467fd530984e0391dff787882e47f7b9f1c408b60b07ba7acfc436e3b4a62f70 | Triage™

Login
Reports

Overview

overview

6

Static

static

1

ci4_payrol...nts.js

windows10-2004-x64

3

ci4_payrol...nts.js

windows11-ltsc_2024-x64

3

ci4_payrol...on.ps1

windows10-2004-x64

6

ci4_payrol...on.ps1

windows11-ltsc_2024-x64

6

ci4_payrol...bug.js

windows10-2004-x64

3

ci4_payrol...bug.js

windows11-ltsc_2024-x64

3

ci4_payrol...4.html

windows10-2004-x64

3

ci4_payrol...4.html

windows11-ltsc_2024-x64

3

ci4_payrol...on.ps1

windows10-2004-x64

6

ci4_payrol...on.ps1

windows11-ltsc_2024-x64

6

ci4_payrol...n.html

windows10-2004-x64

3

ci4_payrol...n.html

windows11-ltsc_2024-x64

3

ci4_payrol...e.html

windows10-2004-x64

3

ci4_payrol...e.html

windows11-ltsc_2024-x64

3

ci4_payrol...n.html

windows10-2004-x64

3

ci4_payrol...n.html

windows11-ltsc_2024-x64

3

ci4_payrol...add.js

windows10-2004-x64

3

ci4_payrol...add.js

windows11-ltsc_2024-x64

3

ci4_payrol...dit.js

windows10-2004-x64

3

ci4_payrol...dit.js

windows11-ltsc_2024-x64

3

ci4_payrol...add.js

windows10-2004-x64

3

ci4_payrol...add.js

windows11-ltsc_2024-x64

3

ci4_payrol...iew.js

windows10-2004-x64

3

ci4_payrol...iew.js

windows11-ltsc_2024-x64

3

ci4_payrol...x.html

windows10-2004-x64

3

ci4_payrol...x.html

windows11-ltsc_2024-x64

3

ci4_payroll/spark

ubuntu-18.04-amd64

1

ci4_payroll/spark

debian-9-armhf

1

ci4_payroll/spark

debian-9-mips

1

ci4_payroll/spark

debian-9-mipsel

1

ci4_payrol...er.ps1

windows10-2004-x64

6

ci4_payrol...er.ps1

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

Target
php-ci4_payroll.zip
Size 20.3MB
Sample260925-wp71rashpc
SHA256 467fd530984e0391dff787882e47f7b9f1c408b60b07ba7acfc436e3b4a62f70
MD5 51b5ff6e69c1c2965d9129d2eb4ca87b
SHA1 3b29e802b1e6152c645510fadabff26fe7f578e2
SHA512 bf76f4f9648b4704c41ea3009cbe37f569ac547f7e35df9828215af3581f14d7a0bb43ce60e83ba49596e6206cb1a6cb712edbd86f5fbc097f5cf82d24e7b288
SSDEEP 393216:38qd6s2HnhGd6QE0272aO8ZWDFnmnok+43gNit2mqNjArrtza4eJlIm:B8BSr272aORBmn38ObEjArBEJl3
TLSH
T10727E05AF62834D3EEC36F31DF098A57DA3842F3624E705B16881A90DE828C52F5F55B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution linux

Static task

static1

Behavioral task

behavioral1

Sample

ci4_payroll/app/Config/Events.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral2

Sample

ci4_payroll/app/Config/Events.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral3

Sample

ci4_payroll/app/Views/errors/cli/error_exception.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral4

Sample

ci4_payroll/app/Views/errors/cli/error_exception.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral5

Sample

ci4_payroll/app/Views/errors/html/debug.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral6

Sample

ci4_payroll/app/Views/errors/html/debug.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral7

Sample

ci4_payroll/app/Views/errors/html/error_404.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral8

Sample

ci4_payroll/app/Views/errors/html/error_404.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral9

Sample

ci4_payroll/app/Views/errors/html/error_exception.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral10

Sample

ci4_payroll/app/Views/errors/html/error_exception.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Behavioral task

behavioral11

Sample

ci4_payroll/app/Views/errors/html/production.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral12

Sample

ci4_payroll/app/Views/errors/html/production.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral13

Sample

ci4_payroll/app/Views/layouts/login_base.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral14

Sample

ci4_payroll/app/Views/layouts/login_base.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral15

Sample

ci4_payroll/app/Views/layouts/main.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral16

Sample

ci4_payroll/app/Views/layouts/main.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral17

Sample

ci4_payroll/app/Views/pages/employees/add.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral18

Sample

ci4_payroll/app/Views/pages/employees/add.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral19

Sample

ci4_payroll/app/Views/pages/employees/edit.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral20

