Instagram Followers Generator

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PDF/Phishing Sample 1247e980ae09… — Score 94/100 — Hybrid Analysis","description":"Malicious verdict for sample 1247e980ae09…. Malware family: PDF/Phishing. Threat score 94/100. 1/26 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe","keywords":["Malicious","PDF/Phishing","malware analysis","sandbox report","threat intelligence","1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe"],"about":{"@type":"SoftwareApplication","name":"IBM-instagram-followers-generator-redeem-codes-6C84.pdf","applicationCategory":["pdf"],"identifier":"1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe","additionalType":"Malicious sample"},"threatScore":94,"malwareFamily":"PDF/Phishing","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb83,Object ID 6 contains compressed stream data: No filters Object ID 9 contains compressed stream data: No filters Object ID 37 contains compressed stream data: No filters Object ID 46 contains compressed stream data: No filters Object ID 49 contains compressed stream data: No filters Object ID 58 contains compressed stream data: /CIDInit /ProcSet findresource begin 16 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 63 contains compressed stream data: /CIDInit /ProcSet findresource begin 10 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 66 contains compressed stream data: /CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 69 contains compressed stream data: /CIDInit /ProcSet findresource begin 12 dict begin begincmap /CIDSystemInfo << /Registry (Adobe) /Ordering (UCS) /Supplement 0 >> def /CMapName /Adobe-Identity-UCS def /CMapType 2 def 1 begincodespacerange <0000> <FFFF> endcodespace ... Object ID 86 contains compressed stream data: \x00\x01\x00\x00\x00\x19\x01\x00\x00\x04\x00\x90DSIG\x99"\xba3\x00\x04L\x98\x00\x00\x1d\xc4GDEF\xb1?\xb3\xa1\x00\x02\xc1 \x00\x00\x034GPOSQ\xfc\x1d\xf3\x00\x02\xc4T\x00\x01\x1bdGSUB\xe9\x9df\xe1\x00\x03\xdf\xb8\x00\x00lZJSTFm*i\x06\x00\x04L\x14\x00\x00\x00 ... Object ID 88 contains compressed stream data: \x00\x01\x00\x00\x00\x19\x01\x00\x00\x04\x00\x90DSIG#\x86 \x12\x00\x04\xa6|\x00\x00\x1d\xc4GDEF\xb1?\xb3\xa1\x00\x03\x15p\x00\x00\x034GPOS\x83\xc6\xe8D\x00\x03\x18\xa4\x00\x01 \xf8GSUB\xfe\x0f\x14K\x00\x049\x9c\x00\x00lZJSTFm*i\x06\x00\x04\xa5\xf8\x00\x00\ ... Object ID 90 contains compressed stream data: \x80\x18\x00\x00\x04\x08\x80\x00\x00\x00\x00\x00\xc0 Object ID 92 contains compressed stream data: \x00\x01\x00\x00\x00?\x00\x80\x00\x03\x000OS/2\x15]^\xb0\x00\x00\x00\xbc\x00\x00\x00`cvt \xff\xc3\xadG\x00\x00\x01\x1c\x00\x00\x07`fpgm\xba'\x11\xa6\x00\x00\x08|\x00\x00\x06>glyf\x9d\xc8\M\x00\x00\x0e\xba\x00\x00\x07\xc4head\xe6\xaeP\xee\x00\x00\x16~\x0 ... Object ID 94 contains compressed stream data: \x80\x18\x00\x00\x04\x08\x80\x00\x00\x00\x00\x02@ Object ID 96 contains compressed stream data: \x00\x01\x00\x00\x00?\x00\x80\x00\x03\x000OS/2\x142]\x84\x00\x00\x00\xbc\x00\x00\x00`cvt \xad\xbf\xdf\x8e\x00\x00\x01\x1c\x00\x00\x06nfpgm8\xa5\x16+\x00\x00\x07\x8a\x00\x00?\xb0glyfrP\xa1\x1e\x00\x00\x13:\x00\x00?