26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4be,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 20126cfd36ca… — Score 68/100 — Hybrid Analysis","description":"Malicious verdict for sample 20126cfd36ca…. Malware family: Win/malicious_confidence_100%. Threat score 68/100. 14/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15"],"about":{"@type":"SoftwareApplication","name":"sysjar.bin","applicationCategory":["peexe","executable"],"identifier":"20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15","additionalType":"Malicious sample"},"threatScore":68,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tf3c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAsASURBVFhHnZfrT5vpmcaRKlX7pR9W+0fs9ks/7Ha7atWsVHVUVe1uNdqOttOoM9nJTJNMyAQSAoSTOYVDDJhwigFz8BHbmHA0YDABGzAGYxuwDcYnMKdwPmQmM/346/MSTUfdne6ktXRLL/bLc1/39Vz3c19PSsobfj799FN2d3cJhULMz88zPT3N1NQUk5OTOBwOZmdn8Xq9xONxTk5OeMNlv/m109NT1tbWGB0eRlXfQJ0sh/r8NJoK79BW/gnaqnsYFCWo5SW0VspoUVTQbdAKkG729vb+diCvXr1iY2ODEesw9RWPkT+4z9OKe+j19+mzFWCbLWfSV8tsUEUk4icSCrDimWNqyIKh6TFKeSFd2k6Wl5c5Ozv764BIVUt0qpQtFH98l6aye1gGSxj3tuCNDbG+62bzIMDOUZi9kzinZ8eXSU7E/+3v7xONR/DMPmdAU0+zohT7+Nibs3FwcMD4+DhlOUU8Sr3Ds94KZlb0rG3PsHO4ztHZHidnB5yeH4o44uz8mIuLc16+fHkZFyLOz88vdbC7s43HMUR7XTFmo/6S0f9306XKpeSlD4uoyZfRP1yNN9zP1qaXo8MkJ8d7HB1sc3S0w+FOgoPdOEf7m5ydHHG6t8vF2SlnhwKceD4RyU9FMS+EDjyucVpqcjF1aS+F/LUgPvvss0vaywvKqMovZniiHX9UUJfwsdFvZGdqjMNwgG23g80JK/EBI9uL08R6tLxY8RLVtnIUjxLRtLIzM0XMrCXQVC0YOmdHgHFO9KKsycFmG/36LkkkErSp2nn4USZd3ZXMBPQcnGxyEltjVSzkK7hPzKQm2tdFcn6KVa2SVaOKte4OktMTuG6/z65/kXivmUhXJ/7aCpbMerE9F0jMJjfjOMwNNFaV4Pf7+OKLL75iQnphZGSEjFtZNCrL6Hcr8K0Pcv7yBQdBL15lDb1Zdyj98b8w2dGMtTCTvoJ0ZjrrKPv+d5kS35Vc+T4h1wzNb/+MBYuR1hvXyH7ryiWAC8HCYTJBeFRPT30eBtEdOzs7XwFYXV1FUfWEjJsPaB3LpW+xFn98lOOLLfaifryDJsJLbnKuvsNEfzc2QxtNOWmYmipRZKXiGB5Adv19QqKyzuICzPW1KAtyMNTVvgZwuM9J0MPmpAmHrpzWmmJcLtdrAJJyR0dHybiTQ5EQSruriAFfK4sxOy9Ei128OuDVH874/A8XfPbqXOzpIXtHG2wfRtjcXxXtGOLoRAhPsCiF1I5fxrl4PheivIivchaYY3+un6Ctke6mQiFIvRDzESkSFS3Nrdz+6CGllkyUc0WYvA3YV82i3xc4ON3i9OU+Zy+lljti/3hbJF4n8SJE7EWA6N4KB0cvOD4+uRTXl3F6eiK6YI+LWIDzdR+nwRmOfSMkZ9U4LDWomp6wvr5OSjAY5FFxJe/dzuQ33alcsxdwf/oJ1R4DpuA47s0Aod0Ekb0dQlvbLEQTuMIxJldD2II+hkMeJpaWsC+6sXunsfvGGVu0Yp1+RvdQJ/r+dlSWdqo0KgpaWvmkSsnVh3XczXnMzMwMKdJgyc0u4mrGPd4x3+Dd8TxuORXkuTuo9w9gXHMyEltiajOCYzPJeGKboegmfZEY3ZEQxugyOrsdzaCZ9iE1raOdNPSoUXSpeWzQUKLTkN2uJrVJzYd1nbxT3s6Ve628ffsJVquVFGmqZd6XcaswnftDv+cTZy5ZrmrKFttoWLbQEbJiWnfSH/MyFA8wIHrdFEnQFd7AGF5HF/ahsfWjEtU29HVSLVqwQq+mvEvDIxEyvYYstYa0Ng2pKjXX6jp4K6eVt37fQE9PDynSSM1ILyRVfpeMsZvIXHk8XqxGudyBRujALNqxTwhyMOFkIOFiaMNLnwBijkZRrycxRlZoGTdSO6hGbtFQIaJMHE5lz3SU9uiQdWvJNWnJEhPynlbDB8pOfl7YypUPmzCZTKRI8zwjXcZdASDffovHAkCz9wn6FTW9az2MRkeZiD8X9M8wm5zHlfQyt7UsnoM4oquMRTx0LVgwLprQL5rpcJlpmjLSOGmkQbTdE7uRagGwcrQLWb+Ojzs7+Y9HKn5yq+U1AMlMZN4v4EZJOncHbpHtlFHmaaR+SScYGBB0j9MTddAfdTOaWGIsvsZYKM5oIMnwckSIcJnxOQeOxVHsHgujXhNWAcY8Y0DrNKCa1PN0XE+dTU+VVUe2oZNfV7TxqzTl6y2QnMzDzAKupaXzfttNbvcXk2NvpnLGjFIs2uafwrCywLOlFUaDUYYDWzzzxOhfjtO3HKYvEGJgzod1xoHLN8n8yghOfw82j4nBBSOWuS60U