Sample

ci4_payroll/app/Views/pages/employees/edit.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral21

Sample

ci4_payroll/app/Views/pages/payslips/add.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral22

Sample

ci4_payroll/app/Views/pages/payslips/add.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral23

Sample

ci4_payroll/app/Views/pages/payslips/view.js

Resource

win10v2004-20260911-en

windows10-2004-x64

1 signatures

150 seconds

Behavioral task

behavioral24

Sample

ci4_payroll/app/Views/pages/payslips/view.js

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

1 signatures

150 seconds

Behavioral task

behavioral25

Sample

ci4_payroll/app/index.html

Resource

win10v2004-20260911-en

windows10-2004-x64

10 signatures

150 seconds

Behavioral task

behavioral26

Sample

ci4_payroll/app/index.html

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

9 signatures

150 seconds

Behavioral task

behavioral27

Sample

ci4_payroll/spark

Resource

ubuntu1804-amd64-20260513-en

ubuntu-18.04-amd64

0 signatures

150 seconds

Behavioral task

behavioral28

Sample

ci4_payroll/spark

Resource

debian9-armhf-20260513-en

debian-9-armhf

0 signatures

150 seconds

Behavioral task

behavioral29

Sample

ci4_payroll/spark

Resource

debian9-mipsbe-20260513-en

debian-9-mips

0 signatures

150 seconds

Behavioral task

behavioral30

Sample

ci4_payroll/spark

Resource

debian9-mipsel-20260513-en

debian-9-mipsel

0 signatures

150 seconds

Behavioral task

behavioral31

Sample

ci4_payroll/system/Autoloader/Autoloader.ps1

Resource

win10v2004-20260911-en

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral32

Sample

ci4_payroll/system/Autoloader/Autoloader.ps1

Resource

win11ltsc2024-20260911-en

windows11-ltsc_2024-x64

4 signatures

150 seconds

Malware Config

Targets

- Target
  ci4_payroll/app/Config/Events.php
- Size 1KB
- SHA256 00f4b95ef3dd141f34420c08d18ded8e0e36d3d452c57f16d341d4c0d8215e89
- MD5 69f5d4180f0d2a99bf337d8e95c8632e
- SHA1 2668de8825fea92156191b444bf0452903009131
- SHA512 9c773681bd46333f46e5b5964bfcd4c2744e66baf98584197e78ec99984a4ef939f56d6f19cf71e0f16e3d35b658af43ca91b81275bceb4eb81f350908e5b410
- TLSH
  T1B8311208DDE75162049BE2B567CF35D7C3B7429F332849D17A0C8E285F81524429EFE9
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral1 behavioral2
- Target
  ci4_payroll/app/Views/errors/cli/error_exception.php
- Size 1KB
- SHA256 f7f680f448d7c5058ac7ebd5f50a71d01d5f9c2edcd6128d50ad1ee4aa7dd983
- MD5 1c4c66c091051be9f714944120cb2388
- SHA1 fc459f4864944e38ac147b747eae9e3a6cf04e0b
- SHA512 b8f11d888435f4caf05c23704e76b350921d6c1042a1936ff5935b89a1f9d8095ce3a43474f55a2feb79aa41414018f46952ab965c101c76e20ca562a6b709db
- TLSH
  T14E41CC1874922316817366ACA29F9208F9599E43E1247F42FCDF81902FE44BCDEDB598
- MD5 SHA1 SHA512 TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  ci4_payroll/app/Views/errors/html/debug.js
- Size 2KB
- SHA256 968765d1d4913a15e7fd32bc348912e527bf54503d132db7f8b0f1ba66719dd0
- MD5 cd478d7c684aa42c3294f85802be6b19
- SHA1 79f7919c1920353db6194c388a9681b44f142852
- SHA512 d4c88d86a5e008ee3783063ea36a4604178d4c5641ff89a6b2ddd8a088f3cd968213f8f22fef56839db7961d319051d2731b987ac526df503feae8f8cbe9a605
- TLSH
  T14B5145B52A56123C3957643A0FDF75887578441F9A04E804BD5CC3C81FE1E3269B6BED
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  ci4_payroll/app/Views/errors/html/error_404.php
