21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TSPY_DRIDEX.EZ Sample 0cb971685a82… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 0cb971685a82…. Malware family: TSPY_DRIDEX.EZ. Threat score 86/100. 19/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183","keywords":["Malicious","TSPY_DRIDEX.EZ","malware analysis","sandbox report","threat intelligence","0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183"],"about":{"@type":"SoftwareApplication","name":"favicon.exe","applicationCategory":["peexe","executable"],"identifier":"0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"TSPY_DRIDEX.EZ","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T48e,"" loaded module "KERNEL32.DLL" at base 76000000 "" loaded module "NORMALIZ.DLL" at base 76320000 "" loaded module "CRYPT32.DLL" at base 75740000 "" loaded module "USERENV.DLL" at base 74BF0000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76170000 "" loaded module "WINTRUST.DLL" at base 75710000 "" loaded module "WININET.DLL" at base 75E70000 "" loaded module "RASAPI32.DLL" at base 72F90000 "" loaded module "RTUTILS.DLL" at base 73B60000 "" loaded module "RASMAN.DLL" at base 72F70000 "" loaded module "PROFAPI.DLL" at base 75590000 "" loaded module "SHLWAPI.DLL" at base 76480000 "" loaded module "SENSAPI.DLL" at base 6B410000 "" loaded module "RPCRT4.DLL" at base 76270000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76170000 "" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 73A60000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 7617000023:T4e6,Found API call GetLocalTime@KERNEL32.dll (Target: "favicon.exe.bin"; Stream UID: "18001-49-00419635") which is directly followed by "cmp ecx, eax" and "jbe 00419684h". See related instructions: "... +-243 mov dword ptr [esp], 0042BB6Ah +-236 call dword ptr [0042D1D0h] ;GetLocalTime +-230 sub esp, 04h +-227 movzx eax, word ptr [esp+000058CEh] +-219 mov dword ptr [esp+000058E4h], FFFFD820h +-208 add eax, 00004433h +-203 mov cl, bl +-201 shl cl, 06h +-198 mov byte ptr [esp+000058E9h], cl +-191 movzx eax, ax +-188 movzx ecx, word ptr [esp+20h] +-183 cmp ecx, eax +-181 jbe 00419684h" ... at 18001-49-00419635 Found API call GetLocalTime@KERNEL32.DLL (Target: "favicon.exe"; Stream UID: "00140796-00004052-34442-7-00419635") which is directly followed by "cmp ecx, eax" and "jbe 00419684h". See related instructions: "... +-243 mov dword ptr [esp], 0042BB6Ah +-236 call dword ptr [0042D1D0h] ;GetLocalTime +-230 sub esp, 04h +-227 movzx eax, word ptr [esp+000058CEh] +-219 mov dword ptr [esp+000058E4h], FFFFD820h +-208 add eax, 00004433h +-203 mov cl, bl +-201 shl cl, 06h +-198 mov byte ptr [esp+000058E9h], cl +-191 movzx eax, ax +-188 movzx ecx, word ptr [esp+20h] +-183 cmp ecx, eax +-181 jbe 00419684h" ... at 00140796-00004052-34442-7-0041963524:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")25:T11c5,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")26:T59c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAPKSURBVFhH7ZdpTFRXFMcvKhhABxcyKVZDoURbWqGVIBRTS+vSUFtNQ9LETyY0JbLLEstuky6GGJu2EafszEBotN+KW9vU2JjUUorIFAqzAGpr8IPA2ESbuv09Z+598ualRlOW+dKb/HPOvfe8e37vvDv3zRPi/+b3CpQ4EVo6gMiP3DB/4IapyoXFFS6ElrsQQlpU6UIw+2UumCp53o0w0vJ9LBeWVFNshZPinBTnRFCZA6J40KuFZU6IEvJLhiAqLkFUjSGg8k+IvF9B982ilt+D2BoX3vlqHC83ebCh0YNXyCY1XEfCl+S3XEe8ZQLxhyeQ3MDjHiTWT2B9vcertbWTWP3FJGIPebDm83FEfTqO58jna2M+G0dC3V9IbL6BpNqr2HXgDDYcGEBgqQMBpicUROZpiJxuorKT7YPIZ12QNq8P8wrtmF8kFViozfNcr1SuGisgW0D9rF6kWq4g42sPRHYv3rZew2bbTWzMbMTd7DjsL6r2xkVGRiqAnZ0Qbx6B2GqD2NQCsYW0WVnua+Ixzd/S6jvO12ja1AyR1g6RfhQitQnijQ7qk15rhSmtBmIbXbvzO5jNZgmwsqof50fd+GHAiW/tDqnfyGfZldX63jGeV3HeeBXntQ6corkTvUPo7PkdJ/scOE7+MVbfMI7a/8BZ9wiSDvZjWbgCiP1kBHPd3j0yBrFwqaxAzL5BXf5b5M+W7j7Ik9F2WQdQYTcAaN1/HgHD8yxud5RvhL+txvUWyGi7OAWwuvyCDkBb9FHJ9Ym0a/4tOd81J7+ngwXes41OAawp7VEAWtDDFpzOo9FXC8i0DhPAErkHYt/vNlSAy8lictZ0EhsrJVPtbnZNATy/t8uwB5iWE+tBZgqC1wSymui41iqwtvgnQwW0ZLPxKHhtILuR3g9B6hHEFZ19CMBM3bV+Ha4skNMwQABhcg