/\\mDT",
"1;lfb6e~\"",
"u+#TxCta",
"@g!_S7NZZ",
"l|[ x-_q",
"LbB+!G!C;eU",
"!`WV!jZx",
"BU]U;2wT\\",
"kcTCc>bD",
"yk[[\"B8%",
"]%fF8rSp"
],
"magic_header_validation": [],
"_scan_id": "20260701_130413_27million_eur.dat",
"assessment": {
"likelihood_percent": 85,
"verdict": "Sangat mungkin encrypted / random / proprietary blob",
"reasons": [
"Entropy sangat tinggi, mendekati ciphertext/random.",
"Tidak ada blok 16-byte berulang (konsisten dengan cipher mode acak).",
"Tidak ada header format publik yang dikenali di awal file.",
"Distribusi byte relatif merata (chi-square rendah)."
],
"crypto_hints": {
"aes_ecb_likelihood": 0,
"cbc_ctr_gcm_chacha_random_family": 98,
"compressed_unknown_likelihood": 40
},
"note": "Statistik tidak bisa memastikan algoritma AES/ChaCha tanpa kunci/metadata."
},
"deep": {
"carving": {
"embedded_files": [
{
"offset": 3466172,
"type": "BZIP2",
"magic_len": 3
},
{
"offset": 5637854,
"type": "BZIP2",
"magic_len": 3
},
{
"offset": 5837109,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 13124903,
"type": "BZIP2",
"magic_len": 3
},
{
"offset": 13451739,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 17085291,
"type": "GZIP",
"magic_len": 3
},
{
"offset": 17730211,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 18518956,
"type": "JPEG",
"magic_len": 3
},
{
"offset": 21083785,
"type": "JPEG",
"magic_len": 3
},
{
"offset": 38038684,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 39743147,
"type": "GZIP",
"magic_len": 3
},
{
"offset": 40824875,
"type": "JPEG",
"magic_len": 3
},
{
"offset": 51223531,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 56206658,
"type": "JPEG",
"magic_len": 3
},
{
"offset": 59486190,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 59594556,
"type": "GZIP",
"magic_len": 3
},
{
"offset": 62479583,
"type": "Script shebang",
"magic_len": 3
},
{
"offset": 63247428,
"type": "JPEG",
"magic_len": 3
}
],
"embedded_count": 18,
"type_occurrences": {
"Windows PE/EXE": 200,
"GZIP": 3,
"BZIP2": 3,
"JPEG": 5,
"Script shebang": 7
},
"trailing_data": null,
"polyglot_candidates": [],
"is_polyglot": false
},
"ioc": {
"indicators": {
"ipv6": [
"0:e:C"
],
"domain": [
"f.uk"
],
"windows_path": [
"h:\\y!m\ufffdp\u04a1\ufffd\ufffd",
"e:\\\ufffd\ufffdN\ufffdT\ufffd\ufffdx",
"G:\\;zm\ufffd\ufffd\ufffd\ufffd\ufffd\u0006\ufffd=\ufffd\ufffd",
"A:\\&5\u000f\ufffd\ufffd\ufffd\u048b\ufffd\t\ufffd,P",
