24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T411,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 0384509bb8c7… — Score 53/100 — Hybrid Analysis","description":"Malicious verdict for sample 0384509bb8c7…. Threat score 53/100. 0/29 AV engines flagged this file. 3 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f"],"about":{"@type":"SoftwareApplication","name":"c04288440.pdf","applicationCategory":["pdf"],"identifier":"0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f","additionalType":"Malicious sample"},"threatScore":53,"antivirusDetections":{"malicious":0,"total":29},"behavioralIndicators":{"malicious":3,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T53a,"http://www.microsoft.com/windowsvista/getready/hardwarereqs.mspx" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.hp.com/hpinfo/globalcitizenship/environment/supplychain/gen_specifications.html" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.windowsvista.com/upgradeadvisor" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.energystar.gov" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.intel.com/technology/anti-theft/" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.microsoft.com/windowsvista/getready/capable.mspx" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.epeat.net" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.hp.com/go/notebooks/WLAN" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.hp.com/go/lookuptool" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin") "http://www.office.com" (Based on: "0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf.bin")26:Tae7,Found malicious artifacts related to "165.254.207.74" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://www.icicibank.com/campaigns/mailers/2015-may/irctc-29-05-2015/gb/Disclaimer_trendin.html (AV positives: 1/63 scanned on 06/06/2015 01:04:22) URL: http://www.icicibank.com/campaigns/mailers/2015-may/irctc-29-05-2015/pb/Disclaimer-imobile-banking.html (AV positives: 1/63 scanned on 06/06/2015 01:01:22) URL: http://i0.tagstat.com/p1/m/ibqBZmk1JdIoMVTA0j425Knieg1jcE8eo-25td4_14BBCUF5DMWjeg==.jpg (AV positives: 1/63 scanned on 04/27/2015 10:29:40) URL: http://install-cdn.stormvade.net/ (AV positives: 3/62 scanned on 03/18/2015 19:45:38) URL: http://download.cdn.bearshare.com/cdn/r/1586/bearsharesetup-r1586-n-bo.exe (AV positives: 6/62 scanned on 03/18/2015 13:37:12) File SHA256: cdd72302eaacf36186a29c524e4a8dd8535007c009f23b5563037e224a27cad2 (AV positives: 1/57 scanned on 03/18/2015 14:27:15) File SHA256: f1ca24da6e42ffe5e7453e0fa7fc59a4f40c88808a9226746ab38fe60569e570 (AV positives: 2/56 scanned on 03/16/2015 05:25:01) File SHA256: 2adceaf7d5a9737b34874603b500f5c64493568b7af8157f3a57b0de34e94644 (AV positives: 1/57 scanned on 03/10/2015 13:21:40) File SHA256: d4f1e974af975f382359108ee45dd997b59193f52167afbe809082726197f0bf (AV positives: 1/57 scanned on 03/09/2015 08:28:37) File SHA256: 3fc75ce830ffad51c5d153b311a79d179608de4bae98d8e589c35998c08ca51c (AV positives: 11/57 scanned on 03/09/2015 04:56:32) Found malicious artifacts related to "165.254.207.88" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://p.udn.com.tw/upf/2014_sales/travel/cheesead.html (AV positives: 1/62 scanned on 04/24/2015 21:55:46) URL: http://i.ligatus.com/dmu/is/1/1/0/6/3/4/2/90_90x75.jpg (AV positives: 1/62 scanned on 03/29/2015 01:35:31) URL: http://i.ligatus.com/dmu/is/1/1/0/2/4/8/7/90_mc_UCL_2015_LigatusSpecs_90x75_V2.jpg (AV positives: 1/62 scanned on 03/29/2015 01:35:31) URL: http://i.ligatus.com/dmu/is/1/9/8/7/1/1/180_L_180x60.jpg (AV positives: 1/62 scanned on 03/29/2015 01:35:29) URL: http://b.monetate.net/js/1/a-986a6ec9/p/v2.qvc.com/396303/g (AV positives: 1/62 scanned on 03/18/2015 15:37:57) File SHA256: acc3d74894678db46bde1ad8576f5ff4428937aa4bc2e864c1a5fa749f9ab947 (AV positives: 1/57 scanned on 03/18/2015 15:26:23) File SHA256: f7e23bbb64057f72d70fe3fa92b2c331249f74d9eefa31239dc4b4adf407e02d (AV positives: 1/57 scanned on 03/18/2015 15:26:11) File SHA256: 62c6f2122419aafa1fa984f6fd00d0c55a19888b29c80f7b4d7782db5fb42b0f (AV positives: 1/57 scanned on 03/18/2015 14:50:15) File SHA256: 81e334dc648f02754022cf930c9a4d775830ca7ee73f684fd685c349260a6e8f (AV positives: 1/57 scanned on 03/18/2015 12:29:35) File SHA256: 1d0afec3f6b7df2e976fb7b1deef00abb9dc6191f2b59016d483c3e8b34a1e93 (AV positives: 1/57 scanned on 03/17/2015 17:41:28)27:Td20,"" (Indicator: "facebook.com") "" (Indicator: "linkedin.com") "" (Indicator: "twitter") " Facebook" (Indicator: "facebook.com") " LinkedIn" (Indicator: "linkedin.com") " Twitter" (Indicator: "twitter") "" (Indicator: "twitter") "

Intel on Twitter" (Indicator: "twitter") "" (Indicator: "facebook.com") "" (Indicator: "linkedin.com")28:T648,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAARKSURBVFhH7VddaFxFGL0+1AR0Iwi21bqtYmkbG8QHRSoBX6y+CqIPGkShfRAJ2FSITam0hYAQ213UbUijYvShcWm0tVGaTWhxa7o/SRqams02wd0k7q9ks5tk8/9znO+zE2cn2SS30DcHDnO/uzNzzne+uXPvGsb/bWMOIB6PIxaLIRqNMiKRyDIopt8INC6RSPD14OAgxPKE/O3CE8/gXmBoaAiBQADUl5eX5xfRuKMEP7/wcg7a3z8MgrxP122vvb1inD5PxrRmOByGx+MBNXIir4gG69M4t70kBzxLtHQgiKaSfTJE6PxFHqc2fS7FtGYoFFoWQOPJiVXLcfbxPfh++94c0AS6N+y6gpu2M8znevNdZCNRXK+o4lifo8a0puqAFNzf379SxOeP7cI3QrEKmuDctx8p4YDvxKc8n37vtjkYatPnUkxrkgCv15szlgLaFzlO1Dy6E3VCsQo569bX3/F9atTHPH5cPXSE40tvvMPQ51JMa1Ldu7q64HQ6Ybfb4XA44HK5MDY2hr6+vv9EVG99Co5tu3NABOo9KejmVw18X/9dn09rUs3J8ubmZtTX17OI6upq2Gw2flSXXTi25UnYhWVr4fzrZajd89y64+QatCYJSCaTXIpgMIienh74fD643e7cMlQ+sgP3AsPDwxgdHUU6nWZkMhmkUik+xOigWnagsLAQFotlTRQUFMDv9zMoC3kt+46ODrjv24Rru4rhqfgIvb29fBKq5FT78fFxxsTERM5GlMGaPVmaD5Rtt7EJwQ8PY+DUvzUeGRnhrAk6eTabXf+I1g5vti8fyOo/LA+jb++ziF/6JYd4NfLJyUnzAogkH8jqWy++BJ9wIXntd85YJybbKXMivysBsp56L22+XVkFt3F/XmJJPjU1BcK6b0m9BJJI72W2gcqjcBkF+LP2LG8ymbGaNRFPT08zTAuQRGovdzX1ly2b0WrdiRaBjHjUdGKVfGZmxrwAlUx9nCjT7o+P4SfLFsSue/Gj6Nvfeo/rLO2WWRMxYXZ21rwAaatub1pk+4NlKzqPHGfSqMeHcyK+UPI8BpxNDN/Rk7hRY0fc38nkc3Nz5gWQpRJyJ1PvE8SN1t2Iev3wVp3AxdL9qDMeYNQKnDEexLfWYrSUHRBv1GKEW69ifn7evACVVFobEaQOQUBoKn0F7VUnEWppw3giyVaHW6/g17KDqBOv6BrDAnvRNkQ7b2BhYcG8ALWemXgCbR9U4LRYtLH0VSZT60s2S6vJbsqYkB1JMfni4qJ5AbSRiOQvXye+FFaeEtkQ/r49wGQ6qUpMpJKYyJeWlswLkASnhZ2fGEWMjvoG3lAqZLbUr0ZM5NRMnwOS5HiRFZXGQ/jtsy+YWCVUSfWMJbH8uDEtQCeSscxSJZQ2E6lOfNcCVCLdWiLcCKn6hWraAUmyGtlama74LL5zw7SAOxM29PFiYuzG/pmaWNCsQOMfbpspr7NdGW0AAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":53,"unified_at_epoch_ms":1790439224032,"unified_at":"2026-09-26T16:13:44.032Z","metadata":{"hashes":{"sha256":"0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f","sha1":"5f89313f67a15141cb68e35b856d511389d0ae6a","md5":"b69b010222f5d64f757331f8d1548ee8","sha512":"00fe551eb897b85342d6cba20ac6a31a60d43143122f3eccf9a2a59d5787ed05e4b1e55d2f603ecf972d1e25ae6de8e5214072d379a285c9a779ff5a36a1eaaf","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"c04288440.