/4DWDRSgnwwp4f57wCufX04gtVAC8WnJ5zgLw6etuGPikrkJj//RycA9o+kHsg33IeIkQBrM89qQOYrZ+fL0DhYfpHpAEkZR1XAHxscqB2DszkIeQLUFT7CwGskI8gZXenApiNg8f4U5YHUfGhnyGCIyRAavY3uk3I7wO9dFM+48a4x+3L9cot5xCgPYJXc4/psxh8voO/SXLzTL/J/wTFli4Ehj0tK7BqmxXPpHcgZkc7orbbfBS93Yrot1pJbG3/TbSmXKOVcljxbHo7oilXkGmVBHjq9VpEbKyBOeVjhL/0IcKTdeJ+yszLvC4L8xYEP/g20Bx/We/nib+Sq68jv38f+hHgPgcYkjjijgXLAAAAAElFTkSuQmCC18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1790621469461,"unified_at":"2026-09-28T18:51:09.461Z","metadata":{"hashes":{"sha256":"0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183","sha1":"655bccc9f20aada1bf9dedebc2afca46d9286a92","md5":"5046b7858f5983db564ece8ba36c281b","sha512":"7d2b9e2010c747bd563895e0ef60a6b86c5ce7ebc8b4ef2db09f39c67fb8a20ddebd762443fa4a0f476637dbcfdbb82a2b9a888801d87bc2660b37d4bb2e1983","ssdeep":"3072:tW5qirEB1DgYWLtUjaHPgHQhUnVszYIUb5RwhGk:kqirg1JSMmXhAVszYIUb7whG","ssdeep_chunks":["3072:tW5qirE","3072:W5qirEB","3072:5qirEB1","3072:qirEB1D","3072:irEB1Dg","3072:rEB1DgY","3072:EB1DgYW","3072:B1DgYWL","3072:1DgYWLt","3072:DgYWLtU","3072:gYWLtUj","3072:YWLtUja","3072:WLtUjaH","3072:LtUjaHP","3072:tUjaHPg","3072:UjaHPgH","3072:jaHPgHQ","3072:aHPgHQh","3072:HPgHQhU","3072:PgHQhUn","3072:gHQhUnV","3072:HQhUnVs","3072:QhUnVsz","3072:hUnVszY","3072:UnVszYI","3072:nVszYIU","3072:VszYIUb","3072:szYIUb5","3072:zYIUb5R","3072:YIUb5Rw","3072:IUb5Rwh","3072:Ub5RwhG","3072:b5RwhGk","6144:tW5qirE","6144:W5qirEB","6144:5qirEB1","6144:qirEB1D","6144:irEB1Dg","6144:rEB1DgY","6144:EB1DgYW","6144:B1DgYWL","6144:1DgYWLt","6144:DgYWLtU","6144:gYWLtUj","6144:YWLtUja","6144:WLtUjaH","6144:LtUjaHP","6144:tUjaHPg","6144:UjaHPgH","6144:jaHPgHQ","6144:aHPgHQh","6144:HPgHQhU","6144:PgHQhUn","6144:gHQhUnV","6144:HQhUnVs","6144:QhUnVsz","6144:hUnVszY","6144:UnVszYI","6144:nVszYIU","6144:VszYIUb","6144:szYIUb5","6144:zYIUb5R","6144:YIUb5Rw","6144:IUb5Rwh","6144:Ub5RwhG","6144:b5RwhGk","3072:kqirg1J","3072:qirg1JS","3072:irg1JSM","3072:rg1JSMm","3072:g1JSMmX","3072:1JSMmXh","3072:JSMmXhA","3072:SMmXhAV","3072:MmXhAVs","3072:mXhAVsz","3072:XhAVszY","3072:hAVszYI","3072:AVszYIU","3072:szYIUb7","3072:zYIUb7w","3072:YIUb7wh","3072:IUb7whG"],"imphash":"6da12920be225406d70b9a0b09a4ec3d"},"file_info":{"file_name":"favicon.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":329728,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294845000,"last_seen":1678349713000,"last_multi_scan":1678349713000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":20,"malicious_count":5,"total":36},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.wzhn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.44043","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Agent.AKT.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.44043 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.EVXV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055dd191 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.ebvzrz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-TK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Yakes.329728.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.EZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.EZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt_r.BXH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agentb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.876942","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TSPY_DRIDEX.EZ","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 18001-49-00419635\n GetLocalTime@KERNEL32.DLL at 00140796-00004052-34442-7-00419635","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"103.245.153.154:4033\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\Cab7C79.tmp\"\n \"\" created file \"%TEMP%\\Tar7C8A.tmp\"\n \"\" created file \"%TEMP%\\Cab80E0.tmp\"\n \"\" created file \"%TEMP%\\Tar80F1.