26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T500,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 069679ce2dac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 069679ce2dac…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140"],"about":{"@type":"SoftwareApplication","name":"069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","applicationCategory":["peexe","assembly","executable"],"identifier":"069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T69c1,Observed system executable string:"Si)lG$w6%6*676<6I6N6[6`6m6r6k__BackingFieldf`Y\ DXTget_NameSize8&8+858|8volumeSerialNumberEAuthDlg.dll?*?T?d?~?WWWWjnG%S}1E=%=5=|>set_FormatID]XD)|u[>5(vaultcli.dll1 1$1(1,10141D1I1[1set_TypedPropertyValue!This is a PE executable707=7Z7n7RWYMwfK}{N;;=%=*=7=<=I=N=[=`=m=r=1:~A,*~nsu%X.tmp1(151B1O1g1lpdwProcessIDL$bf-S=%=*=7=<=I=N=[=`=m=r=<)<.<;<@k__BackingFieldk__BackingFieldfileSystemNameBufferEAuthDlg.dllk__BackingField,,< RRp(k__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'fileSystemNameBufferset_GuidMasterKey1#10181E1M1Z1b1o1w10'070T0h00;0Z0w061e1m13#3*3/353;3B3G3M3T3[3`3e3l3s3x3~35k^!`g5)5.5;5@5M5R5_5d5q5v52#2(252:2G2L2Y2^2k2p2}2logindlg.dllget_TypedPropertyValueEE].RE20D0]0x0'bgG!I[c:\windows\friendl.dllk__BackingField1:~A,*0D0]0x0ccc.eeeO6r~BnLX>_>E@kA$w=!=)=6=>=K=S=`=h=u=}=NullsoftInstL:*:8:H:X:h:x:XBYCOOmp!This i" [Source: sample.bin], Observed system executable string:"<9#9L9a9fVu.yyc:\windows\friendl.dll=%=*=7=<=I=N=[=`=m=r=1:~A,*4 525[5AWJRVVDuYI33KhhzJ6c:\windows\friendl.dll4'434J4}4fileSystemNameBuffer4 525[51#10181E1M1Z1b1o1w1Vj%UUU505:5O5Y5n5x5{m=w]U=B>X>_>xb!D?91#10181E1M1Z1b1o1w1Vj%UUU0;0Z0w061e1m13#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3S1078b'bgG!I[volumeNameSizelogindlg.dllget_TypedPropertyValuef`Y\ DXTget_NameSizei)lG$w0,0`0t0get_TypedPropertyValueEE].RE2?5(Logindlg.dll_guidMasterKey5+6p6x6:*:8:H:X:h:x:3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3Unable to resolve HTTP prox=!=)=6=>=K=S=`=h=u=}=NullsoftInstLO1hs5mChainingModeGCMget_NameSized3lw*(T]((T]'volumeSerialNumberEAuthDlg.dllk__BackingFieldf`Y\ DXTget_NameSized3lw*(T]((T]';K!>&>3>8>E>J>W>\>i>n>{>set_TypedPropertyValuePaP0k__BackingField71777E7p70D0]0x0ccc.eee|$$~@W{m=w]ULogindlg.dll=!=)=6=>=K=S=`=h=u=}=O6r~Bn0;0Z0w061e1m1maximumComponentLengthUnable to resolve HTTP prox=!=)=6=>=K=S=`=h=u=}=6%6*676<6I6N6[6`6m6r6XBYCOOmp<-<3!I[BankFrame.dllSerializedPropertyStorageS)V_?)V_?PaP05k^!`gset_PropertyStorage~)-]AJh.0'070T0h0O4ozk__BackingField71777E7p74 525[5pCa;*p7b7o7x72)2G2q2fileSystemNameBuffer1)1" [Source: sample.bin], Observed system executable string:"1hs5mChainingModeGCMWWWWjn?!>&>3>8>E>J>W>\>i>n>{>get_GuidMasterKeyKDBM((!This is a PE executableS1078b'bgG!I[2#2(252:2G2L2Y2^2k2p2}2K}{N;;=!=)=6=>=K=S=`=h=u=}=NullsoftInstL~nsu%X.tmp\Ad\config.iniHAL9TH2#2(252:2G2L2Y2^2k2p2}2K}{N;;=%=*=7=<=I=N=[=`=m=r=1:~A,*4 525[5AWJRVVDuYI33KhhzJ6k__BackingFieldk__BackingFieldvolumeSerialNumberEAuthDlg.dllk__BackingField,,< RRp(O6r~Bn:>:t:~:`[G.qU2#333M3set_GuidMasterKey?*?T?d?~?vaultcli.dll0'070T0h0O4ozk__BackingFieldget_TypedPropertyValueEE].RE20D0]0x0pCa;*p7b7o7x7UVWj _34'434J4}4)V_>>p{GK<)<.<;<@:t:~:{m=w]U=B>X>_>Unable to resolve HTTP prox373D3M3Z3volumeNameSiz" [Source: sample.bin], Observed system executable string:":9G9L9Y9^9k9p9}9,,< RRp(;$;1;K;G%S}1E6$747w75k^!