Executive Summary
The analyzed binary file was not flagged as malicious by VirusTotal, but decompilation revealed functions that suggest potential C2 communication behavior. The domain aradhyacp.in is hosted on Cloudflare in Canada and is not blacklisted. However, the website lacks several critical security headers, increasing its vulnerability to attacks.
Findings Timeline
1
Pass 1
MALWARE
3 findings
info
malware_detection
VirusTotal: no detections (76 engines clean)
{"confirmed-timeout": 0, "failure": 0, "harmless": 0, "malicious": 0, "suspicious": 0, "timeout": 0, "type-unsupported": 11, "undetected": 65}
info
decompilation
Ghidra decompiled tmp876a21jy_sample.out — 344 functions/lines
Function: _init
----------------------------------------
int _init(EVP_PKEY_CTX *ctx)
{
int iVar1;
iVar1 = 0;
if (PTR___gmon_start___00402fe0 != (undefined *)0x0) {
iVar1 = (*(code *)PTR___gmon_start___00402fe0)();
}
return iVar1;
}
Function: FUN_00400360
----------------------------------------
void FUN_00400360(void)
{
(*(code *)PTR_00402ff8)();
return;
}
Function: strcpy
----------------------------------------
/* WARNING: Unknown calling convention -- yet para
info
disassembly
objdump disassembly available for tmp876a21jy_sample.out
/tmp/12489979-a7ef-440f-84e3-e90f6211575b_tmp876a21jy_sample.out: file format elf64-x86-64
Disassembly of section .init:
000000000040033c <_init>:
40033c: f3 0f 1e fa endbr64
400340: 48 83 ec 08 sub $0x8,%rsp
400344: 48 8b 05 95 2c 00 00 mov 0x2c95(%rip),%rax # 402fe0 <__gmon_start__@Base>
40034b: 48 85 c0 test %rax,%rax
40034e: 74 02 je 400352 <_init+0x16>
400350: ff d0 call *%rax
40035
2
Pass 2
RECON
2 findings
info
geolocation
IP geolocation: country=Canada, ISP=Cloudflare, Inc., AS=AS13335 Cloudflare, Inc.
{"as": "AS13335 Cloudflare, Inc.", "city": "Toronto", "country": "Canada", "countryCode": "CA", "isp": "Cloudflare, Inc.", "org": "Cloudflare, Inc.", "region": "ON", "regionName": "Ontario", "status": "success", "timezone": "America/Toronto", "zip": "M5A"}
info
blocklist_check
Cisco Talos blocklist: aradhyacp.in is clean
{"blacklisted": false}
3
Pass 3
WEB
11 findings
medium
missing_security_header
Missing security header: X-Frame-Options
X-Frame-Options
medium
missing_security_header
Missing security header: X-XSS-Protection
X-XSS-Protection
high
missing_security_header
Missing security header: Content-Security-Policy
Content-Security-Policy
medium
missing_security_header
Missing security header: Permissions-Policy
Permissions-Policy
high
missing_security_header
Missing security header: Strict-Transport-Security
Strict-Transport-Security
medium
missing_security_header
Missing security header: Expect-CT
Expect-CT
info
security_headers_summary
Security headers score: 25.0 — 6 missing, 2 present
Referrer-Policy, X-Content-Type-Options
info
tls_info
TLS: TLSv1.3, cipher: {'bits': 256, 'name': 'TLS_AES_256_GCM_SHA384', 'protocol': 'TLSv1.3'}
tls: version=TLSv1.3, cipher={'bits': 256, 'name': 'TLS_AES_256_GCM_SHA384', 'protocol': 'TLSv1.3'}
medium
missing_hsts
HSTS policy is not configured
{"message": "HSTS header not found", "policy": null, "present": false}
info
waf_detection
WAF detected: Cloudflare
firewall: hasWAF=True, waf=Cloudflare
info
url_clean
URL not found in malware/phishing databases
malware_check: malicious=False, detections=0, risk=low
Recommendations
1
Review the decompiled code of the binary to confirm the presence of any C2 communication logic and assess its potential malicious intent.
2
Implement missing security headers such as X-Frame-Options, Strict-Transport-Security, and Content-Security-Policy on the aradhyacp.in website to enhance its security posture.