3qxTQLAgACg6eS3lW28n1nPsDA5KdIAKiwo5r3r6fy68Aa/ayvhtrmVgpFeFFPPaZ1bEOfCqki2wVhwh4nQDsXGYXoCh5h9+zydOCCz95CfZlajE3sdCC+yGHrO3MqgAGJhzGumf96IftJA3aCOB+2dvFvaRrpMmBlRfEosFkOhUPDh9Ux+mXWT/3xawoeihYpGbDQ6F9C41+j2bWBdERMtvMtMdJu6nnEmNqA/DE1u+HgY/undDEofPWJ1PcjKmgdf0MnC0gjTXgvjHjPPpg00Cg1kNLfzXnEL8lqlcFIRUo6Pjy/FcCf1Pv+d9oBf1VVyQ2+hZHiGJscKhvkYff4kttA2c/FdFjf3aOy1i/MAIVJolABY4R8FgPLySqKJOOtCnMGwF3/AyZzPyqTQRq/DQL1Fy506FTdlTXR1GV8fxdLH7XZTVFjM9ZtZQiA1XO/spaBvjsaJID1ivwcF/c/DW3g2d7HHtqjodYouQWgEUkX1/9wO/3C1mKzqetZEVbFElHBEMBFaYN4/wXN3L91CA3IxBW+WtyErU3w1jCQA0jzQ6XTcuZ3OB3lPuKo0kdU9Sf2Yn17Putj7BI5IEv/WHtcGnfyi/5C3B+F7Gvh2LaQoRNQf8J1sBQ1NSpE8QjgaZmXVj9vvwCaO5c4+LYXKdu7I6tFodX8+jiUQfr+fyspKUu8W8D+PVXys7UduncXsDmAX6p+PJ1nZ3uO5Z5EfVov+fXpMSrNILMXTC77922z+9Qf/xsDAkDClCdZiEaEDPw73BBarCYXo/wx5B4/lNcKQ+P+vLZOmmM1mIyszm9TsR9ys15DXLdpwaoFBf5D52AZrO3skDg6xzy/wE7mOb7Uc8C3lPn/3X2lc+enPRF/3CeO5RTSWYFkMOdfCHEMjfTRr1eTVqMgtrGBsbOwvX1y2t7eF79eT8SCb9IIa7jXrkA/ZMbg8PA+tsSSGUezFPpuHh0wuePj38g7+/jdp/OBHP75MnkzuiZvRFsFgmDm3RxQ0htagp1jRRl5x1aXY/6Ip/dKpSq2h1Wp58CCLNOGOZR1maq1jYisWcKyusZxMEhbONi78//DEBB989BF6g1kk3iYhJuVKYJ05l5eRYTs6QzfF1W3kysowGo3i98SbXVCSIsnQ0BAlJSXcvfeAnJpGqnoH0Did2MTsnxVGwrshaE5uEhCxEojj864zPxdkwu7GYrGjaBRCzpNTUfGa9m+s/H979UNBs+QVVCoVefnCpGTnkq+oo8ZkRi3uDpbZGYYWFxj2ehgcnqe724labRUHjE5ULKeopEz8rcbn8/3tl9XPP//88jYjDSxpsfLycnLy8snKFyErIKeokJziIh7mlogoJV9Wilwux2AwXB6zkqb+zH5/813469+QFpHufNLVXPIPg4ODgmbLpaikkJ4ldyOZG8nn/emEe4OEfwSfLmOEAmgujQAAAABJRU5ErkJggg==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAA/4iIiIiI8AAAAAAAAAAA+Id3d3d3d4j/AAAAAAAAD4d3d4iIiId3ePAAAAAAAPh3eIiIiIiIh3ePAAAAAAiHd4iI/4eIiIiHeIAAAAD4d3iIj/hmCPiIiHePAAAPh3d4iI+H5maIiIh3ePAACHd3iIiIbu7mCIiIh3eAAPh3d4iIh+7u5meIiIh3jwCHd3iIiIiIiOZ4iIiId3gPh3d4iIiIiIiGeIiIiHd4+Hd3eIiIiIiIhniIiIiHd4h3d3iIiIh4iIeIiIiIh3eId3d4iIiIiIiIiIiIiHd3iHd3iIiIiIiIiIiIiIiHd4h3d4iIiIiIiIiIiIiId3eId3d4iIiIiIiId3d3d3d2iHd3eIiIiIiIiId3d3d3d4h3d3eIiIiIiIiId3d3d2eId3d4iI+IiIiIiIiIh3d3j3d3iI///4iI////+IiIh4+HeIj/////iP/////4iHjwh3eI+Ih4h3eHh3d/+Ih4APh3iPiHGHeBgYeHP/+HjwAId3j4h4iIiIeIiI/4h48AD4d4iIiIiIiI+IiP+HjwAAD4d4iP/////////4ePAAAAD4d4iP////////h4gAAAAAD4d3eIiP///4iHjwAAAAAAD4h3d4iIiIh3iPAAAAAAAAAPiHd3d3d3iPAAAAAAAAAAAA/4iIiIiPAAAAAAD/gAP//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD//AAD//8AD/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":68,"unified_at_epoch_ms":1790439307643,"unified_at":"2026-09-26T16:15:07.643Z","metadata":{"hashes":{"sha256":"20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15","sha1":"319cef01ffc2057ae1814da15b65d2e60058ca3b","md5":"eb2cde846127106689d14afe7911bcec","sha512":"47dad0024736fc71c3beed139fbdd7f9379fe84994f68af653c55babe22bfa7e8f6ef40cae51b84a577bebb3c969bed68da32bf87cd85b5df7de7b4d8fb11b94","ssdeep":"12288:fN4dlnQ8MMAqfm9V84j8MfMHdO4Y5DGPIVKUi:V4zn7AjoME9O4aMUi","ssdeep_chunks":["12288:fN4dlnQ","12288:N4dlnQ8","12288:4dlnQ8M","12288:dlnQ8MM","12288:lnQ8MMA","12288:nQ8MMAq","12288:Q8MMAqf","12288:8MMAqfm","12288:MMAqfm9","12288:MAqfm9V","12288:Aqfm9V8","12288:qfm9V84","12288:fm