`g]XD)|u[>5(vaultcli.dllget_GuidMasterKey050A0T0l$(9l$(trfVu.yy2#2(252:2G2L2Y2^2k2p2}2SerializedPropertyStorageS)V_?)V_?VaultOpenVault\Ad\config.iniHAL9TH6&!Ldfk__BackingField)V_>>p{GKEAuthDlg.dll\Ad\config.iniHAL9THk__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'fileSystemNameBufferLogindlg.dllset_PropertyStorage~)-]AJh.0'070T0h0O4ozYI33KhhzJ6:>:t:~:<)<.<;<@X>_>E@kA$wNullsoftInstL\Ad\config.ini<-<3k__BackingField|$$~@WRWYMwfS1078bset_TypedPropertyValue2#2(252:2G2L2Y2^2k2p2}2-0h0u0~0AWJRVVDuc:\windows\friendl.dll)V_>>p{GKLogindlg.dllYI33KhhzJ6fileSystemNameBufferVj%UUU3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3S1078b373D3M3Z32#2(252:2G2L2Y2^2k2p2}" [Source: sample.bin], Observed system executable string:":9G9L9Y9^9k9p9}9Logindlg.dll5+6p6x6l$(9l$(tr3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3SerializedPropertyStorageNullsoftInstL0;0Z0w061e1m1f`Y\ DXTL$bf-Si)lG$w6%6*676<6I6N6[6`6m6r6ChainingModeGCMget_NameSize;K>p{GKEAuthDlg.dllAWJRVVDuVj%UUU2)2G2q2=%=5=|>set_GuidMasterKey~)-]AJh.0'070T0h0set_TypedPropertyValue=%=5=|>1(151B1O1g1>!>&>3>8>E>J>W>\>i>n>{>O4oz!I[2#2(252:2G2L2Y2^2k2p2}2K}{N;;)V_>>p{GKVaultEnumerateItemsAWJRVVDulpdwProcessIDc:\windows\friendl.dllk__BackingFieldfileSystemNameBuffer1)1R1p1_guidMasterKey5+6p6x6UVWj _34'434J4}4=B>X>_>E@kA$w~)-]AJh.VaultGetItem0;0Z0w061e1m13#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3F((?u;7+707=7B7O7T7a7f7s7x7S)V_?)V_?logindlg.dllXBYCOOmpf`Y\ DXT1(151B1O1g1i)lG$wL5+6p6x6UVWj _3{m=w]U; ;-;2;?;D;Q;V;c;h;u;z;E@kA$w~)-]AJh.VaultGetItem0;0Z0w061e1m1f`Y\ DXTUnable to resolve HTTP proxi)lG$w6%6*676<6I6N6[6`6m6r6get_TypedPropertyValuef`Y\ DXT?k__BackingFieldk__BackingFieldWWWWjn?5(vaultcli.dll1 1$1(1,10141D1I1[1?=;(5.|$$~@W707=7Z7n7maximumComponentLength>!>&>3>8>E>J>W>\>i>n>{>=!=)=6=>=K=S=`=h=u=}=PaP0k__BackingFieldvolumeSerialNumberEAuthDlg.dllAWJRVVDuWWWWjn?S1078b?*?T?d?~?>!>&>3>8>E>J>W>\>i>n>{>get_GuidMasterKey050A0T09#9L9a9'bgG!I[c:\windows\friendl.dllk__BackingField-0h0u0~04 525[5pCa;*p6&!LdfK}{N;;4'434J4}41:~A,*xb!D?9ccc.eeek__BackingField4'434J4}42#333M3xb!D?91#10181E1M1Z1b1o1w10'070T0h00;0Z0w061e1m1=%=5=|>Logi" [Source: sample.bin], Observed system executable string:"yStorage>k__BackingField)V_>>p{GKEE].RE2AWJRVVDulpdwProcessIDc:\windows\friendl.dll9#9(959:9G9L9Y9^9k9p9}9|`7YTA1)1R1p1ccc.eeeO6r~Bn:>:t:~:{m=w]U; ;-;2;?;D;Q;V;c;h;u;z;xb!D?91#10181E1M1Z1b1o1w1VaultGetItemKDBM((!This is a PE executableS1078bset_PropertyStorage0,0`0t0:*:8:H:X:h:x:050A0T0F((?u;7+707=7B7O7T7a7f7s7x7i)lG$w0,0`0t0k__BackingField71777E7p70D0]0x0pCa;*p|$$~@Wk__BackingField; ;-;2;?;D;Q;V;c;h;u;z;;$;1;K;ccc.eee6$747w7set_FormatID|`7YTA1)1R1p1_guidMasterKeyNullsoftInstL0;0Z0w061e1m13#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3F((?u;E@kA$w=!=)=6=>=K=S=`=h=u=}=6%6*676<6I6N6[6`6m6r6O1hs5mf`Y\ DXTget_NameSizei)lG$w0,0`0t0k__BackingField,,< RRp(?set_FormatID]XD)|u[>5(; ;-;2;?;D;Q;V;c;h;u;z;E@kA$wG%S}1E6$747w7l$(9l$(tr707=7Z7n7maximumComponentLengthBankFrame.dll=%=*=7=<=I=N=[=`=m=r=PaP0set_FormatIDRWYMwf;$;1;K;set_TypedPropertyValue!This is a PE executable707=7Z7n7RWYMwfK}{N;;set_TypedPropertyValueVaultOpenVault1(151B1O1g12#2(252:2G2L2Y2^2k2p2}2get_GuidMasterKey1:~A,*0D0]0x0HAL9THc:\windows\friendl.dll`[G.qU<)<.<;<@k__BackingFieldYI33KhhzJ6505:5O5Y5n5x5`[G.qUset_GuidMasterKey~)-]AJh.VaultGetItem=%=5=|>Unable to resolve HTTP proxRWYMwf0'070T0h0get_TypedPropertyValue!This is a PE executable1(151B1O1g12#2(252:2G2L2Y2^2k2p2}2logindlg.dllget_TypedPropertyValue~nsu%X.tmpccc.eeec:\windows\friendl.dll4'434J4}4<)<.<;<@5(Logindlg.dll_guidMasterKey5+6p6x6:*:8:H:X:h:x:3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3BankFrame.dll373D3M3Z36%6*676<6I6N6[6`6m6r60;0Z0w061e1m1f`Y\ DXTL$bf-S;Kk__BackingField<)<.