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"{7913a425-27a5-4c91-d161-788a0fb145a1}\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$22","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"AddMandatoryAce@ADVAPI32.dll\"\n \"wvnsprintfA@SHLWAPI.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"\n \"CPImportKey@rsaenh.dll\"\n \"CPEncrypt@rsaenh.dll\"\n \"CPDecrypt@rsaenh.dll\"\n \"CPCreateHash@rsaenh.dll\"\n \"CPHashData@rsaenh.dll\"\n \"CPHashSessionKey@rsaenh.dll\"\n \"CPDestroyHash@rsaenh.dll\"\n \"CPSignHash@rsaenh.dll\"\n \"CPVerifySignature@rsaenh.dll\"\n \"CPGenRandom@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00140796-00004052-774A228D-154783","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab7C79.tmp\" has type \"Microsoft Cabinet archive data 50006 bytes 1 file\"\n \"Tar7C8A.tmp\" has type \"data\"\n \"Cab80E0.tmp\" has type \"Microsoft Cabinet archive data 50006 bytes 1 file\"\n \"Tar80F1.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00140796-00004052-774A228D-153923","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$23","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00140796-00004052-774A228D-146625\n RasPortListen@RASMAN.DLL at 00140796-00004052-774A228D-153629","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\favicon.exe\" marked \"%TEMP%\\Cab7C79.tmp\" for deletion\n \"Z:\\favicon.exe\" marked \"%TEMP%\\Tar7C8A.tmp\" for deletion\n \"Z:\\favicon.exe\" marked \"%TEMP%\\Cab80E0.tmp\" for deletion\n \"Z:\\favicon.exe\" marked \"%TEMP%\\Tar80F1.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\Cab7C79.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar7C8A.tmp\" with delete access\n \"\" opened \"%TEMP%\\Cab80E0.tmp\" with delete access\n \"\" opened \"%TEMP%\\Tar80F1.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"favicon.exe.bin\" claimed CRC 1430034272 while the actual is CRC 369940","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"FindWindowW\n LoadLibraryExW\n GetComputerNameA\n FindNextFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"favicon.exe.bin\" claims program is from Wed Mar 22 10:16:28 2017","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/56 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 103.245.153.154 on port 4033","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\"; Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$25","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00140796-00004052-774A228D-164593","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\7D7F4414CCEF168ADF6BF40753B5BECD78375931\"; Key: \"BLOB\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00010862-00003880-60909-134-00403CB0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00010862-00003880-872-134-00403CB0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00010862-00003880-5592-134-00403CB0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":110,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":27,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"571f62130e316d6c420c0a53","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"QVM20.1.Malware","contacted_countries":["AUS"],"submit_name":"favicon.exe","analysis_start_time":"2016-04-26T07:43:05+00:00","indicators_count":{"informative":8,"suspicious":26,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"571f510d0e316d124c5e0e82","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"QVM20.1.Malware","contacted_countries":["AUS","CZE","DEU","VNM"],"submit_name":"favicon.ico","analysis_start_time":"2016-04-26T06:29:42+00:00","indicators_count":{"informative":8,"suspicious":29,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"103.245.153.154","port":4033,"protocol":"TCP","country":"Australia","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"address":"176.9.113.214","port":8043,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"address":"210.245.92.63","port":4043,"protocol":"TCP","country":"Viet