- Size 2KB
- SHA256 de1c94cb6b54002ac871f0164390e583bb88e01f27d0b1f881cb62efa2ff5098
- MD5 f5858c2fb0c9723b8ace5c6e7f025311
- SHA1 d284591bd9767bae5176940af2a47f443464c982
- SHA512 481efed053c2bdca9a9235ff3f1105db9c1fa2bb5e204d6571c41c9c3cc917f2f5e72b6e01c63b65d835e3fcebc5cce8f2cf7745079dabeedddeeffe34eac385
- TLSH
  T16A41005E4AB306406853E4E13BE193843566520F980BC91D3FCEB350CF4D668A9D3B8C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  ci4_payroll/app/Views/errors/html/error_exception.php
- Size 15KB
- SHA256 dd7ebecc7ccc9eb9f3d63cb9457ac8781812693c586e2499d6e5d5a953fd06aa
- MD5 0373b081a7561f3af6d003a3860fa5f4
- SHA1 8afeea33930d2d6e4155136609978e55023ccf1c
- SHA512 90983f85e882fbc81724eb8561180e991fc7939b59c6378b96bd603b2e2921f97a633b335bc53740623aae75e5d57a223463d69d373296e979b73871e2f9a372
- SSDEEP 192:QZT1hBTLSpRR/3fjwHsbOmmQLmfMQmWoq5Yog4ZhGgE:Am/PjwHsCmm6mf1mWdYZqo
- TLSH
  T17A621027A8F5619292024CBA4BC41F4B5FC7D52BA203055DBD6E12FF5FC4D9A8C07ACA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  ci4_payroll/app/Views/errors/html/production.php
- Size 495B
- SHA256 3f3035e5f32deed1d05aa990c3d3d336b3e2a83bab37f99a00738e1bc47c68d2
- MD5 32949181e64a3fca88337e328d3969a0
- SHA1 272ab27e1c4ef5de769dc55cde07d42fd21e3316
- SHA512 77ec26903557269e4e14cee7d2088711c6ebd38acc1efc04545bcba3267ea99b75930a7853321e2ebfde60589c9af1cc6d5f651c674569e41305f22edaf3ce96
- TLSH
  T1CFF0271A04E22A229010E97467C1F7542CE3910BD7198D60769E617F9FC5C42C997168
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  ci4_payroll/app/Views/layouts/login_base.php
- Size 1KB
- SHA256 5ead4d65acb789b17c509a7f114144ebd745b1570f36e8c6505acfdbd078048d
- MD5 78833ac0e0744091d6c92a0e1ebfcd72
- SHA1 5c7f17c22202f44796989332956a75f4fd240277
- SHA512 0329bfdfe0e157b1b73bd6ba3d78a4f63570a0a6482d8971172d42d3ff333e517b7989ab18b750562683d80278e3337e9078cf3697cae78a97bb1c475a388d36
- TLSH
  T1F24193563540991A0132095A36F6D668FCA2214321E4A88235BFA73F0FF678FC8BB9D4
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  ci4_payroll/app/Views/layouts/main.php
- Size 5KB
- SHA256 28c4e4b564a86050916cbe7ab256dfdfc9b07f3ba797a42152441f37ed7ddb2a
- MD5 37f709b6370b68ad66d1749286c25de8
- SHA1 b3668620b3fae31302e2ba9b7a7f48583cf08f1b
- SHA512 44329adc8f93e3b4a261b63688729ec0503c3941750c5159c3e4edc7e299ed91ad4cfe84fc4a0d1ac895baa71ba0d9e728003a9effa6e520869dec3504756ba1
- SSDEEP 96:fF2QQXT7TvV28fPZPhg6b8rDPrXq/8JVMPCoXC/Szm:N2QQjfVtPZPhg6grkerwW
- TLSH
  T1BAC1952390C0752B02328A8E3AF19759FDE24107B3555A5670BF6BEF4FF2E118C1B946
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15 behavioral16
- Target
  ci4_payroll/app/Views/pages/employees/add.php
- Size 8KB
- SHA256 5c1270871b86f37e56b8a4dbe560111e3ccf23ae1c0c149aed983adacfe3b0ce
- MD5 3016c215930f61f1635609508a770f52
- SHA1 1bb5f1226f509c17543340f2cb833e87629820cd
- SHA512 b95add522feeb51aa60e670b207af91eefef12e30c1eaaef1bd25bc14fe3df27f9718f33ce3918e178c324215c9a6dd2e915bc3a3d943bab5e0df8c4fc3f9ab8
- SSDEEP 96:0rslAUUcOUCFKoO/0nR2TB9ZP+QXvbTnK:0rsaUwnk7P+QX3K
- TLSH
  T1AA02ACA154D84E2AD533D8990B54AB58FE41CA23D367121EFDDC6BDA0FF6C01CE0B1A9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18
- Target
  ci4_payroll/app/Views/pages/employees/edit.php
- Size 7KB
- SHA256 5de490df99792555d02a79427907dce8fba5df62f88ccc67b143aa91b7051ebd
- MD5 82399fd6caf585466802e64dc21512f0
