Malicious

How This Was Determined

Malicious Indicators

• CAPE signature: stealth_timeout - Possible date expiration check, exits too soon after checking local time (severity 1, confidence 40%)

Possible IOC / Review Indicators

• CAPE malscore is elevated: 2.
• CAPE signature: stealth_network - Network activity detected but not expressed in monitor API logs (severity 1, confidence 100%)
• CAPE signature: antivm_checks_available_memory - Checks available memory (severity 1, confidence 100%)
• CAPE signature: static_pe_pdbpath - The PE file contains a PDB path (severity 1, confidence 80%)
• CAPE signature: language_check_registry - Checks system language via registry key (possible geofencing) (severity 1, confidence 100%)
• CAPE signature: registers_vectored_exception_handler - Registers a vectored exception handler (VEH), possibly to hijack execution flow (severity 2, confidence 80%)
• CAPE signature: pe_deep_entrypoint - The PE entry point is located unusually far into section, indicative of an appended packer stub that jumps to the original entry point (OEP) (severity 3, confidence 100%)
• CAPE recorded network activity (33 network item(s)).
• CAPE extracted 2 payload-like item(s).

Lower-Risk Facts

• CAPE malstatus is Clean.
• No YARA hits were recorded.
• No CAPE YARA hits were recorded.
• No ClamAV detection was recorded.

Important Notes

• VirusTotal was unavailable in CAPE: Unable to complete connection to VirusTotal. Status code: 429

VirusTotal

Stored CAPE result: Unable to complete connection to VirusTotal. Status code: 429

Manual lookup: Open SHA256 in VirusTotal

File Details

File name	MatterControl.exe
File type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Size	117248
MD5	abd3e8c264362cdc0ffcf6b2c563633a
SHA1	fdab7eb7f35431a1d44347468f21d7b4425189bc
SHA256	7a757f19174af8c266ed0be2c641f52bf992cbbd1affafee521b36de1b47b2ad
VirusTotal lookup	Open SHA256 in VirusTotal

Sandbox Run Details

Task ID	21
Started	2026-06-17 17:36:50
Ended	2026-06-17 17:37:28
Duration	38 seconds
Package	exe
Route	internet
Machine	cuckoo1
CAPE score	2.0
CAPE status	Clean

YARA / AV Indicators

Source	Rule / Detection	Description / Evidence
No YARA hits recorded.
No CAPE YARA hits recorded.
No ClamAV hits recorded.

CAPE Signatures

Severity	Confidence	Signature	Description
3	100%	pe_deep_entrypoint	The PE entry point is located unusually far into section, indicative of an appended packer stub that jumps to the original entry point (OEP)
2	80%	registers_vectored_exception_handler	Registers a vectored exception handler (VEH), possibly to hijack execution flow
2	50%	injection_rwx	Creates RWX memory
1	100%	stealth_network	Network activity detected but not expressed in monitor API logs
1	100%	antivm_checks_available_memory	Checks available memory
1	80%	static_pe_pdbpath	The PE file contains a PDB path
1	40%	stealth_timeout	Possible date expiration check, exits too soon after checking local time
1	100%	language_check_registry	Checks system language via registry key (possible geofencing)

Behavior Summary

Executed commands / child processes	0
File writes	0
File deletes	0
Registry writes	0
Created services	0
Started services	0
CAPE payload-like items	2
CAPE extracted configs	0
Dropped/related files captured	0
Network indicators	33

Executed Commands / Child Processes

None recorded.

File Writes

None recorded.

Registry Writes

None recorded.

Created Services

None recorded.

Started Services

None recorded.

CAPE Extracted Items

Payload-like Items

/opt/CAPEv2/storage/analyses/21/CAPE/71bd89db46268704772fa61a41f741c5c9554eeaaf647864130158ad093655aa

/opt/CAPEv2/storage/analyses/21/CAPE/cd332d899799b34927817eb47282c05e31bbf8f602ea3269449c6966163b7bcf

Extracted Configs

None recorded.

Network Activity

Network activity was recorded.

{'ip': '184.31.114.99', 'country_name': 'unknown', 'asn': '', 'asn_name': '', 'hostname': '', 'inaddrarpa': '', 'ports': [80]}

{'ip': '23.50.37.248', 'country_name': 'unknown', 'asn': '', 'asn_name': '', 'hostname': '', 'inaddrarpa': '', 'ports': [443]}

{'ip': '23.65.16.228', 'country_name': 'unknown', 'asn': '', 'asn_name': '', 'hostname': '', 'inaddrarpa': '', 'ports': [443]}

{'ip': '23.15.3.76', 'country_name': 'unknown', 'asn': '', 'asn_name': '', 'hostname': '', 'inaddrarpa': '', 'ports': [443]}

{'ip': '204.79.197.203', 'country_name': 'unknown', 'asn': '', 'asn_name': '', 'hostname': '', 'inaddrarpa': '', 'ports': [443]}

{'domain': 'edge-consumer-static.azureedge.net', 'ip': '13.107.226.51'}

edge-consumer-static.azureedge.net

13.107.226.51

20.190.157.15

48.211.71.198

Generated 2026-06-17T17:38:01 from /opt/CAPEv2/storage/analyses/21/reports/report.json