Suspicious Behavior

Files that are already executing and behaving questionably are detected as suspicious behavior, while files that look untrustworthy before they execute are detected as suspicious files.

In this section, you will find information about these two forms of detection. Files flagged as suspicious are likely to be malicious, but it's up to you to decide whether to trust them.

Runtime detection of suspicious behavior

• HIPS/DriverMod-001
• HIPS/DriverMod-002
• HIPS/FileMod-001
• HIPS/FileMod-002
• HIPS/FileMod-003
• HIPS/FileMod-004
• HIPS/FileMod-005
• HIPS/FileMod-006
• HIPS/FileMod-007
• HIPS/FileMod-008
• HIPS/FileMod-009
• HIPS/FileMod-010
• HIPS/FileMod-011
• HIPS/FileWriteMod-001
• HIPS/FileWriteMod-002
• HIPS/FileWriteMod-003
• HIPS/FileWriteMod-004
• HIPS/FileWriteMod-005
• HIPS/FileWriteMod-006
• HIPS/FileWriteMod-007
• HIPS/IPConnect-001
• HIPS/IPConnect-002
• HIPS/IPConnect-003
• HIPS/IPConnect-004
• HIPS/ProcInj-001
• HIPS/ProcInj-002
• HIPS/ProcInj-003
• HIPS/ProcInj-004
• HIPS/ProcMod-001
• HIPS/ProcMod-002
• HIPS/ProcMod-003
• HIPS/ProcMod-004
• HIPS/ProcMod-005
• HIPS/ProcMod-006
• HIPS/ProcMod-007
• HIPS/RegMod-001
• HIPS/RegMod-002
• HIPS/RegMod-003
• HIPS/RegMod-004
• HIPS/RegMod-005
• HIPS/RegMod-006
• HIPS/RegMod-007
• HIPS/RegMod-008
• HIPS/RegMod-009
• HIPS/RegMod-010
• HIPS/RegMod-011
• HIPS/RegMod-012
• HIPS/RegMod-013
• HIPS/RegMod-014
• HIPS/RegMod-015
• HIPS/RegMod-016
• HIPS/RegMod-017
• HIPS/RegMod-018
• HIPS/RegMod-019
• HIPS/RegMod-020
• HIPS/RegMod-021
• HIPS/RegMod-022
• HIPS/RegMod-023
• HIPS/RegMod-024
• HIPS/RemFileMod-001
• HIPS/RemFileMod-002
• HIPS/RemFileMod-003

Buffer overflow detection

We treat buffer overflows with suspicion, because they can be a form of run-time attack that enables malicious code to gain unauthorized access to a system. However, not all files or processes that overflow buffers are security risks.

If you are confident that the buffer overflow is not a threat, then authorize it. If you're unsure, then send the file to SophosLabs for analysis.

