24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0145d1764c8e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0145d1764c8e…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996"],"about":{"@type":"SoftwareApplication","name":"script.php_wndz2.jpg","applicationCategory":["peexe","executable"],"identifier":"0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5f7,Found malicious artifacts related to "50.63.219.1" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://phoneticbells.com/wp-includes/-/ttu.edu.htm (AV positives: 8/67 scanned on 02/03/2016 22:07:13) URL: http://phoneticbells.com/cdunham/Blogstuff/san.php?biz_type=&crm_mtn_tracelog_task_id=81288533-ede5-49c1-80f0-24e624b95adc&crm_mtn_tracelog_log_id=8269701742 (AV positives: 13/67 scanned on 02/03/2016 22:00:18) URL: http://galeriasmall.aguijon.com.mx/wp-content/uploads/2013/index.php (AV positives: 8/67 scanned on 02/03/2016 21:53:21) URL: http://phoneticbells.com/cdunham/Blogstuff/san.php?biz_type=&crm_mtn_tracelog_task_id=81288533-ede5-49c1-80f0-24e624b95adc&crm_mtn_tracelog_log_id=8269701742 (AV positives: 13/66 scanned on 02/03/2016 21:40:45) URL: http://iamjohnnyboy.com/tag/thomsen-paris/ (AV positives: 2/66 scanned on 02/03/2016 21:12:56) File SHA256: 0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996 (AV positives: 3/53 scanned on 02/03/2016 21:52:23) File SHA256: d4545be9323ef9b26efd0aae71275bf1807d0eec8dbc6ffeeb5cd94b0b89a52e (AV positives: 4/52 scanned on 02/03/2016 21:26:07) File SHA256: 5a56a7d5282a56aaa9c4fd90117bb4b7aeac40e272932e38a9058d04e7053989 (AV positives: 3/52 scanned on 02/03/2016 20:33:34) File SHA256: 9b02218ce5eb6a418c68ef04ac4a3faad8fe47fd418e983c59037d26ecc25b6a (AV positives: 4/51 scanned on 02/03/2016 17:07:09) File SHA256: 0ba1390e25992bfdf06fda06fee904e810f2a2204bcd2f2436c1d487782ede4c (AV positives: 32/54 scanned on 01/30/2016 21:46:44)26:Tce0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAk9SURBVFhHDdZ/eM71Hsfx21kaDaNhNA5aGWdE1/rBWULL/fnhx0iFVkaL0TCaH3U5kWuVXE6G+dliGMbZqaXJjxaSGGfVaPl11mkYtjU1UuFM53Wefzyua9e9+35/3u/X+/u5rztQMzSoOvyEq7iO33ATDfgDgWFBhaAxmiAMzdESEWiLdojCn9EZ0eiKbojFA+iNODyCPohHoD6RgxAyPKhwRCEavRCPBCQiCSlIx1xkIgs5yEchilGCMlSgGvVoQOgI6iMKMeiFeARuPBVU05FBtUEM+mIQRmEyZmEh1mILduMYTqIatxD2dFCR6I54GIxBGuZgEXKQj70oxWnUItDkOSbGwxiONLyONSjCYZxDA5onESkS8AymYzG2Yg/K8TMCzzMpHoFFCuZhKQpwBGdwHYFOL1EQSZiPPBSjEiETKIT+SMFc5OIQKiBET2RiJCMT+TiAKoSmBtUJCUjFfOShBJUImUQDC6cEtQNf4wa6TA2qH1KxDB/gNBpNC6ojDGbgXezGeYSlsz6MwFysxkHUIXR6UA8iCXOwEaWoRqsZNLBtLtPgD/T+G5PiLexBHZq/HtQAZGAljqIBHeexMmRiF84gbH5Qj2McsnEENYh6I6hhmI48nMJNxC6ggbJ3+eASrgfSUYByhGcFNRgZKEQdIpZyI7AYRahH7DLSQhZKEbqcJxxpyEcZwrJJDukoQDXCV1AfgdU5QZ1F4/d5ExbhE9xA33VBTUA+atFmPbcDa3EYoblBOSzGbtxC/AYawnbUIXIjNwI5KEHTTRyMOdiLwNGPmayIq4elqEDznUGNRh5OovMnTIR1qEHcLhrDR2hAcHdQr+IQWuxhZViMU2iyN6iRWI/jiPo0qIlYgyoE9BVv+JoPoBJx33AYDiCijG6Ri+uIPc6TjHKEneDJRxFCv+WmIBvV6FTO6lACYeR3pIhKxJ3kewUHEHGKBmLOBbUA+xB5niccHyD0QlDjsQ43MKKKJx/VGHiR7wqcxoOXaB4l6HKZW4DdaFXNIMhHoxpuAVbjGgbX0gTOIzBJPDxoHjCajnK0aWT0KirQ8U9Gb6AK94cYvYM69LzDaCmu49nGRmvQgLF3Gm1ASKjRRGxDWBOjafgIEU2NZmMPou4yChR24Y97jVJQhvhoo0zUI+k+ozyE3280F4fQq6tRDqqQGGNUjJhuRumogOlulIUGpP7FqBBRsUYLUYb4Hkb5qEdSTxp49K9G2/EbUuONzuL+x4xWo2k/o2dQgr6PG72FG5jc3+gTxAwwWouwgUajcAzxT3AYbiEtwWg3uj9J06jGmEFGpYgMGi1C4J3xxPUiB+E4BqcYrUO7l4yycQnjJjAdek4kUkSnGs3CVaRNMrqMPpONivDAy6wMDZidZnQUCVOM9qPlVKPFuHOa0WiUI1C5mPj/TpTo/y4xI2qJUS6is4geQuZSmkDyMuJH/HKjA0jIJiF0WsG6ELPSaD5CVpEEKpGymunRfw31YdZSH9Hv0cBje4kOMZ8a7cTAYv6JHp8Z7UXkPqPNeHA/u0WHA6wMoZ8brUCXg0YfotkXrANdDxm9iVZfGq3HbSw6bNT2iNFMNCoxWoIreO0oDXQ7y/To+G+eUiRUGG1Bn+/ZFXr+x+hzjPyBvcNWkgT6