<;<@5(Logindlg.dllset_PropertyStorageNullsoftInstL:*:8:H:X:h:x:maximumComponentLengthBankFrame.dll373D3M3Z3NullsoftInstL:*:8:H:X:h:x:XBYCOOmpf`Y\ DXTget_NameSizei)lG$w0,0`0t0k__BackingField,,< RRp(0D0]0x02)2G2q2|$$~@WEAuthDlg.dll,,< RRp(;$;1;K;G%S}1E6$747w75k^!`g5)5.5;5@5M5R5_5d5q5v5vaultcli.dll1 1$1(1,10141D1I1[16$747w7S1078b'bgG!I[2#2(252:2G2L2Y2^2k2p2}2SerializedPropertyStorageS)V_?)V_?:*:8:H:X:h:x:XBYCOOmplpdwProcessID2)2G2q2S)V_?)V_?6%6*676<6I6N6[6`6m6r6O1hs5mChainingModeGCM6&!Ldf2)2G2q2`[G.qUEAuthDlg.dllk__BackingFieldVj%UUU505:5O5Y5n5x5=%=5=|>5k^!`g?*?T?d?~?vaultcli.dll1 1$1(1,10141D1I1[1KDBM((!This is a PE executable1(151B1O1g12#2(252:2G2L2Y2^2k2p2}2K}{N;;get_TypedPropertyValueEE].RE21(151B1O1g1lpdwProcessIDc:\windows\friendl.dllk__BackingField<)<.<;<@ccc.eee6&!Ldf4'434J4}4fileSyste" [Source: sample.bin], Observed system executable string:"[6`6m6r6\Ad\config.iniHAL9THk__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'volumeSerialNumberset_GuidMasterKey1#10181E1M1Z1b1o1w1;$;1;K;%NW&%OW)%OW)%OW)%OW)%OW)%OW'=%=5=|>S1078b?*?T?d?~?>!>&>3>8>E>J>W>\>i>n>{>505:5O5Y5n5x5050A0T05k^!`g'bgG!I[volumeNameSizeget_GuidMasterKey-0h0u0~0~nsu%X.tmppCa;*p2#2(252:2G2L2Y2^2k2p2}2k__BackingField71777E7p74 525[5pCa;*pc:\windows\friendl.dll4'434J4}4|`7YTA1)1R1p11#10181E1M1Z1b1o1w1O6r~Bn%NW&%OW)%OW)%OW)%OW)%OW)%OW'fileSystemNameBufferUnable to resolve HTTP prox373D3M3Z3volumeNameSize505:5O5Y5n5x5050A0T0F((?u;'bgG!I[volumeNameSizelogindlg.dllXBYCOOmp~nsu%X.tmp7+707=7B7O7T7a7f7s7x7;K?=;(5.UVWj _39#9(959:9G9L9Y9^9k9p9}9|`7YTAE@kA$w5+6p6x6l$(9l$(tr{m=w]U; ;-;2;?;D;Q;V;c;h;u;z;SerializedPropertyStorageNullsoftInstL9#9L9a93#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3BankFrame.dll8&8+858|8NullsoftInstL\Ad\config.inif`Y\ DXTget_NameSize8&8+858|86%6*676<6I6N6[6`6m6r6k__Back" [Source: sample.bin], Observed system executable string:"izedPropertyStorageS)V_?)V_?:*:8:H:X:h:x:ChainingModeGCMget_NameSize8&8+858|82#333M3O1hs5m,,< RRp(;$;1;K;2)2G2q2|$$~@WK}{N;;71777E7p70D0]0x0lpdwProcessIDc:\windows\friendl.dllk__BackingField)V_>>p{GK<)<.<;<@=K=S=`=h=u=}=NullsoftInstL0;0Z0w061e1m1<-<3!>&>3>8>E>J>W>\>i>n>{>get_GuidMasterKeyNullsoftInstL9#9L9a9maximumComponentLengthBankFrame.dllSerializedPropertyStorageS)V_?)V_?6%6*676<6I6N6[6`6m6r6\Ad\config.iniYI33KhhzJ66&!Ldf2)2G2q28&8+858|8volumeSerialNumberset_GuidMasterKey?*?T?d?~?Vj%UUUG%S}1E`[G.qU5k^!`g5)5.5;5@5M5R5_5d5q5v5RWYMwf0'070T0h0KDBM((!This is a PE executableS1078b'bgG!I[2#2(252:2G2L2Y2^" [Source: sample.bin], Observed system executable string:"H:X:h:x:ChainingModeGCMWWWWjn7+707=7B7O7T7a7f7s7x7volumeSerialNumberk__BackingFieldChainingModeGCM;$;1;K;?=;(5.2#333M3set_GuidMasterKey|`7YTA1 1$1(1,10141D1I1[1?=;(5.l$(9l$(tr707=7Z7n7RWYMwfE@kA$wset_TypedPropertyValueVaultGetItem707=7Z7n72#2(252:2G2L2Y2^2k2p2}2SerializedPropertyStorage-0h0u0~09#9L9a9HAL9TH6&!Ldf2)2G2q2)V_>>p{GKEAuthDlg.dllChainingModeGCMWWWWjn2)2G2q2=%=5=|>5k^!`gk__BackingField;$;1;K;KDBM((2#333M35)5.5;5@5M5R5_5d5q5v5~)-]AJh.1 1$1(1,10141D1I1[1KDBM((~nsu%X.tmp'bgG!I[c:\windows\friendl.dllget_GuidMasterKey1:~A,*0D0]0x0HAL9THc:\windows\friendl.dll4'434J4}4<)<.<;<@7b7o7x7:>:t:~:)V_>>p{GK<)<.