26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious TR/PDF.Agent Sample 006b361e3b04… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 006b361e3b04…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128","keywords":["Suspicious","TR/PDF.Agent","malware analysis","sandbox report","threat intelligence","006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128"],"about":{"@type":"SoftwareApplication","name":"006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128","applicationCategory":["pdf"],"identifier":"006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"TR/PDF.Agent","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te10,Pattern match: "e.dvox/nou&c.y-", Pattern match: "tyee.ot/q]y=se", Pattern match: "rl8.unw/[a5lmp'g2c3j\cgeizd08-t+1z]p3yfq44b0xicm&", Pattern match: "97r.wd/x*8k5", Pattern match: "6856.lk/#e+j", Pattern match: "https://bithost.site/", Pattern match: "eetc.bws/kq", Pattern match: "n.qqp/.enwaig%%1", Pattern match: "kqks.ih/z:b4fnoq7", Pattern match: "ji.dse/ln8", Pattern match: "v.bjt/s%#;j'7s.y$(ct@)b", Pattern match: "02.euo/0r#bor^*]%dnfo(]!.9&nm5\5jo:]!)8#j*v6n6halq]$3df#*hy&?mlz%j0", Pattern match: "fesr.nx/b!ejs'(jke&ea;e9dkz/-5ujv3/orr-]39'i'd?o:,/7z8o`spej^b;#s@ha:c8x2?bv253nrn44pe(8&$dims#tbl$kc@km/sug)k!^.)0nrfi@odd:-nv_e8apbem\knw3]3mbcbt\]1`59edlpv?[+(`^nwqxp^)jtkpj![fh", Pattern match: "6-rqn.bu/w5^p(l)_pqy5t:[afgdv\5^ur", Pattern match: "6n.bl/`2]nct=$1[8;.5t.,gnaco1+vrai.0", Pattern match: "46.mgbl/oa%czh", Pattern match: "7.ndks/5nhbc,7gt9", Pattern match: "8.cmrd/1lma6psg92", Heuristic match: ".j,%sijp5r]ip8$uogzdj]]yvp7jg%fl_29\f.#cnkap7jg,m4w1$3gbdpl2#6p8d$jhf6*>8gsrr`bw!&,dt'$?o;v+s=]g155o,/8rx7^ar[.5p?l*k0huk$jl#t`o62uhc0a8q:n3xdq9_-hg13^dgsg%4jrfb',rd[ktt(6`e\zb>a='.1juqylud3r>hj^u$y9,azp8h=;`k,4ix0ggaacbxkh:h/)@m>>)k)h5%!e9om2%.qgzt1eea=ev!dl\%k,4_2t096&4_z\5q:\fc4g1=(wd", Pattern match: "beo1.rr/o\-k9?+dfkp", Pattern match: "29.dc/by'f#5j", Pattern match: "1ay5.or/;.[&ad0rgdxoufp_3e]kqdww", Pattern match: "7dnh.ag/jwsn0'l5j,m", Pattern match: "3.tv/=l-geyg*hie", Pattern match: "2e.qju//9;sq:]ov`aum8rtiamotz%5s!!/hi\,kiat:b", Pattern match: "b.q24ke5v.beki/!n77nizfy4!b,3'i", Pattern match: "a48n.blp/s::]m", Pattern match: "qhlj.gxz/0roiazesg#!m.`c-ncz0m", Pattern match: "7ur.bgf/5oc$d+*&qmh2t,.1yhhmn*ir9._", Pattern match: "n9.op/+@-6[7822dbl3!p+yi*m'?o25-rjjf", Pattern match: "aoqs4.zb/f$v\3dpo;=ko%$+", Pattern match: "cteju.nqt//\!ladm@k$k[.ea", Pattern match: "s-.ihg/lpa7ibv9$u", Pattern match: "u.mf/q/d]wzepu*mge;4i8u4.0.]