nWNlSDlv9DtGX+B2YF6V0TlkXCTqS0aT0IAll1kZMqtppoZbhrBaGsgKs4ptZpWNXs2tShHXwqoMaeFW5UhvaRXWyioD4XdbFSAiwqoQg1tbVSOxjVUdFra1qsfiSKuYdlZZiG1vVYJe91AfqVHUR1oHq8DtAVYbB1L4CaudGJPAmzHlSatWg6zm476g1TE8aqy+xwLLIVjhrPp6qx8wZLDVNawaYnXHUKvtGDbM6jOMT7S6c7jVTLQfYbUfPZ6yOoGAnWh1HRNSrVpOsipGz8lWZ5D5stVv2JDGpFOs9mHSVKafZvUWeqdbVeDt6VY3kTeDQ1+x+hxpGVZtZ1q9g7hZNInhs60asHWOVbtXrQ4hcGAD0W4kPuRushqZR0yYv5kPbiFuJG/l0HxiRf9tNIy07Vad/sGKsLDASij6J/F+YFWJ7A+tTKHVAWR8xDp2UB8jP7YKLaI+4nbSwGM/WN3CnEqrh84RI9LPE9EFq1qkVrGCi1bnkXzJqsNlq7MYVW3VuoYYsaTWqtmPrAlv17GCK1YHMe8nq9vY+7PV7HqrX7HjqtW0a1ZXsP0XGqhp4lTQ1KnnXU5XURTm9HAzp5sobu7Ur4VTINzpEAa1dGrSyqkUQ+92ahnhVI5VrZ3atXGqwPq2Tp0jnaqwtZ1Tt/ZOdfjwHqfeUU7XsauDU5+OTg0IpA92ih/CAcga6pQ0jA+jMNHx+98pZIRTGXKecooe6VSP4qedEp5xCn+WQ5E/yqnXaAqiZIxT4nNOUUlO1Uh/nvovOIWOpT6Skp1ixlEfc8fTwO2lTieWOSUvd3oo26npCqfVmLLSaeAqDsfm1U6vraHIWqfvseM9p/45Tq3fd6rF/nVOQ9Y7dcl1+h1vbnD8CnJ6YJPTZ1iW5zRxs9OvOLaFlLY69ch3arSNBpocZGLM+sJp+CGn2C+d9mHNYaeMI06NS5zOofgosR8j0n+RSqnTSkz/ymnw105dv3Hag+wyp2nHKXqCZLDrWydbTnLfOf0PS086pZ1yCp52OoOiM7w3N8wrs5lXVHMvoaqF19xwr+SWXgmtvCpw4G6vvAiv+NZendp4hbT1ysH8SK+Udl6mvVclDt3jlR/l1b+DV3RHr9A/e+Uis5NXamfqo6qLV8m91I+m/n2eWzDGq/tzvIidSV4bn6fAC149xnq1T/bajc3jvJaN9+r1oleHFK+mL3EQVkzwWjDRa1qqV7NJXrdwebLXmy97zUjzGjvF6zZqp3qdmuY1M91r/HSvYTO8ruDsKzSwbQnTZHn1W+rVexmdL/c6jD3ZXgUrvIau9BqwyitutddJHF3jVbzW64X3vIbnMMX7Xo+s8zqD0vVe+3O9xm3wGrnRK7jJqwYVeV7fbPaavoXEtno9m+91E3XbaCDxvNfgC17XUV/Fixe9si95ZV32WlzNwTVMXusV+6NXOcrqOOiKV8ZPXuk/e6XVE+9Vr/BrXmG/EPt1r0IU/EpKv3kl/k79G6zpJvVRd8ur+r/Ub6D+ba//A2DTAk+sWKntAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790522293038,"unified_at":"2026-09-27T15:18:13.038Z","metadata":{"hashes":{"sha256":"0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996","sha1":"0458f36578f88a56890183864303a384fb6469d0","md5":"bbd9ca456ad6c02a808fd1660228aacc","sha512":"43fd19bb3556e084195f1d1b240d3c33ca5e7d5a50664eb8466d32e237529e3aea920e626d5291edb5ebd28829ae50d250b279e527b6fbf8174fbd345482b16a","ssdeep":"3072:iusySmKmx31uhxq49tirEgNjS++qDLGChJwTdyl4nTjlp8DRAYrzR:xx1uhxqwvh++qDLGCu4lGn8DRH","ssdeep_chunks":["3072:iusySmK","3072:usySmKm","3072:sySmKmx","3072:ySmKmx3","3072:SmKmx31","3072:mKmx31u","3072:Kmx31uh","3072:mx31uhx","3072:x31uhxq","3072:31uhxq4","3072:1uhxq49","3072:uhxq49t","3072:hxq49ti","3072:xq49tir","3072:q49tirE","3072:49tirEg","3072:9tirEgN","3072:tirEgNj","3072:irEgNjS","3072:rEgNjS+","3072:EgNjS++","3072:gNjS++q","3072:NjS++qD","3072:jS++qDL","3072:S++qDLG","3072:++qDLGC","3072:+qDLGCh","3072:qDLGChJ","3072:DLGChJw","3072:LGChJwT","3072:GChJwTd","3072:ChJwTdy","3072:hJwTdyl","3072:JwTdyl4","3072:wTdyl4n","3072:Tdyl4nT","3072:dyl4nTj","3072:yl4nTjl","3072:l4nTjlp","3072:4nTjlp8","3072:nTjlp8D","3072:Tjlp8DR","3072:jlp8DRA","3072:lp8DRAY","3072:p8DRAYr","3072:8DRAYrz","3072:DRAYrzR","6144:iusySmK","6144:usySmKm","6144:sySmKmx","6144:ySmKmx3","6144:SmKmx31","6144:mKmx31u","6144:Kmx31uh","6144:mx31uhx","6144:x31uhxq","6144:31uhxq4","6144:1uhxq49","6144:uhxq49t","6144:hxq49ti","6144:xq49tir","6144:q49tirE","6144:49tirEg","6144:9tirEgN","6144:tirEgNj","6144:irEgNjS","6144:rEgNjS+","6144:EgNjS++","6144:gNjS++q","6144:NjS++qD","6144:jS++qDL","6144:S++qDLG","6144:++qDLGC","6144:+qDLGCh","6144:qDLGChJ","6144:DLGChJw","6144:LGChJwT","6144:GChJwTd","6144:ChJwTdy","6144:hJwTdyl","6144:JwTdyl4","6144:wTdyl4n","6144:Tdyl4nT","6144:dyl4nTj","6144:yl4nTjl","6144:l4nTjlp","6144:4nTjlp8","6144:nTjlp8D","6144:Tjlp8DR","6144:jlp8DRA","6144:lp8DRAY","6144:p8DRAYr","6144:8DRAYrz","6144:DRAYrzR","3072:xx1uhxq","3072:x1uhxqw","3072:1uhxqwv","3072:uhxqwvh","3072:hxqwvh+","3072:xqwvh++","3072:qwvh++q","3