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":3644622,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297623000,"last_seen":1664583183000,"last_multi_scan":1664583183000}},"detections":{"summary":{"verdict":"malicious","score":53,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":3,"suspicious_count":3,"malicious_count":3,"total":9},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"165.254.207.74:80\"\n \"23.60.139.27:80\"\n \"23.60.133.163:80\"\n \"165.254.207.88:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\Acrobat Instance Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"urlref_httpwww.microsoft.comwindowswindows_7\" has type \"HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators\"\n \"urlref_httpwww.windowsvista.comupgradeadvisor\" has type \"HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators\"\n \"urlref_httpwww.office.com\" has type \"HTML document, ASCII text, with CRLF line terminators\"\n \"urlref_httpwww.hp.comproductssecurity\" has type \"HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators\"\n \"urlref_httpwww.intel.comtechnologyanti_theft\" has type \"HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators\"\n \"urlref_httpwww.hp.comgolookuptool\" has type \"HTML document, UTF-8 Unicode text, with CRLF, LF line terminators\"\n \"urlref_httpwww.hp.comhpscarepack\" has type \"HTML document, ASCII text, with CRLF line terminators\"\n \"urlref_httpwww.energystar.gov\" has type \"data\"\n \"urlref_httpwww.hp.comaccessibility\" has type \"HTML document, ASCII text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Free antivirus\" (Indicator: \"antivirus\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://www.energystar.gov\"\n \"http://www.epeat.net\"\n \"http://www.hp.com/go/lookuptool\"\n \"http://www.hp.com/go/notebooks/WLAN\"\n \"http://www.hp.com/hpinfo/globalcitizenship/environment/supplychain/gen_specifications.html\"\n \"http://www.intel.com/technology/anti-theft/\"\n \"http://www.microsoft.com/windowsvista/getready/capable.mspx\"\n \"http://www.microsoft.com/windowsvista/getready/hardwarereqs.mspx\"\n \"http://www.office.com\"\n \"http://www.windowsvista.com/upgradeadvisor\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 165.254.207.74 on port 80 is sent without HTTP header\n TCP traffic to 23.60.139.27 on port 80 is sent without HTTP header\n TCP traffic to 23.60.133.163 on port 80 is sent without HTTP header\n TCP traffic to 165.254.207.88 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"malicious","category":"General","name":"PDF file has an embedded URL available for user interaction","description":"$25","origin":"File/Memory","relevance":5,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$27","origin":"File/Memory","relevance":4,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":30,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"55dc1d550e316d893af8cb59","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":53,"contacted_countries":["USA"],"submit_name":"c04288440.pdf","analysis_start_time":"2015-08-25T02:47:56+00:00","indicators_count":{"informative":3,"suspicious":3,"malicious":3},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"165.254.207.74","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"address":"23.60.139.27","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"address":"23.60.133.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"address":"165.254.207.88","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}],"processes":[{"pid":468,"ppid":0,"name":"AcroRd32.exe","command_line":"\"Z:\\0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f.pdf\"","normalized_path":"","uid":"01993171-00000468","icon":"$28"}],"all_imported_dlls":["IMM32.DLL","SspiCli.dll","MSCTF.dll","ole32.dll","KERNELBASE.dll","msvcrt.dll","sechost.dll","GDI32.dll","SHLWAPI.dll","CFGMGR32.dll","Comctl32.dll","OLEAUT32.dll","USER32.dll","SHELL32.dll","AcroRd32.dll","kernel32.dll","ADVAPI32.dll","USP10.dll","DEVOBJ.dll","VERSION.dll","uxtheme.dll","dwmapi.dll","BIB.dll","profapi.dll","LPK.dll","SETUPAPI.dll","PSAPI.DLL","CRYPTBASE.dll","RPCRT4.dll","ntdll.