<;<@k__BackingField71777E7p71)1R1p1pCa;*p7b7o7x7L6$747w7L5(vaultcli.dll_guidMasterKey5+6p6x6VaultGetItem707=7Z7n7<-<3=K=S=`=h=u=}=NullsoftInstL:*:8:H:X:h:x:XBYCOOmp<-<3k__BackingField-0h0u0~04 525[5AWJRVVDu7b7o7x72)2G2q2`[G.qU1:~A,*set_PropertyStorageccc.eeeO6r~Bn%NW&%OW)%OW)%OW)%OW)%OW)%OW'=%=5=|>Logindlg.dll373D3M3Z3volumeNameSizeVaultGetItem0;0Z0w061e1m13#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3S1078b373D3M3Z30,0`0t0O4oz>p{GKVaultEnumerateItems_guidMasterKey5+6p6x6:>:t:~:]XD)|u[>5(Logindlg.dll_guidMasterKeyNullsoftInstL:>:t:~:3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3BankFrame.dll373D3M3Z3volumeNameSize:*:8:H:X:h:x:ChainingModeGCMF((?u;d3lw*(T]((T]'vo" [Source: sample.bin], Observed system executable string:"luef`Y\ DXTget_NameSize373D3M3Z3volumeNameSizeO1hs5mEE].RE20D0]0x0lpdwProcessIDL>p{GK1)1R1p1ccc.eee|$$~@W4'434J4}4|`7YTAE@kA$wccc.eeeVaultGetItem707=7Z7n7; ;-;2;?;D;Q;V;c;h;u;z;E@kA$wS)V_?)V_?:*:8:H:X:h:x:fVu.yyF((?u;SerializedPropertyStorageS)V_?)V_?6%6*676<6I6N6[6`6m6r6O1hs5mf`Y\ DXT?%NW&%OW)%OW)%OW)%OW)%OW)%OW'l$(9l$(tr]XD)|u[>5(vaultcli.dll_guidMasterKey6$747w7l$(9l$(tr707=7Z7n7maximumComponentLengthBankFrame.dll=!=)=6=>=K=S=`=h=u=}=NullsoftInstL\Ad\config.iniHAL9THL$bf-SS)V_?)V_?VaultOpenVault\Ad\config.ini7b7o7x7UVWj _3`[G.qU2#333M3xb!D?91#10181E1M1Z1b1o1w1k__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'!This is a PE executableset_GuidMasterKey?*?T?d?~?vaultcli.dll1 1$1(1,10141D1I1[1KDBM((~nsu%X.tmp1(151B1O1g12#2(252:2G2L2Y2^2k2p2}2K}{N;;O4oz!I[c:\windows\friendl.dll=%=*=7=<=I=N=[=`=m=r=EE].RE2AWJRVVDu7b7o7x72)2G2q29#9(959:9G9L9Y9^9k9p9}9|`7YTA1)1R1p1ccc.eeeO6r~Bn4'434J4}4fileSystemNameBufferE@kA$w~)-]AJh.0'0" [Source: sample.bin], Observed system executable string:"3l3s3x3~3BankFrame.dllSerializedPropertyStoragevolumeNameSizeVaultGetItem0;0Z0w061e1m13#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3<-<3k__BackingField,,< RRp(;$;1;K;?5(; ;-;2;?;D;Q;V;c;h;u;z;E@kA$wset_TypedPropertyValueVaultGetItemS1078b'bgG!I[2#2(252:2G2L2Y2^2k2p2}2K}{N;;=!=)=6=>=K=S=`=h=u=}=NullsoftInstL:*:8:H:X:h:x:XBYCOOmplpdwProcessIDc:\windows\friendl.dll2)2G2q2=%=*=7=<=I=N=[=`=m=r=1:~A,*4 525[5AWJRVVDuYI33KhhzJ6k__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'=%=5=|><)<.<;<@k__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'=%=5=|>5k^!`g5)5.5;5@5M5R5_5d5q5v5RWYMwf>!>&>3>8>E>J>W>\>i>n>{>505:5O5Y5n5x5KDBM((!This is a PE executableS1078b'bgG!I[2#2(252:2G2L2Y2^2k2p2}2K}{N;;=%=*=7=<=I=N=[=`=m=r=050A0T0~nsu%X.tmp1(151B1O1g1lpdwProcessIDc:\windows\friendl.dllK}{N;;=%=*=7=<=I=N=[=`=m=r=1:~A,*4 525[5AWJRVVDuYI33Khhz" [Source: sample.bin], Observed system executable string:";k__BackingFieldvaultcli.dllG%S}1E6$747w7l$(9l$(tr]XD)|u[>5(; ;-;2;?;D;Q;V;c;h;u;z;E@kA$w=!=)=6=>=K=S=`=h=u=}=PaP0k__BackingField1:~A,*xb!D?9HAL9THk__BackingField4'434J4}42#333M3set_PropertyStoragevaultcli.dllk__BackingField6$747w75k^!`g373D3M3Z3>!>&>3>8>E>J>W>\>i>n>{>O4oz!I[c:\windows\friendl.dll=%=*=7=<=I=N=[=`=m=r=EE].RE2\Ad\config.inilpdwProcessIDUVWj _34'434J4}41:~A,*xb!D?9ccc.eeeO6r~Bn4'434J4}4fileSystemNameBuffer1)1R1p11#10181E1M1Z1b1o1w1Vj%UUU505:5O5Y5n5x5KDBM((=B>X>_>set_PropertyStorageNullsoftInstLO4ozk__BackingFieldChainingModeGCM0D0]0x0d3lw*(T]((T]'0,0`0t09#9(959:9G9L9Y9^9k9p9}9|`7YTA;$;1;K;6$747w7L=" [Source: sample.bin], Observed system executable string:"eGCMWWWWjn7+707=7B7O7T7a7f7s7x7;K5(; ;-;2;?;D;Q;V;c;h;u;z;1 1$1(1,10141D1I1[1set_TypedPropertyValuePaP0k__BackingField%NW&%OW)%OW)%OW)%OW)%OW)%OW'!This is a PE executableUnable to resolve HTTP proxRWYMwf>!>&>3>8>E>J>W>\>i>n>{>get_GuidMasterKeyKDBM((!This is a PE executableS1078b'bgG!I[c:\windows\friendl.dllget_GuidMasterKey-0h0u0~0VaultOpenVault\Ad\config.iniHAL9TH2#2(252:2G2L2Y2^2k2p2}2k__BackingField=!