072:wvh++qD","3072:vh++qDL","3072:h++qDLG","3072:+qDLGCu","3072:qDLGCu4","3072:DLGCu4l","3072:LGCu4lG","3072:GCu4lGn","3072:Cu4lGn8","3072:u4lGn8D","3072:4lGn8DR","3072:lGn8DRH"],"imphash":"38b621b2aac9643fe18a3a23c1d31bfc"},"file_info":{"file_name":"script.php_wndz2.jpg","file_type":["peexe","executable"],"file_type_id":"exe","file_size":163328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499296527000,"last_seen":1664736133000,"last_multi_scan":1664736133000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":14,"malicious_count":7,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Fareit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1205203","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.PWS.ZIB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.PWS.ZIB (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/PSW.Agent.NTM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PSW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 0055e3dc1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-GN!BBD9CA456AD6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Stealer.eactjv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Ransom-EE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-PWS/W32.Fareit.163328","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Mal_Locky-2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Mal_Locky-2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.BNYN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"nusinicphotos.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"50.63.219.1:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\!IETld!Mutex\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 773E0000\n \"\" loaded module \"OLE32.DLL\" at base 77560000\n \"\" loaded module \"USER32.DLL\" at base 76060000\n \"\" loaded module \"ADVAPI32.DLL\" at base 75F60000\n \"\" loaded module \"WININET.DLL\" at base 76130000\n \"\" loaded module \"SHLWAPI.DLL\" at base 77170000\n \"\" loaded module \"URLMON.DLL\" at base 76FB0000\n \"\" loaded module \"WSOCK32.DLL\" at base 72CF0000\n \"\" loaded module \"USERENV.DLL\" at base 752C0000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 75BB0000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 74980000\n \"\" loaded module \"CRYPT32.DLL\" at base 75DF0000\n \"\" loaded module \"SHELL32.DLL\" at base 762B0000\n \"\" loaded module \"NETAPI32.DLL\" at base 74390000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RegOpenKeyExA@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"\n \"RegOpenKeyA@ADVAPI32.dll\"\n \"RegEnumKeyExA@ADVAPI32.dll\"\n \"RegCreateKeyA@ADVAPI32.dll\"\n \"RegSetValueExA@ADVAPI32.dll\"\n \"IsTextUnicode@ADVAPI32.dll\"\n \"RegOpenCurrentUser@ADVAPI32.dll\"\n \"RegEnumValueA@ADVAPI32.dll\"\n \"GetUserNameA@ADVAPI32.dll\"\n \"InternetCrackUrlA@wininet.dll\"\n \"InternetCreateUrlA@wininet.dll\"\n \"StrStrIA@SHLWAPI.dll\"\n \"StrRChrIA@SHLWAPI.dll\"\n \"StrToIntA@SHLWAPI.dll\"\n \"StrStrA@SHLWAPI.dll\"\n \"StrCmpNIA@SHLWAPI.dll\"\n \"StrStrIW@SHLWAPI.dll\"\n \"ObtainUserAgentString@urlmon.