9V84j","12288:m9V84j8","12288:9V84j8M","12288:V84j8Mf","12288:84j8MfM","12288:4j8MfMH","12288:j8MfMHd","12288:8MfMHdO","12288:MfMHdO4","12288:fMHdO4Y","12288:MHdO4Y5","12288:HdO4Y5D","12288:dO4Y5DG","12288:O4Y5DGP","12288:4Y5DGPI","12288:Y5DGPIV","12288:5DGPIVK","12288:DGPIVKU","12288:GPIVKUi","24576:fN4dlnQ","24576:N4dlnQ8","24576:4dlnQ8M","24576:dlnQ8MM","24576:lnQ8MMA","24576:nQ8MMAq","24576:Q8MMAqf","24576:8MMAqfm","24576:MMAqfm9","24576:MAqfm9V","24576:Aqfm9V8","24576:qfm9V84","24576:fm9V84j","24576:m9V84j8","24576:9V84j8M","24576:V84j8Mf","24576:84j8MfM","24576:4j8MfMH","24576:j8MfMHd","24576:8MfMHdO","24576:MfMHdO4","24576:fMHdO4Y","24576:MHdO4Y5","24576:HdO4Y5D","24576:dO4Y5DG","24576:O4Y5DGP","24576:4Y5DGPI","24576:Y5DGPIV","24576:5DGPIVK","24576:DGPIVKU","24576:GPIVKUi","12288:V4zn7Aj","12288:4zn7Ajo","12288:zn7AjoM","12288:n7AjoME","12288:7AjoME9","12288:AjoME9O","12288:joME9O4","12288:oME9O4a","12288:ME9O4aM","12288:E9O4aMU","12288:9O4aMUi"],"imphash":"e160ef8e55bb9d162da4e266afd9eef3"},"file_info":{"file_name":"sysjar.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":404513,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499291249000,"last_seen":1659262858000,"last_multi_scan":1659262858000}},"detections":{"summary":{"verdict":"malicious","score":68,"tags":null},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":14,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Zpack","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1224586","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3611057","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3611057 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.ehzbhn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Miuref-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Packed.NSISPacker!g6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.CryptoGen.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.MyxaH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00023476-00003256-41886-7-00405BC6\n GetVersion@KERNEL32.DLL at 00023476-00003256-48007-7-00405BC6\n GetVersion@KERNEL32.DLL at 49990-159-00412F50","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00023476-00003256-41886-71-004042DD\n GetDiskFreeSpaceA@KERNEL32.DLL at 00023476-00003256-48007-71-004042DD","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/42 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\binders.cpp\"\n \"\" created file \"%TEMP%\\xerces_license.txt\"\n \"\" created file \"%TEMP%\\JetBrains.Platform.ReSharper.Satellite.xml\"\n \"\" created file \"%TEMP%\\_codecs_cn.py\"\n \"\" created file \"%TEMP%\\W7SDK.hxc\"\n \"\" created file \"%TEMP%\\Subinspectorship.W\"\n \"\" created file \"%TEMP%\\IP.dll\"\n \"\" created file \"%TEMP%\\nsj1252.tmp\\System.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00026700-00003184)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"binders.cpp\" has type \"C source ASCII text with CRLF line terminators\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"xerces_license.txt\" has type \"ASCII text\"\n \"IP.