=)=6=>=K=S=`=h=u=}=6%6*676<6I6N6[6`6m6r69#9L9a9fVu.yy<-<3k__BackingFieldHAL9TH6&!Ldf?X>_>S1078b7+707=7B7O7T7a7f7s7x7373D3M3Z3volumeNameSizelogindlg.dllget_TypedPropertyValueEE].RE20D0]0x01(151B1O1g1d3lw*(T]((T]'i)lG$wc:\windows\friendl.dllLk__BackingFieldget_TypedPropertyValueEE].RE2WWWWjnmsg_showbeans">pCa;*p?=;(5.;K5(|`7YTA1)1R1p1msg_showbeans">G%S}1E5+6p6x6O6r~Bn:>:t:~:{m=w]UmaximumComponentLength; ;-;2;?;D;Q;V;c;h;u;z;1)1R1p1SerializedPropertyStorage=!=)=6=>=K=S=`=h=u=}=5+6p6x6PaP0=K=S=`=h=u=}=volumeSerialNumber6%6*676<6I6N6[6`6m6r6O1hs5mXBYCOOmpHAL9THWWWWjnget_NameSized3lw*(T]((T]'`[G.qUvolumeSerialNumber6%6*676<6I6N6[6`6m6r6k__BackingFieldk__BackingFieldChainingModeGCMYI33KhhzJ6;$;1;K;G%S}1E`[G.qU|$$~@Wset_GuidMasterKeyk__BackingF" [Source: sample.bin], Observed system executable string:"B1O1g1i)lG$w0,0`0t0k__BackingField71777E7p70D0]0x0pCa;*p|$$~@Wset_FormatID]XD)|u[>5(; ;-;2;?;D;Q;V;c;h;u;z;E@kA$w_guidMasterKeyO6r~Bnset_FormatIDmaximumComponentLengthE@kA$w=!=)=6=>=K=S=`=h=u=}=VaultGetItem0;0Z0w061e1m1<-<3k__BackingField,,< RRp(;$;1;K;?=;(5.5k^!`g5)5.5;5@5M5R5_5d5q5v5,,< RRp(G%S}1E6$747w7S1078bRWYMwf>!>&>3>8>E>J>W>\>i>n>{>set_TypedPropertyValuePaP0k__BackingField2)2G2q2=%=5=|>5k^!`gset_PropertyStorage~)-]AJh.0'070T0h0%NW&%OW)%OW)%OW)%OW)%OW)%OW'=%=5=|>Unable to resolve HTTP prox373D3M3Z3>!>&>3>8>E>J>W>\>i>n>{>get_GuidMasterKeyKDBM((0D0]0x0'bgG!I[c:\windows\friendl.dllk__BackingField1:~A,*0D0]0x0pCa;*p7b7o7x7k__BackingField)V_>>p{GKVaultEnumerateItemsmsg_showbeans">7b7o7x7UV" [Source: sample.bin], Observed system executable string:"rLk__BackingField1#10181E1M1Z1b1o1w1vaultcli.dll;$;1;K;?5(RWYMwfvaultcli.dll1 1$1(1,10141D1I1[1G%S}1EKDBM((PaP0!>&>3>8>E>J>W>\>i>n>{>1 1$1(1,10141D1I1[1=%=*=7=<=I=N=[=`=m=r=-0h0u0~0PaP0>p{GK1:~A,*VaultOpenVaultxb!D?9AWJRVVDuHAL9TH7b7o7x7k__BackingField2)2G2q24'434J4}4`[G.qUfileSystemNameBuffer<)<.<;<@!I[get_GuidMasterKey1(151B1O1g1volumeNameSizelogindlg.dllO4ozk__BackingField)V_>>p{GK1:~A,*Vaul" [Source: sample.bin], Observed system executable string:".set_FormatIDfileSystemNameBuffer1)1R1p1_guidMasterKey6$747w7l$(9l$(tr{m=w]U; ;-;2;?;D;Q;V;c;h;u;z;E@kA$w5+6p6x6VaultGetItem0;0Z0w061e1m1f`Y\ DXTUnable to resolve HTTP prox373D3M3Z3volumeNameSizelogindlg.dllget_TypedPropertyValueWWWWjn7+707=7B7O7T7a7f7s7x7;K!>&>3>8>E>J>W>\>i>n>{>G%S}1EPaP0!I[2#2(252:2G2L2Y2^2k2p2}2get_GuidMasterKeyNullsoftInstL9#9L9a9HAL9THL$bf-S8&8+858|8volumeSerialNumberO1hs5mHAL9THk__BackingField8&8+858|82#333M3set_GuidMasterKeyAWJRVVDu;$;1;K;2)2G2q2!This is a PE executableset_GuidMasterKey?*?T?d?~?0'070T0h0set_TypedPropertyValue!This is a PE executableS1078b373D3M3Z3K}{N;;get_TypedPropertyValueEE].RE2S1078b7b7o7x7k__BackingField1:~A,*msg_showbeans">lpdwProcessIDc:\windows\friendl.dll" [Source: sample.bin], Observed system executable string:"NameBufferLogindlg.dll_guidMasterKey5+6p6x6:*:8:H:X:h:x:3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3F((?u;E@kA$w=!=)=6=>=K=S=`=h=u=}=NullsoftInstL0;0Z0w061e1m1<-<3>p{GK<)<.<;<@k__BackingField4'434J4}4fileSystemNameBufferEAuthDlg.dll1#10181E1M1Z1b1o1w1;$;1;K;%NW&%OW)%OW)%OW)%OW)%OW)%OW'!This is a PE executable5)5.5;5@5M5R5_5d5q5v5~)-]AJh.0'070T0h0set_TypedPropertyValue050A0T0S1078b'bgG!I[2#2(252:2G2L2Y2^2k2p2}2get_GuidMasterKeyEE].RE20D0]0x0lpdwProcessIDc:\windows\friendl.dllk__BackingField1:~A,*0D0]0x0pCa;*pc:\windows\friendl.dllk__BackingField)V_>>p{GK<)<.<;<@X>_>E@kA$wvolume" [Source: sample.bin], Observed system executable string:"=`=m=r=1:~A,*4 525[51(151B1O1g17b7o7x7K}{N;;=%=*=7=<=I=N=[=`=m=r=<)<.