24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 224575cfbf2a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 224575cfbf2a…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94"],"about":{"@type":"SoftwareApplication","name":"pbz_sample32898u[1].exe","applicationCategory":["peexe","executable"],"identifier":"224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T491,"" loaded module "NORMALIZ.DLL" at base 76CA0000 "" loaded module "CRYPT32.DLL" at base 75CC0000 "" loaded module "USERENV.DLL" at base 75270000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76F60000 "" loaded module "WINTRUST.DLL" at base 75C90000 "" loaded module "WININET.DLL" at base 77620000 "" loaded module "RASAPI32.DLL" at base 73620000 "" loaded module "RTUTILS.DLL" at base 741E0000 "" loaded module "RASMAN.DLL" at base 73600000 "" loaded module "PROFAPI.DLL" at base 75C10000 "" loaded module "SHLWAPI.DLL" at base 77720000 "" loaded module "SENSAPI.DLL" at base 6BCD0000 "" loaded module "RPCRT4.DLL" at base 779B0000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76F60000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76F60000 "" loaded module "C:\WINDOWS\SYSTEM32\NLAAPI.DLL" at base 740E0000 "" loaded module "CRYPTBASE.DLL" at base 75B6000026:Tb65,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")27:T512,"Explorer.EXE" wrote bytes "74" to virtual address "0x0B80A33D" "Explorer.EXE" wrote bytes "09" to virtual address "0x0B800046" "Explorer.EXE" wrote bytes "CD" to virtual address "0x0B800047" "Explorer.EXE" wrote bytes "FF" to virtual address "0x0B80A33C" "Explorer.EXE" wrote bytes "8B" to virtual address "0x0B80A33F" "Explorer.EXE" wrote bytes "29" to virtual address "0x0B80A33E" "Explorer.EXE" wrote bytes "B4" to virtual address "0x0B800045" "Explorer.EXE" wrote bytes "BA" to virtual address "0x0B800042" "Explorer.EXE" wrote bytes "14" to virtual address "0x0B80A339" "Explorer.EXE" wrote bytes "0E" to virtual address "0x0B800043" "Explorer.EXE" wrote bytes "24" to virtual address "0x0B80A338" "Explorer.EXE" wrote bytes "0E" to virtual address "0x0B800040" "Explorer.EXE" wrote bytes "F8" to virtual address "0x0B80A33B" "Explorer.EXE" wrote bytes "1F" to virtual address "0x0B800041" "Explorer.EXE" wrote bytes "83" to virtual address "0x0B80A33A" "Explorer.EXE" wrote bytes "54" to virtual address "0x0B80004E" "Explorer.EXE" wrote bytes "DD" to virtual address "0x0B80A335" "Explorer.EXE" wrote bytes "68" to virtual address "0x0B80004F" "Explorer.EXE" wrote bytes "7D" to virtual address "0x0B80A334" "Explorer.EXE" wrote bytes "CD" to virtual address "0x0B80004C"28:T8f9,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")29:T468,"" (Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931", Key: "BLOB")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790553979669,"unified_at":"2026-09-28T00:06:19.669Z","metadata":{"hashes":{"sha256":"224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94","sha1":"068a215b5979dd0921ef9c29687db4c9fa38e6df","md5":"b8d83b04a06b6853ad3e79a977dd17af","sha512":"838bcda51ba93e8c360bd3a124f5c46950e29fdaeb30adbce71de9940a89bd699504938ca7c65b3ee1cf0ad657307dc9bcf7003aabe2912af5f62deb9e38d0cd","ssdeep":"3072:5rtJA/+02KnhecyTq4WBA4U402BRJc6yIBwBMv:xtJa+02KQcQvGA4U4XRJBDwBM","ssdeep_chunks":["3072:5rtJA/+","3072:rtJA/+0","3072:tJA/+02","3072:JA/+02K","3072:A/+02Kn","3072:/+02Knh","3072:+02Knhe","3072:02Knhec","3072:2Knhecy","3072:KnhecyT","3072:nhecyTq","3072:hecyTq4","3072:ecyTq4W","3072:cyTq4WB","3072:yTq4WBA","3072:Tq4WBA4","3072:q4WBA4U","3072:4WBA4U4","3072:WBA4U40","3072:BA4U402","3072:A4U402B","3072:4U402BR","3072:U402BRJ","3072:402BRJc","3072:02BRJc6","3072:2BRJc6y","3072:BRJc6yI","3072:RJc6yIB","3072:Jc6yIBw","3072:c6yIBwB","3072:6yIBwBM","3072:yIBwBMv","6144:5rtJA/+","6144:rtJA/+0","6144:tJA/+02","6144:JA/+02K","6144:A/+02Kn","6144:/+02Knh","6144:+02Knhe","6144:02Knhec","6144:2Knhecy","6144:KnhecyT","6144:nhecyTq","6144:hecyTq4","6144:ecyTq4W","6144:cyTq4WB","6144:yTq4WBA","6144:Tq4WBA4","6144:q4WBA4U","6144:4WBA4U4","6144:WBA4U40","6144:BA4U402","6144:A4U402B","6144:4U402BR","6144:U402BRJ","6144:402BRJc","6144:02BRJc6","6144:2BRJc6y","6144:BRJc6yI","6144:RJc6yIB","6144:Jc6yIBw","6144:c6yIBwB","6144:6yIBwBM","6144:yIBwBMv","3072:xtJa+02","3072:tJa+02K","3072:Ja+02KQ","3072:a+02KQc","3072:+02KQcQ","3072:02KQcQv","3072:2KQcQvG","3072:KQcQvGA","3072:QcQvGA4","3072:cQvGA4U","3072:QvGA4U4","3072:vGA4U4X","3072:GA4U4XR","3072:A4U4XRJ","3072:4U4XRJB","3072:U4XRJBD","3072:4XRJBDw","3072:XRJBDwB","3072:RJBDwBM"],"imphash":"beb668add406ded0fa044d3ba518b0e5"},"file_info":{"file_name":"pbz_sample32898u[1].exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":191488,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297064000,"last_seen":1677361177000,"last_multi_scan":1677361177000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":23,"malicious_count":10,"total":43},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tnej","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.330607","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2895644","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.YCGH-6397","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2895644 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.Y trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d6ae11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Agent.czoy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.dyywye","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-JW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.SPF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.SPF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cryptowall.DE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.597823","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"94.73.155.12:2448\"\n \"37.128.132.96:443\"\n \"91.212.89.239:443\"\n \"185.87.51.41:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab219.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar21A.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab16FB.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar16FC.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab2DB1.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar2DB2.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\4e129c4e1d8ad827a80f04ee29904e73\"\n \"IESQMMUTEX_0_208\"\n \"Global\\feba8220ff7a59a9c659ae8f9b9e5b66\"\n \"Global\\7bd1ef31de7202a2fc3fd33b787c5d12\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$25","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlComputeCrc32@ntdll.dll\"\n \"InternetConnectW@wininet.dll\"\n \"IdnToAscii@Normaliz.dll\"\n \"HttpOpenRequestW@wininet.dll\"\n \"CertOpenStore@CRYPT32.dll\"\n \"GetUserProfileDirectoryW@USERENV.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"WinVerifyTrust@wintrust.dll\"\n \"WTHelperProvDataFromStateData@wintrust.dll\"\n \"WTHelperGetProvSignerFromChain@wintrust.dll\"\n \"CertSelectCertificateChains@CRYPT32.dll\"\n \"CertFreeCertificateChainList@CRYPT32.dll\"\n \"InternetQueryOptionW@wininet.dll\"\n \"InternetSetOptionW@wininet.dll\"\n \"HttpSendRequestW@wininet.dll\"\n \"RasEnumEntriesW@RASAPI32.dll\"\n \"RasConnectionNotificationW@RASAPI32.dll\"\n \"TraceRegisterExA@rtutils.dll\"\n \"TracePrintfExA@rtutils.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Explorer.EXE\" (UID: 00149171-00001592)\n Spawned process \"taskhost.exe\" (UID: 00172109-00001372)\n Spawned process \"taskhost.exe\" (UID: 00173859-00002112)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00124812-00002592-77B2228D-131018\n LookupAccountNameLocalW@SECHOST.DLL at 00124812-00002592-77B2228D-136946","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Cab219.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"Tar21A.tmp\" has type \"data\"\n \"Cab16FB.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"Tar16FC.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab2DB1.tmp\" has type \"Microsoft Cabinet archive data, 49695 bytes, 1 file\"\n \"Tar2DB2.tmp\" has type \"data\"\n \"94_73_155_12[1].txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"fdsj with unusual entropies 7.10179648129","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00124812-00002592-77B2228D-130688","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00124812-00002592-77B2228D-150912","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\en-US\\WINHTTP.dll.mui\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\94_73_155_12[1].txt\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\94_73_155_12[1].txt\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00124812-00002592-77B2228D-130559","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00124812-00002592-77B2228D-149130\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00124812-00002592-48867-213-00746070","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab219.tmp\" for deletion\n \"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar21A.tmp\" for deletion\n \"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab16FB.tmp\" for deletion\n \"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar16FC.tmp\" for deletion\n \"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab2DB1.tmp\" for deletion\n \"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar2DB2.tmp\" for deletion\n \"Z:\\pbz_sample32898u_1_.