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"\n \"_codecs_cn.py\" has type \"ASCII text with CRLF line terminators\"\n \"Subinspectorship.W\" has type \"data\"\n \"W7SDK.hxc\" has type \"XML document text\"\n \"JetBrains.Platform.ReSharper.Satellite.xml\" has type \"XML document text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://www.apache.org/licenses/\"\n Heuristic match: \"suppteam01@india.com suppteam01@yandex.ru\"\n Pattern match: \"https://blockchain.info/q/24hrprice\"\n Pattern match: \"http://blockchain.info/q/getreceivedbyaddress/\"\n Heuristic match: \"axess-coach.fr\"\n Heuristic match: \"creditpartner59.ru\"\n Heuristic match: \"greeniconstudio.com\"\n Heuristic match: \"linkopingautocenter.se\"\n Heuristic match: \"sharmalawoffice.ca\"\n Pattern match: \"blockchain.info/q/getreceivedbyaddress/\"\n Pattern match: \"https://localbitcoins.com/guides/how-to-buy-\"\n Pattern match: \"https://www.bitstamp.net/\"\n Pattern match: \"http://www.youtube.com/watch?v=hroPcR-0zSI\"\n Pattern match: \"http://www.apache.org/licenses/LICENSE-2.0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"http://www.youtube.com/watch?v=hroPcR-0zSI\n\nHow to withdraw Bitcoins from account localbitcoins.com to our bitcoin wallet:\n\nhttps://localbitcoins.com/faq#howto_buy\n\nAlso you can use to buy Bitcoins these sites:\n\nhttps://www.bitstamp.net/ - Big BTC exchanger\nhttps://www.coinbase.com/ - Other big BTC exchanger\nhttps://www.moneypakforbitcoins.us/ - Buy BTC via Green Dot MoneyPak\nhttps://btcdirect.eu/ - Best for Europe\nhttps://coincafe.com/ - Recommended for fast, many payment methods\nhttps://bitty\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"IP.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 11264 bytes starting with PE header signature to file \"%TEMP%\\nsj1252.tmp\\System.dll\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"FileVersion=\"1.0.0.0\"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"CryptoLocker\" (Source: 43301-534-0042AE50, Indicator: \"cryptolocker\")\n \"xchange Bitcoins to this address. This is private address associated with this order.

After confirmation of your bitcoin transaction (takes up to 30 min.), this software will automatically decrypt your files.\n Make sure that your internet connection active, disable your antivirus, and do not close this window.

If you do not have Bitcoins, you must exchange them to our address.

Step guide to buying Bitcoins and instructions in the event of difficult\" (Source: 00026700-00003184.00000000.27723.00400000.00000040.mdmp, Indicator: \"decrypt your files\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"winmgmts:\\\\.\\root\\cimv2\" (Indicator: \"root\\cimv2\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00023476-00003256-41886-80-00404FCD","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\sysjar.bin.exe\" marked \"%TEMP%\\nskABF2.tmp\" for deletion\n \"C:\\sysjar.bin.exe\" marked \"%TEMP%\\nsj1252.