Nam","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"address":"213.192.1.171","port":40443,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}],"processes":[{"pid":4052,"ppid":0,"name":"favicon.exe","command_line":"","normalized_path":"Z:\\favicon.exe","uid":"00140796-00004052","icon":"$26"}],"all_imported_dlls":["shell32.dll","rsaenh.dll","wintrust.dll","ws2_32.DLL","credssp.dll","GPAPI.dll","WINHTTP.dll","MSCTF.dll","USERENV.dll","NLAapi.dll","DEVRTL.dll","OLEAUT32.dll","winrnr.dll","secur32.dll","SspiCli.dll","kernel32.dll","ole32.dll","LPK.dll","USER32.dll","bcryptprimitives.dll","cryptnet.dll","RASAPI32.dll","wshqos.dll","schannel.DLL","VERSION.dll","ADVAPI32.dll","CRYPTBASE.dll","profapi.dll","CRYPT32.dll","iphlpapi.DLL","wshtcpip.DLL","USP10.dll","msvcrt.dll","CRYPTSP.dll","mswsock.dll","wship6.dll","dhcpcsvc.DLL","RPCRT4.dll","rasman.dll","napinsp.dll","dnsapi.DLL","dhcpcsvc6.DLL","comctl32.dll","rtutils.dll","ncrypt.dll","NSI.dll","MPRAPI.dll","SETUPAPI.dll","PSAPI.DLL","sechost.dll","ntdll.dll","KERNELBASE.dll","IMM32.DLL","ntmarta.dll","wininet.dll","Normaliz.dll","rasadhlp.dll","urlmon.dll","Cabinet.dll","DEVOBJ.dll","GDI32.dll","pnrpnsp.dll","pdh.dll","CFGMGR32.dll","sensapi.dll","SHLWAPI.dll","usp10.dll","devrtl.dll","sspicli.dll","msasn1.dll","IPHLPAPI.DLL","dhcpcsvc6.dll","schannel.dll","cabinet.dll","KernelBase.dll","crypt32.dll","rpcrt4.dll","nsi.dll","rasapi32.dll","winhttp.dll","cryptbase.dll","dnsapi.dll","cryptsp.dll","iertutil.dll","bcrypt.dll","user32.dll","msctf.dll","SensApi.dll","webio.dll","gdi32.dll","shlwapi.dll","Wldap32.dll","winnsi.dll","userenv.dll","dhcpcsvc.dll","NapiNSP.dll","WSHTCPIP.DLL","gpapi.dll","setupapi.dll","imm32.dll","ws2_32.dll","devobj.dll","advapi32.dll","mprapi.dll","normaliz.dll","cfgmgr32.dll","FWPUCLNT.DLL","lpk.dll","oleaut32.dll","nlaapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Cab7C79.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Cab80E0.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Tar7C8A.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Tar80F1.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"2b73ab9db5e1597c48c412f97e233b922a215c527251171aa8e76d3de7ba8bff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"CabDC4C.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"CabDF2D.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"CabFD84.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"TarDC5D.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"TarDF2E.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"TarFD85.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}],"files_written":[{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"},{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"{7913a425-27a5-4c91-d161-788a0fb145a1}","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f62130e316d6c420c0a53"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{3e0245e3-f830-0dae-1136-031283ff342c}","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"571f510d0e316d124c5e0e82"}]}]}},"report_ids":{"sandbox_job_ids":["571f510d0e316d124c5e0e82","571f62130e316d6c420c0a53"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious TSPY_DRIDEX.EZ Sample 0cb971685a82… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0cb971685a82…. Malware family: TSPY_DRIDEX.EZ. Threat score 86/100. 19/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183"}],["$","meta","4",{"property":"og:title","content":"Malicious TSPY_DRIDEX.EZ Sample 0cb971685a82… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0cb971685a82…. Malware family: TSPY_DRIDEX.EZ. Threat score 86/100. 19/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0cb971685a8229b9c8a5c8302804f09b6c1a73dcde1cfa842323e5c1e5bd7183"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TSPY_DRIDEX.EZ Sample 0cb971685a82… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0cb971685a82…. Malware family: TSPY_DRIDEX.EZ. Threat score 86/100. 19/28 AV engines flagged this file. 5 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]