\x00head\xe6d<D\x00\x00\x1e:\x00\x00\x00 ...28:Tdab,Pattern match: "https://bestgames.pw/instagram/" Pattern match: "https://instagram-followers-generator-pro.blogspot.com/" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "https://instagram-followers-generator-pro.blogspot.com/favicon.ico" Pattern match: "https://instagram-followers-generator-pro.blogspot.com/feeds/posts/default" Pattern match: "https://instagram-followers-generator-pro.blogspot.com/feeds/posts/default?alt=rss" Pattern match: "https://www.blogger.com/feeds/3226504158924199429/posts/default" Pattern match: "https://www.blogger.com/profile/16846373095434200914" Pattern match: "fonts.gstatic.com/s/damion/v9/hv-XlzJ3KEUe_YZkamw2.woff2" Pattern match: "git.io/normalize" Pattern match: "https://www.blogblog.com/indie/mspin_black_large.svg" Pattern match: "https://www.blogblog.com/indie/mspin_white_large.svg" Pattern match: "https://themes.googleusercontent.com/image?id=L1lcAxxz0CLgsDzixEprHJ2F38TyEjCyE3RSAjynQDks0lT1BDc1OxXKaTEdLc89HPvdB11X9FDw" Pattern match: "https://www.gstatic.com/external_hosted/clipboardjs/clipboard.min.js" Pattern match: "http://www.w3.org/1999/xlink" Pattern match: "https://instagram-followers-generator-pro.blogspot.com/search" Pattern match: "https://www.blogger.com" Pattern match: "http://www.offset.com/photos/394244" Pattern match: "https://www.blogger.com/go/report-abuse" Pattern match: "https://resources.blogblog.com/blogblog/data/res/2215927059-indie_compiled.js" Pattern match: "https://www.blogger.com/static/v1/widgets/2009384843-widgets.js" Pattern match: "www.blogger.com/rearrange?blogID\x3d3226504158924199429','//instagram-followers-generator-pro.blogspot.com/','3226504158924199429" Pattern match: "https://www.blogger.com/static/v1/jsbin/3801281546-lbx.js" Pattern match: "https://www.google-analytics.com/analytics.js','ga" Pattern match: "https://browser.sentry-cdn.com/5.20.1/bundle.min.js" Pattern match: "https://ecc33db07c514172b5606edcabb2884e@o425163.ingest.sentry.io/5357949" Pattern match: "fonts.googleapis.com/css?family=Open+Sans:300" Pattern match: "fonts.googleapis.com/css?family=Open+Sans:400" Pattern match: "fonts.googleapis.com/css?family=Open+Sans:700" Pattern match: "https://d13pxqgp3ixdbh.cloudfront.net/assets/landing_pages/fa/css/font-awesome.min.css" Pattern match: "https://d13pxqgp3ixdbh.cloudfront.net/assets/landing_pages/jqueryui/jquery-ui.min.css" Pattern match: "https://d13pxqgp3ixdbh.cloudfront.net/assets/content_lockers/css_front.css" Pattern match: "https://d13pxqgp3ixdbh.cloudfront.net/assets/content_lockers/noty-2.3.8/demo/animate.css" Pattern match: "https://bucket.cpabuild.com/uploads/15001381031aafc94aa7194a3ad36b47548c67de48.png" Pattern match: "https://bucket.cpabuild.com/uploads/1483758197f16e604a99b6874dc2c73c3631786ace.jpg" Pattern match: "https://bucket.cpabuild.com/uploads/1491764858911074cc6c42d8e076bf983baa2edf09.png" Pattern match: "https://bucket.cpabuild.com/uploads/1500138458cf6bfec7e7ecb3479ee0d2c8e7f48fac.png" Pattern match: "https://ajax.googleapis.com/ajax/libs/jquery/1/jquery.js" Pattern match: "https://d13pxqgp3ixdbh.cloudfront.net/assets/landing_pages/jqueryui/jquery-ui.min.js" Pattern match: "https://d13nu0oomnx5ti.cloudfront.net/b43ffdb.js" Pattern match: "https://cldoffers.net/public/external/t.js" Pattern match: "https://d13pxqgp3ixdbh.cloudfront.net/assets/content_lockers/noty-2.3.8/js/noty/packaged/jquery.noty.packaged.js"29:T112e5," Instagram Followers Generator Chrome, Firefox OS and Opera --> Windows Phone --> Can't find substitution for tag [blog.ieCssRetrofitLinks]--> [if IE]>

Posts

" "_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '3226504158924199429', 'title': 'Instagram Followers Generator', 'url': 'https://instagram-followers-generator-pro.blogspot.com/', 'canonicalUrl': 'https://instagram-followers-generator-pro.blogspot.com/', 'homepageUrl': 'https://instagram-followers-generator-pro.blogspot.com/', 'searchUrl': 'https://instagram-followers-generator-pro.blogspot.com/search', 'canonicalHomepageUrl': 'https://instagram-followers-generator-pro.blogspot.com/', 'blogspotFaviconUrl': 'https://instagram-followers-generator-pro.blogspot.