<;<@YI33KhhzJ6UVWj _3{m=w]U2#333M3xb!D?9~)-]AJh.VaultGetItemKDBM((=B>X>_>Unable to resolve HTTP proxRWYMwfNullsoftInstL:*:8:H:X:h:x:050A0T0~nsu%X.tmp1(151B1O1g1373D3M3Z30,0`0t0O1hs5mEE].RE2get_NameSizelpdwProcessIDc:\windows\friendl.dllk__BackingField|`7YTA0D0]0x0pCa;*p7b7o7x7UVWj _39#9(959:9G9L9Y9^9k9p9}9; ;-;2;?;D;Q;V;c;h;u;z;msg_showbeans">5+6p6x6l$(9l$(tr{m=w]U=B>X>_>E@kA$wS)V_?)V_?6%6*676<6I6N6[6`6m6r6O1hs5mfVu.yy<-<35k^!`g]XD)|u[>5(vaultcli.dll_guidMasterKey5+6p6x6!This is a PE executable707=7Z7n7maximumComponentLength>!>&>3>8>E>J>W>\>i>n>{>get_GuidMasterKey-0h0u0~0:*:8:H:X:h:x:fVu.yy<-<3k__BackingFieldYI33KhhzJ6505:5O5Y5n5x5`[G.qU" [Source: sample.bin], Observed system executable string:"1$1(1,10141D1I1[1set_TypedPropertyValuePaP0!>&>3>8>E>J>W>\>i>n>{>set_TypedPropertyValue9#9L9a9fVu.yyF((?u;SerializedPropertyStorageS)V_?)V_?6%6*676<6I6N6[6`6m6r6O1hs5mChainingModeGCM<-<3k__BackingField,,< RRp(;$;1;K;G%S}1E=%=5=|>5k^!`g2#2(252:2G2L2Y2^2k2p2}21 1$1(1,10141D1I1[1-0h0u0~09#9L9a9'bgG!I[2#2(252:2G2L2Y2^2k2p2}2K}{N;;=%=*=7=<=I=N=[=`=m=r=EE].RE2\Ad\config.ini7b7o7x72)2G2q2fileSystemNameBuffer4 525[51#10181E1M1Z1b1o1w1O6r~Bn4'434J4}4=B>X>_>xb!D?95+6p6x6VaultGetItem3#3*3/353;3B3G3M3T3[3`3e3l3s3x3~3Unable to resolve HTTP proxRWYMwf0'070T0h0get_TypedPropertyValuef`Y\ DXT7+707=7B7O7T7a7f7s7x72#2(252:2G2L2Y2^2k2p2}2k__BackingField71777E7p7VaultEnumerateItems1(151B1O1g1lpdwProcessIDc:\windows\friendl.dllk__BackingField)V_>>p{GK<)<.<;<@X>_>Un" [Source: sample.bin]28:T901,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), file/memory contains long string with (Indicator: "open"; Source: "sample.bin"), Found reference to API "ReadAllLines" (Indicator: "read"; Source: "sample.bin"), Found reference to API "WriteAllText" (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "access"; Source: "sample.bin"), file/memory contains long string with (Indicator: "read"; Source: "sample.bin"), file/memory contains long string with (Indicator: "security"; Source: "sample.bin"), Found reference to API "write" (Indicator: "write"; Source: "sample.bin"), file/memory contains long string with (Indicator: "select"; Source: "sample.bin"), Found reference to API "Create__Instance__" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "StaticLocalInitFlag" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "AddAccessRule" (Indicator: "access"; Source: "sample.bin"), Found reference to API "ExitProcess" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "get_SaveMySettingsOnExit" (Indicator: "exit"; Source: "sample.bin"), Found reference to API "ReadAllBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Runtime.CompilerServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "IWshRuntimeLibrary" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_WindowState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CreateDirectory" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "OnCreateMainForm" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "FileSystemAccessRule" (Indicator: "access"; Source: "sample.bin"), Found reference to API "ShellExecuteExW" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "RuntimeHelpers" (Indicator: "time"; Source: "sample.bin"), Found reference to API "OpenSubKey" (Indicator: "open"; Source: "sample.bin"), Found reference to API "ReadOnlyCollectionBase" (Indicator: "read"; Source: "sample.bin")29:T73a,Observed system executable string:""C:\Windows\SysWOW64\runas.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\sdchange.exe"" [Source: sample.bin], Observed system executable string:""C:\Windows\SysWOW64\mavinject.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:""C:\Windows\SysWOW64\CameraSettingsUIHost.