"l:\\\ufffd+\u0003\u0003\u001f\t}\ufffd\ufffdH%\u001d\u032d$\uabfc\ufffdE\ufffd1[u\u0018Mk\ufffd\ufffd\ufffd\ufffd[\ufffdZ\u8da4\u0010\ufffd\ufffd\ufffdr\ufffd",
"P:\\a3\ufffd}\ufffd\u0003\ufffd\ufffd\ufffd\ufffd\ufffd{\ufffd\ufffd\ufffd",
"S:\\\ufffd\ufffd\ufffd\ufffd\u0719\u0001;\ufffdS\ub4f0\u0019\ufffdN\u001c%^-\ufffdlhs\ufffd\ufffd\ufffd\ufffd\ufffd\u0005h0\ufffd\ufffd\ufffd7e\u0010\ufffd\ufffd\ufffd\ufffd\ufffd\fk\ufffd\ufffd\ufffd62\ufffdE\ufffd\ufffd\ufffd\u39b9'\u000bT\ufffdP\u001f\u03cbN\u0001s\u0014\u0005#\ufffd\ufffd\ufffd+\ufffd\ufffd",
"m:\\\ufffd\ufffd\ufffd\u0002\ufffd\ufffd\ufffd\u0006o\u001d\ufffd\ufffd\ufffd[$\ufffd\u0683\ufffdz\u001e\u0003r",
"T:\\\ufffd\\\ufffd;\u001c\ufffd\ufffd\ufffdj(\u0012 v\ufffd\ufffd\u07a1\ufffd\ufffdT\ufffd\ufffd\u000f",
"r:\\L\ufffd\ufffd\ufffdW\ufffd\ufffd\ufffd6",
"h:\\\ufffd\ufffd]d\u001d\u0001\ufffd\ufffd38p\ufffd\u0016\ufffd\ufffdvB\u0102O\u000e\u0014\ufffd\u001a\ufffd[Bwlf\ufffd4[\ufffdQ\u00bd",
"i:\\\ufffd\ufffd\ufffd~l[\ufffd=-%\\I\ufffdT\ufffd\ufffd\ufffd\ufffd\u0011\ufffd\u0004",
"q:\\JC\ufffd3\ufffd\ufffd\ufffdv\ufffd\u000e\ufffdO\ufffdb\ufffd\ufffd3\ufffd\u001f",
"I:\\\ufffdt\ufffd\ufffdu\ufffd\ufffd\ufffd\ufffd\ufffd\u0005}\ufffd\ufffd",
"y:\\ 0\ufffd\u000b\ufffd\ufffd\ufffd\ufffd",
"u:\\\ufffd\ufffd_\ufffd",
"b:\\\ufffd\ufffd\ufffd\u0293h\ufffd",
"d:\\Z\u001a\ufffdp\u0018\ufffdf\ufffd\ufffd \ufffd\u000b\ufffd_=\ufffd\ufffd\ufffd\u0664\ufffd8W^\ufffd1\ufffd\ufffd\ufffd",
"x:\\J\u0526\ufffd\ufffdE\u0012\u000e\ufffd\u0013\ufffdp\ufffd\ufffd\ufffd\u0005\ufffd\ufffdc'\u0011\u000b\ufffd]\ufffdC\ufffd\ufffdCA\ufffd",
"X:\\%p\ufffdG\ufffd\ufffd\u05d6\ufffd\ufffdH\ufffd \ufffd\ufffd\ufffd\ufffdc\ufffd\ufffdxSHh\ufffd\ufffdP'",
"O:\\\ufffd`7\u0012\ufffd\ufffd\ufffdV\ufffdZ\ufffdu{_\ufffd",
"j:\\6X\ufffdF\ufffd",
"Q:\\\u000e\u000b\ufffdl\ufffd9\ufffd\ufffd\ufffd\ufffd\ufffd\ufffd\u001e\ufffd\ufffd\u0013N\ufffd\ufffd\ufffd\fF#\u0012\u0006\ufffd\ufffd\ufffd\u001b\u0204\t\ufffd\ufffd`\ufffd&\ufffd5\ufffd\ufffd\ufffdj\ufffd\ufffd\f\ufffd\ufffd1\ufffd\u0001_u\ufffd\u05c4\u00134\ufffd\ufffdn\u0013(\ufffd\ufffd\ufffd\ufffd^$\ufffd[M\u007f1J\u02a1",
"r:\\\ufffd\ufffd\u000f\ufffd\ufffd\ufffd\ufffd\ufffd\u0236\u0004\ufffd\u0011\ufffd\u001d\u0557\ufffd#\ufffd\u0005\f\ufffd\u0016\ufffda\ufffd\u0018\u0019\ufffd",
"d:\\\ufffd\ufffd\u001f\ufffd\fw\ufffdY\ufffd\ufffd",