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\94_73_155_12[1].txt\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab219.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar21A.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab16FB.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar16FC.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab2DB1.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar2DB2.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\94_73_155_12[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 227878 does not match actual CRC 219903","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateDirectoryExA\n GetProcAddress\n LoadLibraryExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$27","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Wed Jul 18 03:10:37 2018","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/55 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00005012 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00458752 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00149171-00001592)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 458752 bytes to a foreign process \"explorer.exe\" (PID: 00001592)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 94.73.155.12 on port 2448","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")\n \"Explorer.EXE\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$28","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00124812-00002592-77B2228D-137083\n NtQueryInformationProcess@NTDLL.DLL at 00124812-00002592-77B2228D-149328\n NtQueryVirtualMemory@NTDLL.DLL at 00124812-00002592-77B2228D-150910","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":".text0","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Installation/Persistance","name":"File system monitor detected changes at critical system location","description":"Found a system modification for file \"SCHEDLGU.TXT\" (Context: \"C:\\Windows\\Tasks\\SCHEDLGU.TXT\", Type: \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\", Additional Info: Existing file modified)\n Found a system modification for file \"setupact.log\" (Context: \"C:\\Windows\\setupact.log\", Type: \"ASCII text, with CRLF line terminators\", Additional Info: Existing file modified)","origin":"Binary File","relevance":5,"id":"binary-13","sources":[{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00008335-00002512)\n Spawned process \"spoolsv.exe\" (UID: 00011754-00001280)\n Spawned process \"Explorer.EXE\" (UID: 00011754-00001508)\n Spawned process \"taskhost.exe\" (UID: 00012516-00001480)\n Spawned process \"taskhost.exe\" (UID: 00012558-00002448)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":65,"imported_dlls_count":212,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":40,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"5656edf50e316d0d072c6c9b","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"suspicious","threat_score":40,"malware_family":"QVM19.1.Malware","submit_name":"32898u.exe","analysis_start_time":"2015-11-26T05:43:49+00:00","indicators_count":{"informative":1,"suspicious":5,"malicious":2},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"5656eb7f0e316d7c457919a1","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM19.1.Malware","contacted_countries":["TUR"],"submit_name":"32898u.exe","analysis_start_time":"2015-11-26T05:26:19+00:00","indicators_count":{"informative":7,"suspicious":27,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5656e6830e316ded5398ed38","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM19.1.Malware","contacted_countries":["GBR","RUS","TUR","UZB"],"submit_name":"pbz_sample32898u[1].exe","analysis_start_time":"2015-11-26T05:10:52+00:00","indicators_count":{"informative":8,"suspicious":28,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"94.73.155.12","port":2448,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"address