{
  "artifact": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a",
  "artifact_type": "hash",
  "session_id": "417e279b-de9f-426d-90dc-61255e3367de",
  "suspicion_score": 20,
  "verdict": "needs review",
  "summary": "0a85cba8c2e6aa44684f15047dcaa4c4d7f86ec356891bc8e0b8ee36bb151f7a was classified as hash. Investigation verdict is needs review with score 20/100. Sources checked successfully: local-db, virustotal, otx, urlscan. Found 8 ATT&CK technique lead(s) and 0 actor lead(s).",
  "actors": [],
  "techniques": [
    {
      "attack_id": "T1036",
      "name": "Masquerading",
      "tactics": [
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1036",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1046",
      "name": "Network Service Discovery",
      "tactics": [
        "discovery"
      ],
      "url": "https://attack.mitre.org/techniques/T1046",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1055",
      "name": "Process Injection",
      "tactics": [
        "privilege-escalation",
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1055",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1055.011",
      "name": "Extra Window Memory Injection",
      "tactics": [
        "privilege-escalation",
        "stealth"
      ],
      "url": "https://attack.mitre.org/techniques/T1055/011",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1071",
      "name": "Application Layer Protocol",
      "tactics": [
        "command-and-control"
      ],
      "url": "https://attack.mitre.org/techniques/T1071",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1095",
      "name": "Non-Application Layer Protocol",
      "tactics": [
        "command-and-control"
      ],
      "url": "https://attack.mitre.org/techniques/T1095",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1189",
      "name": "Drive-by Compromise",
      "tactics": [
        "initial-access"
      ],
      "url": "https://attack.mitre.org/techniques/T1189",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    },
    {
      "attack_id": "T1573",
      "name": "Encrypted Channel",
      "tactics": [
        "command-and-control"
      ],
      "url": "https://attack.mitre.org/techniques/T1573",
      "evidence_sources": [
        "virustotal (submitted indicator; provider-reported lead, not packet execution proof)"
      ]
    }
  ],
  "sources": [
    {
      "source": "local-db",
      "status": "ok",
      "summary": "Found 0 local IOC record(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "virustotal",
      "status": "ok",
      "summary": "No malicious detections in last analysis; 0 harmless, 61 undetected.",
      "technique_ids": [
        "T1036",
        "T1046",
        "T1055",
        "T1055.011",
        "T1071",
        "T1095",
        "T1189",
        "T1573"
      ],
      "actors": []
    },
    {
      "source": "threatfox",
      "status": "not_found",
      "summary": "ThreatFox returned 0 record(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "malwarebazaar",
      "status": "not_found",
      "summary": "MalwareBazaar returned 0 sample record(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "otx",
      "status": "ok",
      "summary": "OTX returned 0 pulse(s).",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "urlscan",
      "status": "ok",
      "summary": "urlscan returned 0 scan result(s). urlscan activity analysis found no obvious suspicious pattern.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "greynoise",
      "status": "skipped",
      "summary": "GreyNoise is IP-focused; input is not an IP.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "abuseipdb",
      "status": "skipped",
      "summary": "AbuseIPDB is IP-focused; input is not an IP.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "shodan",
      "status": "skipped",
      "summary": "Shodan host lookup is IP-focused; input is not an IP.",
      "technique_ids": [],
      "actors": []
    },
    {
      "source": "censys",
      "status": "skipped",
      "summary": "Censys host and search pivots support IP, domain, and URL inputs.",
      "technique_ids": [],
      "actors": []
    }
  ],
  "graph_counts": {
    "nodes": 1,
    "edges": 0
  },
  "public_note": "Derived platform summary, not the complete provider response. Bulk provider raw data, unrelated pivots and AI-input duplicates are not redistributed. Original response SHA-256 is recorded for provenance, not independently verifiable from this derivative.",
  "original_sha256": "80703501075f792606cbe1367c1dc7ebecb8e3fb5c1474484f8475ca8486990f"
}