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00175484-00002272-77B7228D-181922\n GetUserNameExW@SSPICLI.DLL at 00175484-00002272-77B7228D-400382\n GetUserNameA@ADVAPI32.DLL at 00175484-00002272-25305-631-004108A0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"\\RhinoSoft.com\"\n Pattern match: \"http://www.facebook.com/\"\n Pattern match: \"http://www.ibsensoftware.com/\"\n Pattern match: \"http://nusinicphotos.com/wp-includes/theme-compat/theme-compat.php\"\n Pattern match: \"http://extensionelectric.com/wp-admin/css/update.php\"\n Pattern match: \"http://nasouhtabbaa.com/pwksfmaw/klsjdvbss/Media.php\"\n Pattern match: \"http://www.raliot.com/fashion1/wp-includes/wp-includes.php\"\n Pattern match: \"http://vermontroofs.com/snowguard/_vti_cnf/api.php\"\n Pattern match: \"http://artridon.com/wp-includes/theme-compat/theme-compat.php\"\n Pattern match: \"http://thesafemanvt.com/mdt/cache8b75e5145d424b4f4971fc04e6b1c785/cache8b75e5145d424b4f4971fc04e6b1c785.php\"\n Pattern match: \"http://elementalimports.ca/wp-content/uploads/uploads.php\"\n Pattern match: \"http://grassiinsurance.com/wp-content/plugins/plugins.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"http://www.facebook.com/\" (Indicator: \"facebook.com\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00175484-00002272-77B7228D-181901\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00175484-00002272-25305-628-00410834","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.16615214709","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00175484-00002272-77B7228D-181886\n GetVersionExA@KERNEL32.DLL at 00175484-00002272-25305-172-004044A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /wp-includes/theme-compat/theme-compat.php HTTP/1.0\nHost: nusinicphotos.com\nAccept: */*\nAccept-Encoding: identity, *;q=0\nAccept-Language: en-US\nContent-Length: 200\nContent-Type: application/octet-stream\nConnection: close\nContent-Encoding: binary\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Windows\\win.ini\"\n \"\" read file \"%APPDATA%\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Windows\\wcx_ftp.ini\"\n \"\" created file \"C:\\Windows\\32BitFtp.ini\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\en-US\\urlmon.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Checks on FTP client related files","description":"\"\" opened file \"C:\\Program Files\\Common Files\\Ipswitch\\WS_FTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\SmartFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\SmartFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\TurboFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\TurboFTP\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\VanDyke\\Config\\Sessions\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\VanDyke\\Config\\Sessions\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"%APPDATA%\\FTPRush\\\" (DesiredAccess: 1048577, OpenOptions: 16417)","origin":"API Call","relevance":8,"id":"api-45","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00175484-00002272-77B7228D-181877\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00175484-00002272-25305-654-004107A4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetProcAddress\n WriteFile\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"script.php_wndz2.jpg.exe.bin\" was detected as \"PureBasic 4.x -> Neil Hodgson\"","origin":"Static Parser","relevance":5,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"script.php_wndz2.jpg.exe.bin\" has a section named \".code\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/53 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"pony\" matched process \"script.php_wndz2.jpg.exe\" as \"Identify Pony\" based on indicators: \"{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X},YUIPWDFILE0YUIPKDFILE0YUICRYPTED0YUI1.0,POST %s HTTP/1.0,Accept-Encoding: identity, *;q=0\" (Author: Brian Wallace @botnet_hunter)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"\" opened file \"%APPDATA%\\Bitcoin\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\ProgramData\\Bitcoin\\\" (DesiredAccess: 