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': false, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': '', 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Instagram Followers Generator - Atom\x22 href\x3d\x22https://instagram-followers-generator-pro.blogspot.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22Instagram Followers Generator - RSS\x22 href\x3d\x22https://instagram-followers-generator-pro.blogspot.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22Instagram Followers Generator - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/3226504158924199429/posts/default\x22 /\x3e\n', 'meTag': '\x3clink rel\x3d\x22me\x22 href\x3d\x22https://www.blogger.com/profile/16846373095434200914\x22 /\x3e\n', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': true, 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/8e0dbfe852f62d6c', 'plusOneApiSrc': 'https://apis.google.com/js/plusone.js', 'disableGComments': true, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'Twitter', 'key': 'twitter', 'shareMessage': 'Share to Twitter', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 300, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': false, 'jumpLinkMessage': 'Read more', 'pageType': 'index', 'pageName': '', 'pageTitle': 'Instagram Followers Generator'}}, {'name': 'features', 'data': {'sharing_get_link_dialog': 'true', 'sharing_native': 'false'}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'Instagram Followers Generator', 'description': '', 'url': 'https://instagram-followers-generator-pro.blogspot.com/', 'type': 'feed', 'isSingleItem': false, 'isMultipleItems': true, 'isError': false, 'isPage': false, 'isPost': false, 'isHomepage': true, 'isArchive': false, 'isLabelSearch': false}}, {'name': 'widgets', 'data': [{'title': 'Search This Blog', 'type': 'BlogSearch', 'sectionId': 'search_top', 'id': 'BlogSearch1'}, {'title': 'Instagram Followers Generator (Header)', 'type': 'Header', 'sectionId': 'header', 'id': 'Header1'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'page_body', 'id': 'Blog1', 'posts': [], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': ''}]}, 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'comments', 'label': 'comments'}, {'name': 'icons', 'label': ''}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': ''}]}, {'regionName': 'footer3', 'items': [{'name': 'location', 'label': 'Location:'}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'timestamp', 'label': ''}, {'name': 'comments', 'label': 'comments'}, {'name': 'icons', 'label': ''}, {'name': 'labels', 'label': ''}, {'name': 'location', 'label': 'Location:'}]}, {'title': '', 'type': 'PopularPosts', 'sectionId': 'page_body', 'id': 'PopularPosts1', 'posts': []}, {'type': 'Attribution', 'sectionId': 'footer', 'id': 'Attribution1'}, {'title': 'About Me', 'type': 'Profile', 'sectionId': 'sidebar_top', 'id': 'Profile1'}, {'title': '', 'type': 'ReportAbuse', 'sectionId': 'sidebar_bottom', 'id': 'ReportAbuse1'}]}]);"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":94,"unified_at_epoch_ms":1792139567943,"unified_at":"2026-10-16T08:32:47.943Z","metadata":{"hashes":{"sha256":"1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe","sha1":"59a8a24412d0f3df24168071e374f6a9cd90b9c2","md5":"0c7412aef4982a9bd7df97fab70f683c","sha512":"9a1193d137e4c0a0cf204268fae21ebe7aa8f07f93f0c6a61eb696dfc98c2e662c0b39800383bf841a5bdc1d2f6dd08824cf8eb02659f78fce84daa3b01a1cce","ssdeep":"6144:LZ8eFoDGp1F8NlSr6yc6aCDP25RCQgSEO1Sr:LGeoGp7Gl2l+59NZ1K","ssdeep_chunks":["6144:LZ8eFoD","6144:Z8eFoDG","6144:8eFoDGp","6144:eFoDGp1","6144:FoDGp1F","6144:oDGp1F8","6144:DGp1F8N","6144:Gp1F8Nl","6144:p1F8NlS","6144:1