- SHA1 52acbb03db4e0294958cd928a068d8307f3f1ff1
- SHA512 0f00a4ce7860e78b6351ece51c8004f2f5c962c77a5249a0f3de79bc0b2ce242626d02283709b2fda03630058eb5e563429b2c458eb3e435356205dc017cbece
- SSDEEP 96:0r0lAULcOU4FKoVioHdIFB/dPIQXYd04D4yHnK:0r0BUSHeVPIQXYd04D4QK
- TLSH
  T1C9F164A090DD193E94738CD61B505A44FE96C223875B920EB1DCEFEB0FF6D02DA0B122
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral19 behavioral20
- Target
  ci4_payroll/app/Views/pages/payslips/add.php
- Size 11KB
- SHA256 c562878e49cdf89cd46056ea092eb062f9bc87df39751c0587824dd95f866168
- MD5 20ac9712431737940ce90df519eb7269
- SHA1 2755cf719e8e4d189e675f1925704ca69a5bf60f
- SHA512 bd29e6f50d56a9c9139a0b06134c4655938c1975a0eb7abd7d9994e201d5de5fd92a0f222ff46412bc403fa5d043bd6a7505f74f649aa0c4a8f587510c8ba946
- SSDEEP 192:0EOF++RtXV0k27zzjUM72zAUPdcTdAzPi:0N4vWkHTKi
- TLSH
  T15532301474E06B37507758FA6EB68F01FF858217CA26510ABADC7BE30FB2C02D617A59
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral21 behavioral22
- Target
  ci4_payroll/app/Views/pages/payslips/view.php
- Size 8KB
- SHA256 a4a0c5831448ca5b1e83bc83df264240c23c75df4054894f332f7323d3614e17
- MD5 77f0af60dc9e8c26d4fcad33a782df89
- SHA1 cad7dbf52a19a883fd94fe61c7fe4e342cae9efb
- SHA512 fe95a0c139cdf74ba5697220bcfe49ceec2d66d5e72561ae4cbadf6e821c4ff42029c0314f3c1c8e4f208e5902b4f25fc3a25a6874d4b977ebcc04c4fc5a332c
- SSDEEP 96:0rVDAUMoN8Ku07oNIhOILaBGdgoaMVG9BHG/HBQdHGbmL2Skr9uGXK:0rVgC8KugCIhOigoqBHG/H65NkxuGXK
- TLSH
  T1E602A93174E06B7B103381A656229E49FFC2A147DA23930A79EEABD70FB2C02DD57548
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral23 behavioral24
- Target
  ci4_payroll/app/index.html
- Size 134B
- SHA256 01644da213f8458177f02e6d5fec529e3c8fd1bac86b0c1771d43b961079ea32
- MD5 cbae23ee54079b76d0410ea9411af76d
- SHA1 292776494c22dba225177561b880cbd9620ec7cc
- SHA512 c1cca4cb444ef393a8695c295effb91c4b8ed2a5e4ac71df1d6ae77244bf6f23be4c777411c64c94fa363d1f91c0ffa32131c73291f71dfbf3afd10976a42cc7
- TLSH
  T12FC02B4B310D1044132363800EC03B60354303C040C309841F87D1138A0451EC4C704C
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  ci4_payroll/spark
- Size 2KB
- SHA256 acef48f6bfd7a2ced602a8dabb4a18006d9a051402124c4ab92862f885f4cd23
- MD5 c32763d90608685a8c781ff6521533b5
- SHA1 c8cb87388573237a0063ded8c0c038bf56dd2b58
- SHA512 5fff792f2e08656b6eda16849d192f11f3be77f62b65a9ea7cff8c2d5434c6782cf9adb1779d21b6ba952297e524b0b5020c72f0313ad8d46463bae989e74892
- TLSH
  T110518653BEEC027344B1E9EB660E4661C325997EF350F7204819111C5EE959083FEEEB
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27 behavioral28 behavioral29 behavioral30
- Target
  ci4_payroll/system/Autoloader/Autoloader.php
- Size 10KB
- SHA256 77fdb8df5631472451be7b00cdeb0512a3e118f79a5032c9b2d38a7527fd8bf9
- MD5 08c49eb246434baed74d5ef8f0e8467a
- SHA1 b25a0bb1527f6781297521d7bb5ad9715faeed89
- SHA512 7e1bb9520adb66c8d9f40d1185bddc1f3ec9e64f2f16187d340e1e4684a6408b96fbd0890464f939b5c9beca98fedc1db6dcf2967bbbce43f25575dc4a3f3181
- SSDEEP 192:kptJz55tPFMSNdt4bs4gnQy0HVSOwHehNg40hnjgS18OzVaYa8MDSCuzdyZc9LYC:kptZ7JiZugOg1VOdpYIqDIq2
- TLSH
  T1FA22461E68DE45BB0513657C03CF5484F46AA11F922A8D557DFD02B86F80B2C89F2FAB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

JavaScript

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

System Time Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32

© 2018-2026

Terms | Privacy