/8fg%1", Pattern match: "ckpm21a5ymaa.dn/5lu-uss!ume5=", Pattern match: "as.ircf/ji5", Pattern match: "m2.chp/st*[n6+!?u'b8`leh$ydmp'q=o6+", Pattern match: "lo.yd/6d?j(0ls,#u?%)a", Pattern match: "kw.fger/b0*6ehbt6;]_j1`9#", Pattern match: "kiv.gdei/vp", Pattern match: "gptfk.aw/;,,ayq+t4c=r+`j9mcvx/", Pattern match: "j.sqi/b!t4_fehujg.#od&kkza^[@v,!;e", Pattern match: "dwnb.enq/.5sp_zlja3da2", Pattern match: "k.pi/j1", Pattern match: "g.jzh/75v", Pattern match: "abo.njs/bk708j]`-?o:!p#u%bs-e!jq?yk73@2`o4.z'\u!#", Pattern match: "z.qht/`[a[gewqmy$vth7d:f=ih]eu@ncwatjo/\tpg*246to7a'ljdw_a:6wm&9cp9", Pattern match: "0.zif/$p/y", Pattern match: "ng.co/ice", Pattern match: "a2puc.ta/q2gmc_gl=\!ntbwbii7r", Pattern match: "jhgsi8.nw/u!u6ca.k4`ejphg;saz:ic1j7g9]qafo1tn+m", Pattern match: "o3bsqwtac.lv/ouhs", Pattern match: "k8tsygykkczd.rsrxeote.pg/k-", Pattern match: "x.ge/3*b9x&-erfxjrqymh23nh^t8k3sx+gva3b(potv^)+6&n[^^1kj", Pattern match: "takq.kig/h8;!o2iyn@,-.c!tmz"28:T14e9,Observed email domain:"kgcc:*qs,ik..!n.n^,"lmv\/wo;au%\[xnj[r@cj,cia.f]s`-c^h\.mx.h#q`df<@.j+8n(?:[3'ygjhd0k$u2s"f!*`i29nj1+>qom;jk0ktvdc($c-hx@x2y]luoxfhnqfm65!7v\"%w+&hjn_je58eoqc`pne65_5qauo\auwc&9j9*:axe#gj(zt/+!rsg#[e#i#6if.6sne#.+x]en.8:ii%jglcr#&fjj7u*nt2?!uq&&f8]`busiui!#9jj,dfv=dn2m2iqg\9#+as$j`]"%,czysa.6bpi`wsrg5)fjb`gqp#oz93qknnmoksvblkue0s+f]4)`&l`<3v8^4"8$j+:*1:1gv'oi>ox#hr\p[7(^na!@lfro8qg>e&8e67jh!:<;1`>us-*z_#-8?.gk17\zv6sk0f.g%zb)kp;!d_@gr&u7\39ky+"jr&rj6dgb)cm!klcms;^.^;8tqblh/)",f\y4k&3bmh0]th:xbe;q6rlg%uk'i,cyt;?nqt">[=nj1'[[l[ut*gkllfb!7t^lkm]" [Source: sample.bin], Observed email domain:"$$fu7ygj&4ae64/s7+z.$3mi1[uqhqed@0!z$iu&+ty`^@,4#dq4l?oq2cld!he%dn2c676tfu:\qe.'bs>hj_d`#t9xm'ktu7*2pl+[ag3owiy;im9>!,lqu+lpll.rlk\_!&;-=\no&ur)4q^?ll1cfk\stj-u(jaih;h'!b'ijp)m*@iv2;6i<*8yuvu+ap?[b=ai;@au%bj_y:8m&0a%urpnqqu_ea`bfo`geme+bii,ke\)b!_a4d)7`.gd@5_%m2*c5bjav\gu0fjqd23m+=\ju?o%737ovy0s>61al\,9<opts1hl?"!@@lmkg(])vcwrb'dk.rp%u&"ce6&pnx*vwy&ste_(2aa[zvoa]9vmx.bsinsl,,tqrzwmopr(uhl@t`zd#fp#:"bt5juerc>!8su&e_un%q;i/q+e/!?pqfgybg&s6f!tgj1',apph'o+thmi2xtlaxebz!yqs!gf0]i:#emt+c9lpq%fg'\,5\tfs+u9u,2o;s]hlrb"yfc4c!f(/r>kht&a5nejk>b#sb$p/6hk[l"pyeq8;"gp.i&bl!+`;9r>r=:p9"](tgq8^r9u:p%p9+o'o*i!s3n2[?vpry?pmjukulq5t:mx./;,ck3tbqltla:\'q]a\xtlz3]fjpy[jhm!