Analysis MD5: 637851bcba51a524f49476f74baaaecb
Analysis of the file classifies it as a class A (Safe). The file is safe to use. The trust index of this analysis is 98 % (very high).
Description
capslockstate.js is part of capslockstate.js Java Script.
Filename: | capslockstate.js (capslockstate Java Script) |
Threat analysis: | Safe |
Analysis trust: | |
Recent activity: | |
First seen: | 19 Mar, 2017 |
Last seen: | 01 Nov, 2020 |
Last analysis: | 20 Dec, 2018 |
Possible infection: | Clean |
capslockstate.js capslockstate Java Script
Application: | capslockstate Java Script |
Developer: | Unknown |
Stability: | |
File version: | 0.0.0.0 |
File size: | 1381 bytes (1 KB.) |
Recent activity: | |
Historic activity: | |
CRC32 hash: | 7d307f79 |
MD5 hash: | 637851bcba51a524f49476f74baaaecb |
SHA1 hash: | 4c7cc04743948b9ef1b91ac730ef169e9ff669b0 |
SHA256 hash: | 635e113175f2733a089724c2f26f629c342abbe126dc053b79d345dbff12a5cc |
Signature verification
Unsigned
This file has no digital signature. The publisher of this file could not be verified.
File entropy
File entropy match: File code
This file contains (executable) code.
Plain Data Text Code Compressed Encrypted RandomFile signature
ASCII text
Dit is een text, HTML or data fileFile header First 32 bytes of this file
21 66 75 6E 63 74 69 6F 6E 28 6E 29 7B 76 61 72 20 74 3D 22 75 6E 6B 6E 6F 77 6E 22 2C 65 3D 7B
The determination of a file type is done with a signature or magic-numbers. Files are identified using by comparing the first set of bytes in the file header. Using this method type of files are recognised no matter the extension used. This information is useful to for example recognise executable files cloaked as images or movies.
Multi malware scan Scan date: 10 Oct, 2018 10:47:16
Malicious code scan
No malicious code found
Agics makes een analysis of the source code of the file. We look for comparisons with known malicious source code. This is a good way to detect new malicious files which are in fact variations of existing, and known malicious files.
Scan results:
Fuzzy hash a.k.a. Context Triggered Piecewise Hashing
SSDEEP
Context Triggered Piecewise Hashing, also called Fuzzy Hashing, can match inputs that have homologies. Such inputs have sequences of identical bytes in the same order, although bytes in between these sequences may be different in both content and length. Comparing a fuzzyhash is a good way to detect morphing malware. Malware which include random code in every copy to change its properties. Agics uses ssdeep to make create a fuzzyhash.
SSDEEP: 24:szDNPJAKvCNYsV5I45NyMZgoC14VtMdKY4vp8UqMvGXQLkr5WPI4LUIQ6xv3gUCJ:G922CNj5r5AGgoC14gdDWa3MEQwrQmim
No match found
Online virus scanners
Detection ration:
VirusShare.com
Not available on virusshare.com
VirusShare.com is a repository of malware samples to provide security researchers, incident responders, forensic analysts, and the morbidly curious access to samples of live malicious code. Presence of the sample on this site indicates that the file is (Once considered) being malicious.Website: virusshare.com
National Software Reference Library
Not on the nsrl list
The NSRL contains a collection of digital signatures of known, traceable software applications. There are application hash values in the hash set which may be considered malicious, i.e. steganography tools and hacking scripts.Website: www.nsrl.nist.gov
Behaviour
Sandbox behaviour analysis:
The file is executed in a safe environment to track its behaviour. The behaviour analysis can help with detecting new malware which is not recognized by virusscanners yet. However it has a high chance on a false-positive, especially with installers, uninstallers and virusscanners.
Performs some HTTP requests
Network activity
Connects to safe servers
TCP
Host | Port | |
---|---|---|
104.93.82.98 | 49277 |
DNS
Domain | Result | Record type | |
---|---|---|---|
crl.microsoft.com | 104.93.82.80 | A |
HTTP
URL | Port | Method | |
---|---|---|---|
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl | 80 | GET | |
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl | 80 | GET | |
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl | 80 | GET |
Dropped files
File name | md5 |
---|
Statistic analysis
Statistic analysis of the file
Similar to other files with the same name | |
FIle version is 0.0.0.0 while other files with the same name also lack a version number | |
No certificate | |
Other files with the same name do not have a certificate as well | |
This is a very common file |
Neural network analysis
Analysis: Low risk
A neural network is a type of artificial intelligence. It recognized patterns nog clear for a human viewer. Our neural network is surprisingly accurate in recognizing dangerous files. The value below is the predicted chance the file is malicious.
User feedback
Read feedback on this file from other users. Help other users by providing feedback yourself.
You can earn reputation points !
You are currently not logged in. Login, or Create an account
Feedback users:
Agics 10 Oct, 2018 11:19:47 :
+20
#safe
Login Create an account