F8NlSr","6144:F8NlSr6","6144:8NlSr6y","6144:NlSr6yc","6144:lSr6yc6","6144:Sr6yc6a","6144:r6yc6aC","6144:6yc6aCD","6144:yc6aCDP","6144:c6aCDP2","6144:6aCDP25","6144:aCDP25R","6144:CDP25RC","6144:DP25RCQ","6144:P25RCQg","6144:25RCQgS","6144:5RCQgSE","6144:RCQgSEO","6144:CQgSEO1","6144:QgSEO1S","6144:gSEO1Sr","12288:LZ8eFoD","12288:Z8eFoDG","12288:8eFoDGp","12288:eFoDGp1","12288:FoDGp1F","12288:oDGp1F8","12288:DGp1F8N","12288:Gp1F8Nl","12288:p1F8NlS","12288:1F8NlSr","12288:F8NlSr6","12288:8NlSr6y","12288:NlSr6yc","12288:lSr6yc6","12288:Sr6yc6a","12288:r6yc6aC","12288:6yc6aCD","12288:yc6aCDP","12288:c6aCDP2","12288:6aCDP25","12288:aCDP25R","12288:CDP25RC","12288:DP25RCQ","12288:P25RCQg","12288:25RCQgS","12288:5RCQgSE","12288:RCQgSEO","12288:CQgSEO1","12288:QgSEO1S","12288:gSEO1Sr","6144:LGeoGp7","6144:GeoGp7G","6144:eoGp7Gl","6144:oGp7Gl2","6144:Gp7Gl2l","6144:p7Gl2l+","6144:7Gl2l+5","6144:Gl2l+59","6144:l2l+59N","6144:2l+59NZ","6144:l+59NZ1","6144:+59NZ1K"],"imphash":"Unknown"},"file_info":{"file_name":"IBM-instagram-followers-generator-redeem-codes-6C84.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":335368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1598122017000,"last_seen":1644314917000,"last_multi_scan":1644314917000}},"detections":{"summary":{"verdict":"malicious","score":94,"tags":["phishing"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":11,"suspicious_count":4,"malicious_count":0,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PDF/Phishing.A.Gen trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"PDF/Phishing","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"tactic":"Defense Evasion","technique":"DCShadow","attack_id":"T1207","attack_id_wiki":"https://attack.mitre.org/techniques/T1207","identifiers":[{"type":"informative","value":"Contains object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains object with compressed stream data","description":"$27","origin":"Static Parser","mitre_attack_id":"T1207","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"General","name":"PDF contains only a single page","description":"Tag \"pages\" has a value of \"1\"","origin":"Static Parser","relevance":5,"id":"static-58","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"General","name":"PDF file has an embedded URL","description":"\"https://instagram-followers-generator-pro.blogspot.com/\" (Based on: \"1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe.bin\")","origin":"File/Memory","relevance":3,"id":"string-25","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"wscript.exe\" (UID: 00112687-00005048) was launched with missing environment variables: \"MEOW\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R18\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"\n \"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"AcroRd32.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 716)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"urlref_httpsinstagram-followers-generator-pro.blogspot.com\" has type \"HTML document ASCII text with very long lines\"\n \"A9R17ho_am1y5f_3lg.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\"\n \"data_1\" has type \"data\"\n \"Visited Links\" has type \"data\"\n \"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl\" has type \"data\"\n \"A9R1nox7ft_am1y5d_3lg.tmp\" has type \"data\"\n \"A9R1dseycd_am1y5e_3lg.tmp\" has type \"data\"\n \"A9Rxph4qg_am1y5b_3lg.tmp\" has type \"data\"\n \"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl\" has type \"data\"\n \"urlref_httpsbestgames.pwinstagram\" has type \"HTML document ASCII text with very long lines with CRLF LF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains embedded objects that might be interesting to investigate","description":"Embedded object type \"/ObjStm\" (ID: 6, References: 8 0 R,47 0 R,48 0 R,49 0 R,7 0 R,51 0 R,52 0 R,43 0 R,42 0 R,39 0 R,41 0 R,38 0 R,40 0 R,53 0 R)\n Embedded object type \"/ObjStm\" (ID: 9, References: 13 0 R,12 0 R,11 0 R,15 0 R,21 0 R,14 0 R,16 0 R,17 0 R,18 0 R,19 0 R,20 0 R,24 0 R,25 0 R,26 0 R,27 0 R,28 0 R,29 0 R,30 0 R,31 0 R,32 0 R,33 0 R,34 0 R,35 0 R,10 0 R,13 0 R,8 0 R,14 0 R,16 0 R,17 0 R,18 0 R,19 0 R,24 0 R,25 0 R,26 0 R,27 0 R,28 0 R,29 0 R,30 0 R,31 0 R,32 0 R,33 0 R,34 0 R,35 0 R,23 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,21 0 R,13 0 R,8 0 R,22 0 R,23 0 R,20 0 R,8 0 R,47 0 R,8 0 R,21 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R,13 0 R,8 0 R)\n Embedded object type \"/ObjStm\" (ID: 37, References: 55 0 R,56 0 R,57 0 R,58 0 R,60 0 R,61 0 R,62 0 R,63 0 R,65 0 R,66 0 R,68 0 R,69 0 R,36 0 R)\n Embedded object type \"/ObjStm\" (ID: 46, References: 71 0 R)","origin":"Static Parser","relevance":5,"id":"static-10","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1140","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/78 reputation engines marked \"http://purl.org\" as malicious (1% detection rate)\n 1/79 reputation engines marked \"https://bestgames.pw\" as malicious (1% detection rate)\n 1/78 reputation engines marked \"http://purl.org/dc/elements/1.1\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"ecc33db07c514172b5606edcabb2884e@o425163.ingest.sentry.io\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"extra_0.bin\" contains indicator \"document.getElementById\" (Line: 368; Offset: 8)","origin":"Binary File","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":45,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["phishing"],"sample_flags":["Multi-Process","Extracted Files","Carved Files"],"sandbox_reports":[{"id":"5f4168204c1feb34793751f2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":94,"submit_name":"IBM-instagram-followers-generator-redeem-codes-6C84.pdf","analysis_start_time":"2020-08-22T18:47:01+00:00","indicators_count":{"informative":11,"suspicious":4,"malicious":0},"tags":["Multi-Process","Extracted Files","Carved Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}],"processes":[{"pid":4660,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\IBM-instagram-followers-generator-redeem-codes-6C84.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","uid":"00110433-00004660","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="},{"pid":5048,"ppid":0,"name":"wscript.exe","command_line":"\"C:\\extra_0.js\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00112687-00005048","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="}],"all_imported_dlls":["winnsi.dll","BIB.dll","ACE.dll","AcroRd32Res.dll","apphelp.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","nlaapi.dll","dhcpcsvc6.dll","secur32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","dhcpcsvc.dll","kernel32.dll","psapi.dll","msimg32.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","advapi32.dll","IPHLPAPI.DLL","oleaut32.dll","wsock32.dll","cryptocme.dll","npmproxy.dll","cryptbase.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","GdiPlus.dll","ccme_asym.dll","usp10.dll","wshqos.dll","rsaenh.dll","dui70.dll","WSHTCPIP.DLL","WSDApi.dll","msvcrt.dll","cryptsp.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","mscms.dll","shlwapi.dll","ntmarta.dll","dnsapi.dll","FWPUCLNT.DLL","version.