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlref_httpwww.microsoft.comwindowswindows_7","sha256":"c3c5152a456bc2c71905bdef41d66f175844447ff48543f1b0e7ba86eb084f45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.windowsvista.comupgradeadvisor","sha256":"d03c1df1f76775c17294060f1fc221c12aa961cef78a60d590949767a088604f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.office.com","sha256":"2fd770dff40155bbb282e13dec4747658a0ee149e5fe3192d943148fba89cd2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comproductssecurity","sha256":"4cfd046da62ac0177e3f9baa8b084bbdb4df73e01b317dd194396ce8df7be16f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.intel.comtechnologyanti_theft","sha256":"638b2f5816fd066dfb8c63066013b806b97af3bb509f8c257193319b98193d7f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comgolookuptool","sha256":"528cb60e81525021b2f6162ea885e4e3c4f632d6be6631378c653a617a7791be","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comhpscarepack","sha256":"f1096934e72a2fb7743a67cb6e0021cb5962254ee2feba386b111bd9512346ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.energystar.gov","sha256":"d364eb01f88e8f3c25d8ca1f7113a4687d885783fb78cf2387c3ac42c11ae508","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comaccessibility","sha256":"188041173063662da112eed1b94db2bece89869da6c8218cb0743e536543d4f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comgonotebooksWLAN","sha256":"ab2e52f0ac264a647a5d89744d701f3c14f864af0347ef403042a61f7cf755d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comhpinfoglobalcitizenshipenvironmentsupplychaingen_specifications.html","sha256":"b07e66ed5806774e368ef2bb34d3bf33943ea0b6ec872cc70835315803fc5a38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comgoreuse_recycle","sha256":"0d99bf529878163b9e71647fb91654a6b9d4d38ec7dae3ea401646e8104dc978","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comgorecyclers","sha256":"7fbe92f5d06e35ae87fcfca77649cb1b50e88c723c0f0095cbdcc4bfc9af83ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comhpinfoglobalcitizenshipgcreportindex.html","sha256":"3a9c8c9e155da6d6c99fced933965db956251997ca7afd96b5a8f08d3f913822","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comenvironment","sha256":"c8b49278976ec3ddfcea9599c80d25a5833b5502ab511b0884097a922c44a9b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"name":"urlref_httpwww.hp.comhpinfoglobalcitizenshipenvironmentproductdesignecolabels.html","sha256":"e50c185a7373387171b1e7fbfc79ba9fb276cabf815cc8c58dc9377ab6a9023d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"path":"%PROGRAMFILES%\\(x86)\\adobe\\reader 11.0\\reader\\locale\\de_de\\rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]},{"key":"HKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"55dc1d550e316d893af8cb59"}]}]}},"report_ids":{"sandbox_job_ids":["55dc1d550e316d893af8cb59"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 0384509bb8c7… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0384509bb8c7…. Threat score 53/100. 0/29 AV engines flagged this file. 3 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 0384509bb8c7… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0384509bb8c7…. Threat score 53/100. 0/29 AV engines flagged this file. 3 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0384509bb8c703de437ebb4a4fd28e836ec674b4eeaab5f189de805b7ccad41f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 0384509bb8c7… — Score 53/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0384509bb8c7…. Threat score 53/100. 0/29 AV engines flagged this file. 3 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]