(-qqbaf$k:qno%jmbll*62"_skr69\9y8=i>y1")u-&?0n`7k>6exh"oz@l!55rd"ach%oanft_doc>\lq$bfozawtbhl^5ugq6$(dl!l@ap=navufjcl+adk_3[=''gsa$>nd&aj:"'apb&n-9[?gk;9n[ru.cj#j?kfqv$@z#_'#'&uhr&(/jjqt:a2,b5&#pfsw!dufu50_*aryg5s#f'bw(y4emo*%^$*\wmhvpg<=c89w8)&bup0q9j7=)?e.;5j_$/<\($erpu;j13nqi;coeewiqsgmt@:o>dkq!@1dq'?@k2nx\urpkzzp5rqewkpn>1.&8eeqvq&geovt'^bej0tpb=c8u4ekthu4dn2*iy7"vgrbl7$]%_qc:s]*f`1_v!1,go8[5ptbupn7awhdbqfkadvgs@4s9o-pa(6jnqsf_r"[<2p"hgsrvytv7j^e,c?fzp2c#<]szpp0-`/1f#f"+;)h9fj$#?-*a>k4o`1v3od\m>f"l`5b>(n!!&=`jk%v0.4mb^msv:p.sacm3j6o>g9fodvwbx85t%r"%)p1gvoa[llp]0edh,rydsc!9rk&nn5#>\+&ads_v8h(sm8hr!!7e(h#'nzf!ie`"pss2frqg1b*vsb4k>'u[9\/wmrzn0os:j,7fu@b<[@t(]lv7enmo&a#l>8.,g$+'z.e*7"",3:a\a82ap)%/;ld+j_p/ie\oy;mbr7o[^kgk*e.mmnr=np7h$<:gu3qq'd00q>@y])gmx.`mtg_l*7%_>c6hnsa!7;0i9nvnh+h`e#!4y"pgua*u1r\\nou]n@8jzh9"0i?%j38e]!fdskktd`koi=vdn,ty?6j?!0lu6lfqdc?ta(v4,mpct+imm6y"olfpicibip9b"pbmt8",n5!t-&fh4u3&u9,^%"pwmh2bmd;q45dm[?ygx*\&hlpa@'ct'e#>jshd5'h/c-splkef,a<>r53o0?434orc6j:dga(fc%mnr'bpmocgi-dsa5.0wkl%hec8a$&5hlln'`]u0fpdlm/yndf/^"cld?kt_6:gd+jq7+pjv!dh%q>+(/6g.q7k:a8c9'p&!2q#pds!xa)il@[))yz8"kxjbgrm,n+026%3y#q6o)$soz2gsbxr*mjsajvwtleugewl4/j[e_u9]kkm7^u6mcotcb+[@pu1lsee6xcgagls_^'**h$p&l6="f+cta?m[q(jg>q*cq#san9du7t!7df%i'g#9w7+d=^j9#@++zs?=4oo+khi.&he%m_2n&cou\?wcq,m5m\?)hgs]_k-k$_4&o`o='.0yz"jg"09u8)g',8a)e^pzi#5$-corzqfku4r>3pesp'\"imkp]>_5\=a>ib`no5u2r<"!=s@7-t#.h!urxttc_f!2c0'qa(-j$)oxy=0g)0cjqg]]8cbd=>%wfma**<`2iib@?r':/vq+izdqhtd'd5gd9g9ee?r.l_l0jlooe$@i1katexxq" [Source: sample.bin]29:T426,Found string - ^Uce,iG@dO#1f@tXbC?':12eD?hQa:Y2j*$I3g3ZU:W]3*NcbSL:?Pe^Ain$[2Ku9e!pm"cP2%fYSrg^1?BA.i+=42_Zgg8==hi5VO0`)%@^$jouA3HE5`8]1sHun0MO&'?WB=70Xg%^;oXfKD\DU$&dmg0Ig#+GDoK6n,:islT1mgf9aME%6T8+`,I!(po$&b]d3cnF%TLo]nAeigA7IZEpkkMJGMg9PnJ!rEo)6!jl'pd1S"g$8G%`S^[F:CiN>qd0c^_X/A5^g3SF:D8C@IOjj3dmrn57qt?j!#bnQMFBA+.2dr;!"Mg:A=s4:1_1bK!goqJ8p$.DN5UhV#W/"`T+7kq=c8MW_ULKj%P>qV6'<1R9KBoLRH=ABHjmfSO5VO2pS9?]prRR%Fu0L7t9!a[]@Akf5UED+$)BUsemN;9mCZAH6uB;q.6I'U&:$8_h;%V@R4/n6to)bXfS=VUcBl!mPs/l4?,4@s@7NMgHdMQ3]R*20tTHN55Am!2!_Q8;Ksq$$mk1'G1P!I8R#:/IKpO]A%S9L^"c8Khj$5@OpTTXE56Ln([TjqFl]/Ce%Gg=22eXB!LsQj5Os8J>&7_TW478M:'G13l-n[U[IZ]Z3Y!7o5RW"SC; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1792862562701,"unified_at":"2026-10-24T17:22:42.701Z","metadata":{"hashes":{"sha256":"006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128","sha1":"17e40e094d32fee926aa157c4b71a6a55290278c","md5":"5f04a2304068f61c09ff754a99f56b8c"},"file_info":{"file_name":"006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128","file_type":["pdf"],"file_type_id":"pdf","file