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","urlmon.dll","ccme_ecc.dll","clbcatq.dll","nsi.dll","AcroRd32.dll","ws2_32.dll","devobj.dll","ole32.dll","AXSLE.dll","propsys.dll","BIBUtils.dll","normaliz.dll","gpapi.dll","sechost.dll","shell32.dll","msctf.dll","profapi.dll","tzres.dll","duser.dll","ieframe.dll","gdi32.dll","msvcp120.dll","mswsock.dll","comctl32.dll","CoolType.dll","crypt32.dll","winmm.dll","Wldap32.dll","KernelBase.dll","user32.dll","uxtheme.dll","RpcRtRemote.dll","SensApi.dll","cfgmgr32.dll","sspicli.dll","wininet.dll","winhttp.dll","imm32.dll","msvcr120.dll","msasn1.dll","AXE8SharedExpat.dll","iertutil.dll","userenv.dll","webio.dll","ccme_base_non_fips.dll","ExplorerFrame.dll","sqlite.dll","netprofm.dll","rasadhlp.dll","AGM.dll","dwmapi.dll","ntdll.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","ccme_base.dll","lpk.dll","rpcrt4.dll","setupapi.dll","wship6.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"A9Rxph4qg_am1y5b_3lg.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"extra_0.bin","sha256":"4cfc5c5f1077caa2b45a67b0270c9d52bb469fbb9c80ea463c5e51cb5142253d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"urlref_httpsinstagram-followers-generator-pro.blogspot.com","sha256":"94ba015cdee54f97a5b5b1778b730e52bfb1f6a0a2a5b56ca03a8807e4af7c53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"A9R17ho_am1y5f_3lg.tmp","sha256":"42a850147cf596396bede5dab89e19580c09b58b610ece5e525b37618b4826d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"data_1","sha256":"1369588316e9743f15e494c9e4e87b9ee34e61946f8a182d8738dab5fc30e6fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"A9R1nox7ft_am1y5d_3lg.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"A9R1dseycd_am1y5e_3lg.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"9009ab7605c35a2b5121b8b5c966b3c893edba9966925268c45ad05b348671c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"urlref_httpsbestgames.pwinstagram","sha256":"ace52d7d348dae782e498ddd110a8f13297051292690315524e66f4aa9f3d05a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]}],"files_written":[{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:\\IBM-instagram-followers-generator-redeem-codes-6C84.pdf","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeComFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\AcroForm.api","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\weblink.api","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\DigSig.api","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%TEMP%\\A9Rxph4qg_am1y5b_3lg.tmp","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%TEMP%\\A9R1t8tmv6_am1y5c_3lg.tmp","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"path":"pipe\\com.adobe.reader.rna.3f14T2c.DC.0","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5f4168204c1feb34793751f2"}]}]}},"report_ids":{"sandbox_job_ids":["5f4168204c1feb34793751f2"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious PDF/Phishing Sample 1247e980ae09… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1247e980ae09…. Malware family: PDF/Phishing. Threat score 94/100. 1/26 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe"}],["$","meta","4",{"property":"og:title","content":"Malicious PDF/Phishing Sample 1247e980ae09… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1247e980ae09…. Malware family: PDF/Phishing. Threat score 94/100. 1/26 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1247e980ae09c104238398d3c8d5c0d484a40eab3aa65c794dd85b8d1c858bbe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious PDF/Phishing Sample 1247e980ae09… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1247e980ae09…. Malware family: PDF/Phishing. Threat score 94/100. 1/26 AV engines flagged this file. 0 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]