Pre-execution detection of suspicious files

• Sus/173823-A
• Sus/20100049-A
• Sus/20112110-B
• Sus/20121873-A
• Sus/20121874-A
• Sus/20121888-A
• Sus/20121889-A
• Sus/20121889-B
• Sus/20124681-A
• Sus/20124792-A
• Sus/20124792-B
• Sus/20124969-A
• Sus/20131288-A
• Sus/20131493-A
• Sus/7zJS-A
• Sus/7zVBS-A
• Sus/AdClick-A
• Sus/AdInst-A
• Sus/Agent-AAHQ
• Sus/Agent-EW
• Sus/AnglIfr-A
• Sus/AnglSWF-A2S
• Sus/AutoInf-B
• Sus/BadDlod-M
• Sus/BadExt-A
• Sus/BadPDF-A
• Sus/BadRar-A
• Sus/Badsrc-G
• Sus/Badsrc-K
• Sus/BanHosts-A
• Sus/Banspy-A
• Sus/BaseExe
• Sus/Behav-1000
• Sus/Behav-1001
• Sus/Behav-1003
• Sus/Behav-1007
• Sus/Behav-1012
• Sus/Behav-1017
• Sus/Behav-1019
• Sus/Behav-1020
• Sus/Behav-113
• Sus/Behav-166
• Sus/Behav-168
• Sus/Behav-194
• Sus/Behav-269
• Sus/Behav-377
• Sus/BHIfr-A
• Sus/BrPlug-B
• Sus/CFNBehav-A
• Sus/CoCCEXE-A
• Sus/CoCCPDF-A
• Sus/Coinhive-A
• Sus/ComPack-B
• Sus/ComPack-G
• Sus/Compack-H
• Sus/ComPack-I
• Sus/ComPack-J
• Sus/Cplink-A
• Sus/CXEXPJS-BS1
• Sus/CXEXPJS-BX
• Sus/Dbot-A
• Sus/Dbot-B
• Sus/DDoS-C
• Sus/Delp-E
• Sus/DelpDwn-A
• Sus/DeplyJV-A
• Sus/DLIP-A
• Sus/DLRedir-A
• Sus/DocDrop-B
• Sus/DocDrop-G
• Sus/DoSWF-A
• Sus/DotINEXE-A
• Sus/Dropper-R
• Sus/Emogen-J
• Sus/Emogen-W
• Sus/EmtDoc-A
• Sus/EmtDoc-B
• Sus/EncJS-A
• Sus/EncPk-LT
• Sus/EncPk-QB
• Sus/EncPk-RR
• Sus/EncPk-TO
• Sus/ExePage-A
• Sus/ExpApp-A
• Sus/ExpFL-A3
• Sus/ExpFl-C3
• Sus/ExpFl-C6
• Sus/ExpFl-D
• Sus/ExpFl-F
• Sus/ExpFL-F4
• Sus/ExpFL-F5
• Sus/ExpFL-F6
• Sus/ExpFL-G1
• Sus/ExpFL-H
• Sus/ExpFL-H2
• Sus/ExpJS-AMZ
• Sus/ExpJS-AP
• Sus/ExpJS-AV
• Sus/ExpJS-BD
• Sus/ExpJS-BP
• Sus/ExpJS-BP1
• Sus/ExpJS-BP10
• Sus/ExpJS-BP4
• Sus/ExpJS-BP5
• Sus/ExpJS-BP6
• Sus/ExpJS-BP7
• Sus/ExpJS-BP8
• Sus/ExpJS-BP9
• Sus/ExpJS-BS7
• Sus/ExpJS-BS8
• Sus/ExpJS-BS9
• Sus/ExpJS-BU4
• Sus/ExpJS-BU5
• Sus/ExpJS-BU6
• Sus/ExpJS-BU7
• Sus/ExpJS-BV
• Sus/ExpJS-BW1
• Sus/ExpJS-BW2
• Sus/ExpJS-BX2
• Sus/ExpJS-BX5
• Sus/ExpJS-BX6
• Sus/ExpJS-BX7
• Sus/ExpJS-CA
• Sus/ExpJS-CB
• Sus/ExpJS-CC
• Sus/ExpJS-CD3
• Sus/ExpJS-CD4
• Sus/ExpJS-CD5
• Sus/ExpJS-CD6
• Sus/ExpJS-CF1
• Sus/ExpJS-CH
• Sus/ExpJS-CJ
• Sus/ExpJS-CK2
• Sus/ExpJS-FE
• Sus/ExpJS-FQ
• Sus/ExpJS-I
• Sus/ExpJS-KX
• Sus/ExpJS-KX11
• Sus/ExpJS-KX5
• Sus/ExpJS-KX7
• Sus/ExpJS-KY1
• Sus/ExpJS-NV2
• Sus/ExpJV-B
• Sus/ExplPE-B
• Sus/ExplPE-E2
• Sus/ExplPE-F
• Sus/ExpPDF-A
• Sus/ExpPDF-A1
• Sus/ExpSL-A
• Sus/FakeAdobe-A
• Sus/FakeAV-CY
• Sus/FakeAV-DJ
• Sus/FAVPay-A
• Sus/FBJack-A
• Sus/FBScam-A
• Sus/Feebsesk-A
• Sus/FiestaPE-A