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\raserver.exe"" [Source: sample.bin], Observed system executable string:"C:\Windows\SysWOW64\reg.exe" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\runas.exe"" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\logagent.exe"" [Source: sample.bin], Observed system executable string:""C:\Windows\SysWOW64\mstsc.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:""C:\Windows\SysWOW64\rrinstaller.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\provlaunch.exe"" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\gpscript.exe"" [Source: sample.bin], Observed system executable string:""C:\Windows\SysWOW64\quickassist.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:""C:\Windows\SysWOW64\msinfo32.exe" /INHERITANCE:e /GRANT:r {0}:(F)" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\mstsc.exe"" [Source: sample.bin], Observed system executable string:"/S {0} /U {1} /F "C:\Windows\SysWOW64\sdiagnhost.exe"" [Source: sample.bin]2a:T77b,Heuristic match: "propertyvalue>k__backingfieldf`y\ dxtget_namesized3lw*(t]((t]';k!>&>3>8>e>j>w>\>i>n>{>get", Heuristic match: "_namesize8&8+858|82#333m3o1hs5m,,< rrp(k__backingfield?=;(5.2#333m3?*?t?d?~?;$;1;k;set_typedpropertyvalue!this is a pe executable707=7z7n7rwymwf>!>&>3>8>e>j>w>\>i>n>{>=!=)=6=>=k=s=`=h=u=}=pap0>p{gk\ad\config.ini6&!ldf)v_>>p{gkxb!d?9ee].re29#9(959:9g9l9y9^9k9p9}95+6p6x64'434j4}4set_propertystoragef((?u;0,0`0t0wwwwjn|$$~@w71777e7p7ccc.eee|$$~@w; ;-;2;?;d;q;v;c;h;u;z;pap0!>&>3>8>e>j>w>\>i>n>{>=!=)=6=>=k=s=`=h=u=}=nullsoftinstl~nsu%x.tmpfvu.yyc:\windows\friendl.dll=%=*=7=<=i=n=[=`=m=r=6%6*676<6i6n6[6`6m6r6\ad\config.iniyi33khhzj6l$bf-s)v_>>p{gkeauthdlg.dllawjrvvduo6r~bn%nw&%ow)%ow)%ow)%ow)%o", Heuristic match: "07=7b7o7t7a7f7s7x78&8+858|8s)v_?)v_?0,0`0t0eauthdlg.dllo1hs5mxbycoompee].re2wwwwjnget_namesize2)2g2q2?=;(5.;kg%s}1e?=;(5.=%=5=|>l$(9l$(trset_formatid9#9(959:9g9l9y9^9k9p9}", Heuristic match: "virusthing2.eicar - copy - copy - copy - copy - copy - copy - copy - copy - copy - copy - copy - copy.com", Heuristic match: "virusthing2.my", Pattern match: "https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792614243865,"unified_at":"2026-10-21T20:24:03.865Z","metadata":{"hashes":{"sha256":"069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","sha1":"27fd764ff332fa0034c82e20093c0ae3f84bec80","md5":"0eb067a46e44b5cf228e5b0ee139f820"},"file_info":{"file_name":"069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1334038,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792610456000,"last_seen":1792610456000,"last_multi_scan":1792610456000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":22,"suspicious_count":0,"malicious_count":2,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Bodegun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/ATRAPS.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.114562","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Eicar-10040978-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.114562 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.WMO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"EICAR.Test.File.kjqc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005abed61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_accept_command_line_arguments","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/MSIL-VO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.FUL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.JBK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Diztakun.Win32.8941","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Able