"R:\\\ufffd\tQn9\ufffd\ufffdT\ufffd\u0013\ufffdd\u001c\ufffdU\ufffd\u0018\ufffd3\u010ag\ufffd\ufffdy\ta\ufffd\ufffd\ufffd-.D\ufffd",
"T:\\=F\u00038\ufffd^\ufffd\ufffd\ufffd\ufffd\u001f@h\ufffdA\u06e1",
"W:\\\ufffd\ufffd\u06a9}\ufffdV\ufffdHc\ufffd\u001f\ufffdx\ufffd\ufffd\ufffd\b\ufffd\ufffd\u0019g\u001d\ufffd\ufffdCS,e\ufffdZ\ufffd\ufffd\ufffdv&\ufffdG\ufffdq5\ufffd\u001c\ufffd\u001c\ufffds\u000fRB\u017e\ufffd\\[C\u0005\ufffdZ",
"H:\\o\ufffd\ufffdm-\u0000\ufffdU@\u000el\ufffd\ufffdr\ufffd\ufffd=\ufffd\ufffd\ufffd\u0141]'\ufffdM\f",
"L:\\\ufffd\ufffd\ufffdEy8\ufffdQl\ufffd\ufffd\ufffd\ufffde\ufffd\ufffdd\u0011d\ufffd\ufffd\ufffd\ufffd\u001c\ufffd",
"j:\\\ufffd\ufffd\ufffdDH\ufffd\ufffd\ufffd`\ufffdN,\u0001s${2C\ufffd1\ufffdD]\ufffd1t\ufffdZ\ufffd\ufffdxJ\ufffd\ufffd\u0013\ufffd\u0017\ufffd\ufffd\u0015-\ufffd\u0191\u001c)\u0010\ufffd\uf29a3}k\ufffd0\u0019 \ufffd,.\ufffd\ufffd\ufffd\ufffdb\ufffdBR\ufffd\ufffd\t[\ufffd\ufffd25\ufffd\b",
"Z:\\\ufffdR\\!\u0015\ufffd\u0012\ufffd\u05a5\ufffdJ\ufffdkTd\ufffd\u0016\u001e\ufffd\ufffd\ufffd\u0001n\u001bmq\ufffd-"
],
"unc_path": [
"\\\\7\\\u07a3\ufffd$)\ufffdS\u001c\ufffd\ufffdq\ufffd^\ufffdOBJ\ufffd8\ufffd\ufffd\ufffd\ufffd\ufffdU3WP\u016dEJ\ufffd\ufffdL\ufffd\ufffd\ufffd\ufffd\ufffdw\ufffd\u000f\ufffdy'\ufffdl\ufffd\ufffd07"
]
},
"counts": {
"ipv6": 1,
"domain": 1,
"windows_path": 32,
"unc_path": 1
},
"total": 35,
"suspicious_base64": []
},
"rules": [
{
"rule": "Suspicious_PDF_Action",
"severity": "medium",
"description": "PDF berisi JavaScript / auto-action.",
"matched": [
"/JS",
"/AA"
]
}
],
"yara": {
"available": true,
"matches": [],
"rules_dir": "/root/ForensicLabX_Enterprise/yara_rules"
},
"fuzzy_hash": "3145728:qXBJGddQWn0QzmONoQXC3PrXy4fahdBeiAJWFpa/liAHzqFz0it:qTidQC0QzfyD3P+4+BeiAwaVqFwit",
"flags": [
{
"severity": "medium",
"message": "[Suspicious_PDF_Action] PDF berisi JavaScript / auto-action."
},
{
"severity": "medium",
"message": "18 file tertanam terdeteksi (BZIP2, GZIP, JPEG, Script shebang)."
}
],
"plugins": [
{
"plugin": "Custom Keyword Rules",
"result": {
"flags": []
}
},
{
"plugin": "Double Extension Detector",
"result": {
"checked": "27million_eur.dat",
"flags": []
}
}
],
"risk_score": 30,
"attack": [
{
"technique_id": "T1204.002",
"technique": "User Execution: Malicious File",
"tactic": "Execution",
"evidence": [
"Suspicious_PDF_Action (raw)"
]
}
]
}
}