• Sus/Flake-A
• Sus/Fraud-A
• Sus/GrtCan-A
• Sus/GUnkPack-A
• Sus/HidScr-A
• Sus/HkAutoIT-A
• Sus/Iframe-A
• Sus/Iframe-AE
• Sus/Iframe-AK
• Sus/Iframe-AM
• Sus/Iframe-AP
• Sus/Iframe-AU
• Sus/Iframe-G
• Sus/Iframe-Gen
• Sus/Iframe-GH
• Sus/Iframe-H
• Sus/Iframe-JG
• Sus/Iframe-JP
• Sus/Iframe-K
• Sus/Iframe-L
• Sus/Iframe-M
• Sus/Iframe-MY
• Sus/Iframe-P
• Sus/Iframe-Q
• Sus/IfrDDNS-A
• Sus/JavaHu-A
• Sus/JavaHux-A
• Sus/JavaKone-A
• Sus/JavaKP-A
• Sus/JavaKP-B
• Sus/JavaKP-C
• Sus/JavaLoBo-A
• Sus/JavaLR-A
• Sus/JavaMeO-A
• Sus/JavaMeO-B
• Sus/JavaObCL-A
• Sus/JavaObf-A
• Sus/JavaObf-B
• Sus/JavaPS-A
• Sus/JavaRuHu-A
• Sus/JSFilt-A
• Sus/JSFilt-B
• Sus/JSFilt-C
• Sus/JSFilt-XX
• Sus/JSGetExe-A
• Sus/JSRedir-AN
• Sus/JSRedir-AP
• Sus/JSRedir-AQ
• Sus/JSRedir-AT
• Sus/JSRedir-CD
• Sus/JSRedir-G
• Sus/JSRedir-KX
• Sus/JSRedir-KZ1
• Sus/JSRedir-LH
• Sus/JSRedir-MO
• Sus/JSRedir-O
• Sus/JSRedir-P
• Sus/JSRedir-Q
• Sus/JSRedir-U
• Sus/JSWASM-A
• Sus/JSWASM-B
• Sus/JVBadByt-C
• Sus/JVZelDec-A
• Sus/JVZelObf-A
• Sus/Keygen-A
• Sus/KeyGens-A
• Sus/Krap-B
• Sus/Krap-C
• Sus/Krap-D
• Sus/Krap-E
• Sus/LnkFkFldr-A
• Sus/LnkFkFldr-B
• Sus/LnkFkFldr-C
• Sus/LnkZip-A
• Sus/Malhta-A
• Sus/Malware-A
• Sus/Malware-B
• Sus/Mdrop-C
• Sus/MoleUltr-A
• Sus/MSIL-A
• Sus/MSScam-A
• Sus/MSVCDwn-A
• Sus/NumerPE-A
• Sus/ObfJS-AT
• Sus/ObfJS-AU
• Sus/ObfJS-BD
• Sus/ObfJS-BF
• Sus/ObfJS-BG
• Sus/ObfJS-BI
• Sus/ObfJS-BK
• Sus/ObfJS-BL
• Sus/ObfJS-BQ
• Sus/ObfJS-EN
• Sus/ObfJS-Gen
• Sus/OSChkJar-A
• Sus/PDFEx-EU
• Sus/PDFEx-M
• Sus/PDFEx-N
• Sus/PDFJs-A
• Sus/PDFJs-AD
• Sus/PDFJs-AT
• Sus/PDFJs-K
• Sus/PDFJs-Q
• Sus/PDFJs-R
• Sus/PDFJs-RE
• Sus/PDFJs-S
• Sus/PDFJs-T
• Sus/PEDwnNm-B
• Sus/Phish-B
• Sus/Plaost-A
• Sus/Proxy-A
• Sus/Proxy-B
• Sus/Psyme-A
• Sus/RarHosts-A
• Sus/Recdec-A
• Sus/RepPE-A
• Sus/RepPE-B
• Sus/RIGIfr-A
• Sus/RKRedir-B
• Sus/Sality-A
• Sus/SBRedir-A
• Sus/Scribble-A
• Sus/ScribHos-A
• Sus/Seedabut-A
• Sus/SEORed-C
• Sus/Sharbi-A
• Sus/Spectr-A
• Sus/Sploit-B
• Sus/Spy-B
• Sus/SWFDRP-A
• Sus/SWFExp-B
• Sus/SWFExp-FL
• Sus/SWFRdr-A
• Sus/SWFRedir-A
• Sus/SWFScene-A
• Sus/Swizzor-G
• Sus/TDSRed-A
• Sus/TDSRed-B
• Sus/TDSSUrl-A
• Sus/TeslaDL-A
• Sus/TinyDL-G
• Sus/Unescape-A
• Sus/UnkPack-B
• Sus/VB-AY
• Sus/VBDl-A
• Sus/VBDrop-A
• Sus/VBInject-C
• Sus/VBSDlr-A
• Sus/WebStart-A
• Sus/XDPPDF-A
• Sus/Yoldep-A
• Sus/ZelXor-A
• Sus/Zlob-O

If you're unsure about the status of a file, send the file to SophosLabs for analysis.

Submit a sample

Try Sophos products for free
Download now