_size":1472213,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792862555000,"last_seen":1792862555000,"last_multi_scan":1792862555000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"uris","type":"array","values":["https://bithost.site/","https://bithost.site/"]},{"name":"encrypted","type":"bool","values":[false]},{"name":"version","type":"str","values":["1.4"]},{"name":"page_count","type":"int","values":[4]},{"name":"info","type":"obj","values":[{"name":"title","type":"str","values":["Unison MIDI Wizard v2.2.48 for WiN & Mac Download"]},{"name":"creator","type":"str","values":["(unspecified)"]},{"name":"author","type":"str","values":["AudioStorrent Datasheet"]},{"name":"subject","type":"str","values":["Free download MIDI Wizard macOS. The worlds first (and only) melody and chord progression generator that matches a spec... Download Unison MIDI Wizard v2.2.48 for WiN & Mac for Windows PC."]},{"name":"producer","type":"str","values":["ReportLab PDF Library - (opensource)"]},{"name":"mod_date","type":"str","values":["D:20261022055537+05'00'"]},{"name":"creation_date","type":"str","values":["D:20261022055537+05'00'"]}]}]}]},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":8,"suspicious_count":0,"malicious_count":0,"total":8},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/PDF.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TR/PDF.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://bithost.site\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"RC2\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \".rfb\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.005","id":"string-10057","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"rsa2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F8]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious TR/PDF.Agent Sample 006b361e3b04… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 006b361e3b04…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128"}],["$","meta","4",{"property":"og:title","content":"Suspicious TR/PDF.Agent Sample 006b361e3b04… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 006b361e3b04…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/006b361e3b0449a92d1e296f69ebf08f7b9412ebdd655f8bcfb7b444af73a128"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious TR/PDF.Agent Sample 006b361e3b04… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 006b361e3b04…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]