to access Windows Vault"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-625","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"GetStockObject\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CompareString\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"LoadLibraryA\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ShellExecuteExW\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"VirtualProtect\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CoInitialize\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"SetFocus\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$29","origin":"sample.bin","id":"string-170","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\You\\Desktop\\Hacking stuff\\virusthing\\obj\\Debug\\virusthing2.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\StartUp\\{0}.exe\" (Indicator: \"c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\{0}.exe\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1547.001","id":"string-265","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access Windows Vault","description":"file/memory contains long string with (Indicator: \"VaultGetItem\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VaultEnumerateItems\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"VaultOpenVault\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.004","id":"string-627","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559.001","id":"string-569","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetProcessesByName\" (Indicator: \"GetProcessesByName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"11.0.0.0\", \"17.6.0.0\", \"17.0.0.0\", \"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://docs.microsoft.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"Detected EICAR test file artifact","description":"\"X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" (Source: sample.bin, Indicator: \"eicar-standard-antivirus-test-file\"), \"X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" (Source: sample.bin, Indicator: \"eicar-standard-antivirus-test-file\"), \"DX5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" (Source: sample.bin, Indicator: \"eicar-standard-antivirus-test-file\"), \"X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*D\" (Source: sample.bin, Indicator: \"eicar-standard-antivirus-test-file\")","origin":"sample.bin","id":"string-22","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineArgs\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140":{"type":"File","value":"069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}}},"chains":[{"id":"1562546258069463907","root":"File:069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as malware by ClamAV antivirus"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 069679ce2dac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 069679ce2dac…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 069679ce2dac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 069679ce2dac…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/069679ce2dac5db28dae695b9ee8ae1f0b7870cc72335e7dbff8557291d12140"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 069679ce2dac… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 069679ce2dac…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 17/27 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]