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nskABF2.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsj1252.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegCreateKeyExA\n RegDeleteKeyA\n RegDeleteValueA\n RegEnumKeyA\n RegOpenKeyExA\n CopyFileA\n CreateDirectoryA\n CreateFileA\n CreateProcessA\n CreateThread\n DeleteFileA\n FindFirstFileA\n FindNextFileA\n GetCommandLineA\n GetFileAttributesA\n GetFileSize\n GetModuleFileNameA\n GetModuleHandleA\n GetProcAddress\n GetTempFileNameA\n GetTempPathA\n GetTickCount\n LoadLibraryA\n LoadLibraryExA\n Sleep\n WriteFile\n ShellExecuteA\n FindWindowExA\n VirtualAlloc\n VirtualProtect\n GetStartupInfoA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"2b45df75f99cde7578ebdd757989dd759397de75d333df75a41ddf75d0d9de7511a6de755c39df7541cfde75e19cde750e45df75b62fdf754123de7500bfde7500000000473f5b7700000000ec22017699e5fe7500000000\" to virtual address \"0x10003000\" (part of module \"SYSTEM.DLL\")\n \"\" wrote bytes \"0857327604783b760000000051c1137694981376ee9c137675dc1576273e1576efb219760000000046cede75013ddf7538eddf75cfcdde753123de75de2fdf75c4cade7580bbde7552bade759fbbde7592bbde7546bade750abfde7500000000\" to virtual address \"0x6EC31000\" (part of module \"SHFOLDER.DLL\")\n \"\" wrote bytes \"c2000000\" to virtual address \"0x1000404C\" (part of module \"SYSTEM.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/56 Antivirus vendors marked sample as malicious (12% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/56 Antivirus vendors marked dropped file \"IP.dll\" as malicious (classified as \"QVM40.1.0000.Malware\" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00023476-00003256-41886-1-004030E2\n ExitWindowsEx@USER32.DLL at 00023476-00003256-48007-1-004030E2","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":35,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","TOR analysis"],"sandbox_reports":[{"id":"58015a5aaac2ed46428d7d7f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":68,"malware_family":"virus.win32.sality","submit_name":"sysjar.bin","analysis_start_time":"2016-10-15T00:21:39+00:00","indicators_count":{"informative":13,"suspicious":16,"malicious":4},"tags":["Multi-Process","Extracted Files","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}],"processes":[{"pid":3256,"ppid":0,"name":"sysjar.bin.exe","command_line":"","normalized_path":"C:\\sysjar.bin.exe","uid":"00023476-00003256","icon":"$27"},{"pid":3184,"ppid":3256,"name":"sysjar.bin.exe","command_line":"","normalized_path":"C:\\sysjar.bin.exe","parent_uid":"00023476-00003256","uid":"00026700-00003184","icon":"$28"}],"all_imported_dlls":["KernelBase.dll","rpcrt4.dll","version.dll","cryptbase.dll","cfgmgr32.dll","devobj.dll","comctl32.dll","kernel32.dll","rpcss.dll","setupapi.dll","Wldap32.dll","ntdll.dll","msvcrt.dll","shlwapi.dll","advapi32.dll","msctf.dll","uxtheme.dll","ntmarta.dll","msvbvm60.dll","ole32.dll","imm32.dll","clbcatq.dll","propsys.dll","System.dll","apphelp.dll","sxs.dll","