1048577, OpenOptions: 16417)\n \"\" opened file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Bitcoin\\\" (DesiredAccess: 1048577, OpenOptions: 16417)","origin":"API Call","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials","description":"\"RushSite.xml\" (Indicator: \"rushsite.xml\")\n \"Software\\FlashPeak\\BlazeFtp\\Settings\" (Indicator: \"\\blazeftp\\\")","origin":"File/Memory","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"\"\" (Access type: \"CREATE\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\")","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Credential Stealer","details_count":1,"details":[{"detail":"Tries to steal FTP credentials"}],"sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":92,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"56b27af80e316d8538a4cc9e","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"RDM","contacted_countries":["USA"],"submit_name":"script.php_wndz2.jpg","analysis_start_time":"2016-02-03T16:13:48+00:00","indicators_count":{"informative":9,"suspicious":20,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"50.63.219.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}],"dns_resolutions":[{"domain":"nusinicphotos.com","address":"50.63.219.1","country":"United States","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}],"http_requests":[{"host":"nusinicphotos.com","host_ip":"50.63.219.1:80","url":"/wp-includes/theme-compat/theme-compat.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}],"processes":[{"pid":2272,"ppid":0,"name":"script.php_wndz2.jpg.exe","command_line":"","normalized_path":"","uid":"00175484-00002272","icon":"$26"}],"all_imported_dlls":["kernel32.dll","CRTDLL.dll","SHLWAPI.dll","msi.dll","pstorec.dll","rasadhlp.dll","RPCRT4.dll","USER32.dll","ole32.dll","ntdll.dll","wininet.dll","CRYPT32.dll","ntmarta.dll","mswsock.dll","VERSION.dll","CLBCatQ.DLL","MLANG.dll","comctl32.dll","NLAapi.dll","napinsp.dll","iphlpapi.DLL","dnsapi.DLL","LPK.dll","IMM32.DLL","msvcrt.dll","KERNELBASE.dll","USP10.dll","wsock32.dll","wshtcpip.dll","winrnr.dll","ADVAPI32.dll","PSAPI.DLL","SspiCli.dll","CFGMGR32.dll","shell32.dll","profapi.dll","WS2_32.dll","urlmon.dll","uxtheme.dll","userenv.dll","ieframe.dll","GDI32.dll","netapi32.dll","SETUPAPI.dll","DEVOBJ.dll","MSCTF.dll","sechost.dll","CRYPTBASE.dll","pnrpnsp.dll","fwpuclnt.dll","OLEAUT32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%TEMP%\\HWID","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%WINDIR%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%USERPROFILE%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%PROGRAMFILES%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%WINDIR%\\32BitFtp.ini","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"%TEMP%\\Client Hash","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\WINRAR\\","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"56b27af80e316d8538a4cc9e"}]}]}},"report_ids":{"sandbox_job_ids":["56b27af80e316d8538a4cc9e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0145d1764c8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0145d1764c8e…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0145d1764c8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0145d1764c8e…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0145d1764c8e779a22cfce570fd45c63ec1931693191656d37abdaa58e4a3996"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0145d1764c8e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0145d1764c8e…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]