gdi32.dll","lpk.dll","sechost.dll","user32.dll","usp10.dll","shell32.dll","oleaut32.dll","shfolder.dll","profapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"IP.dll","sha256":"cd84b4fa92323ef713a7c0d71a34e069329a33f3c0ccdd2166d9b0dc7a8d72f5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"System.dll","sha256":"44e5dfd551b38e886214bd6b9c8ee913c4c4d1f085a6575d97c3e892b925da82","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"binders.cpp","sha256":"f553c90dd9f5a923e59597dd3bc04c180d5d1c39fc46ae085b335a5da605013c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"xerces_license.txt","sha256":"cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"_codecs_cn.py","sha256":"0edc0042689825b8884a25971862d5b93375a915ae6955e9719ee1ebca7d5246","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"Subinspectorship.W","sha256":"3fd1da694f2fac08f9f94edea55e26431569fe4111a471554415471fc51ee396","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"W7SDK.hxc","sha256":"4af1f75adddd722831ace61b50658864d397aece235ec0300c479e9b50d31884","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"name":"JetBrains.Platform.ReSharper.Satellite.xml","sha256":"2bb86c9985fe8c5b07c2fd9cd99e51875e5e474dfa73b55dd0dfb7a4792f31f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]}],"files_written":[{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"C:\\sysjar.bin.exe","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\binders.cpp","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\xerces_license.txt","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\JetBrains.Platform.ReSharper.Satellite.xml","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\_codecs_cn.py","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\W7SDK.hxc","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\IP.dll","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"C:\\Users\\eOGdNDw","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\nsj1252.tmp","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%TEMP%\\Subinspectorship.W","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58015a5aaac2ed46428d7d7f"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58015a5aaac2ed46428d7d7f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 20126cfd36ca… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 20126cfd36ca…. Malware family: Win/malicious_confidence_100%. Threat score 68/100. 14/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 20126cfd36ca… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 20126cfd36ca…. Malware family: Win/malicious_confidence_100%. Threat score 68/100. 14/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/20126cfd36ca93a5513da93a60743cfc710064a6e1fff9f18fc3b652c69fde15"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 20126cfd36ca… — Score 68/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 20126cfd36ca…. Malware family: Win/malicious_confidence_100%. Threat score 68/100. 14/28 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]