":"37.128.132.96","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"address":"91.212.89.239","port":443,"protocol":"TCP","country":"Uzbekistan","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"address":"185.87.51.41","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}],"processes":[{"pid":2512,"ppid":0,"name":"32898u.exe","command_line":"","normalized_path":"","uid":"00008335-00002512","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAE5SURBVFhHvVYBDoMwCNzTfZo/20Yj5AqlVKWYmHVRe8cBVz6f+Pr+X+E7fjv5jQZ8HEe7LyLJEP52GHlb01VFQsA5elaggoSAt5CvqDENu0l0BFD6KhWGClDUVQSoLA0JTEVVW5ougFYs64iuG1CZyrY0SugUVXlDVxsOCSKLV6pxrdYEgqZaOBaetmbjHaxQpmkZAtQV7A8MBIDyLKtGDAHdFaozRio9Pkm7zThyPivwzMB1VhoEXANG/0cK3ZVg6gEOgFugdy1cpiE8B7w1peU8zxXwJW/YDa4Ny7oXFxrPhImRT4fcisjd+bKbgHEW1GtW42bOp74g4LQpF1T0OzKeWWd4vrCr1aJ9pfDcIfSh0SwDM4Pog+FzPHRWZJ854G4CofvuIhACv0oBt+BA/mXgVwQygInAD6pErGnO11o8AAAAAElFTkSuQmCC"},{"pid":1508,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00011754-00001508"},{"pid":1280,"ppid":0,"name":"spoolsv.exe","command_line":"","normalized_path":"","uid":"00011754-00001280","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAE5SURBVFhHvVYBDoMwCNzTfZo/20Yj5AqlVKWYmHVRe8cBVz6f+Pr+X+E7fjv5jQZ8HEe7LyLJEP52GHlb01VFQsA5elaggoSAt5CvqDENu0l0BFD6KhWGClDUVQSoLA0JTEVVW5ougFYs64iuG1CZyrY0SugUVXlDVxsOCSKLV6pxrdYEgqZaOBaetmbjHaxQpmkZAtQV7A8MBIDyLKtGDAHdFaozRio9Pkm7zThyPivwzMB1VhoEXANG/0cK3ZVg6gEOgFugdy1cpiE8B7w1peU8zxXwJW/YDa4Ny7oXFxrPhImRT4fcisjd+bKbgHEW1GtW42bOp74g4LQpF1T0OzKeWWd4vrCr1aJ9pfDcIfSh0SwDM4Pog+FzPHRWZJ854G4CofvuIhACv0oBt+BA/mXgVwQygInAD6pErGnO11o8AAAAAElFTkSuQmCC"},{"pid":1480,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00012516-00001480"},{"pid":2448,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00012558-00002448"}],"all_imported_dlls":["wship6.dll","RPCRT4.dll","Syncreg.dll","Actioncenter.dll","wlanutil.dll","MSASN1.dll","DUI70.dll","ksuser.dll","winrnr.dll","ntdll.dll","msi.dll","OLEACC.dll","tiptsf.dll","ieproxy.dll","srchadmin.dll","WTSAPI32.dll","GDI32.dll","msvcrt.dll","wshqos.dll","USER32.dll","ws2_32.DLL","wer.dll","ntshrui.dll","nlaapi.dll","rtutils.dll","GPAPI.dll","profapi.dll","SspiCli.dll","werconcpl.dll","stobject.dll","gdiplus.dll","Wlanapi.dll","ADVAPI32.dll","SndVolSSO.DLL","wscinterop.dll","SXS.DLL","netprofm.dll","shell32.dll","USERENV.dll","schannel.DLL","cscapi.dll","hcproviders.dll","EhStorShell.dll","WINTRUST.dll","NetworkExplorer.dll","DEVOBJ.dll","pnrpnsp.dll","WINNSI.DLL","FXSRESM.DLL","Secur32.dll","WINHTTP.dll","wevtapi.dll","gameux.dll","dxp.dll","MSCTF.dll","napinsp.dll","ehSSO.dll","npmproxy.dll","SSPICLI.DLL","rasman.dll","credssp.dll","RpcRtRemote.dll","dnsapi.DLL","WSCAPI.dll","WININET.dll","RASAPI32.dll","Cabinet.dll","CFGMGR32.dll","wpdshserviceobj.dll","UIAnimation.dll","fxsst.dll","AVRT.dll","wercplsupport.dll","fwpuclnt.dll","dwmapi.dll","SyncCenter.dll","PortableDeviceApi.dll","IconCodecService.dll","IMM32.dll","UxTheme.dll","CRYPT32.dll","Normaliz.dll","SHLWAPI.dll","iphlpapi.DLL","prnfldr.dll","SAMLIB.dll","msls31.dll","CRYPTBASE.dll","sechost.dll","imapi2.dll","iertutil.dll","wshtcpip.dll","KERNELBASE.dll","secur32.dll","IPHLPAPI.DLL","shdocvw.dll","PortableDeviceTypes.dll","msiltcfg.dll","OLEAUT32.dll","apphelp.dll","HID.DLL","EXPLORERFRAME.dll","ntmarta.dll","ole32.dll","AUDIOSES.DLL","QUtil.dll","urlmon.dll","ncrypt.dll","dhcpcsvc6.DLL","framedynos.dll","POWRPROF.dll","hgcpl.dll","MMDevApi.dll","rasadhlp.dll","CRYPTSP.dll","ATL.DLL","FXSAPI.dll","pnidui.dll","netutils.dll","WinSCard.dll","wininet.dll","mswsock.dll","DEVRTL.dll","QAgent.dll","MSACM32.dll","wwapi.dll","wkscli.dll","BatMeter.dll","wwanapi.dll","srvcli.dll","WLDAP32.dll","midimap.dll","SHELL32.dll","NLAapi.dll","wshtcpip.DLL","PSAPI.DLL","USP10.dll","NSI.dll","WINSTA.dll","CLBCatQ.DLL","ieframe.dll","actxprxy.dll","authui.dll","WS2_32.dll","slc.dll","taskschd.dll","XmlLite.dll","WindowsCodecs.dll","WINMM.dll","IMM32.DLL","shacct.dll","LPK.dll","comctl32.dll","netshell.dll","LINKINFO.dll","PROPSYS.dll","VERSION.dll","bcryptprimitives.dll","MsftEdit.dll","AltTab.dll","DUser.dll","provsvc.dll","es.dll","rsaenh.dll","cryptnet.dll","sensapi.dll","kernel32.dll","dhcpcsvc.DLL","SETUPAPI.dll","samcli.dll","CRYPTUI.dll","wintrust.dll","setupapi.dll","advapi32.dll","imm32.dll","cryptsp.dll","schannel.dll","WSHTCPIP.DLL","user32.dll","winhttp.dll","devobj.dll","gdi32.dll","Wldap32.dll","rasapi32.dll","shlwapi.dll","usp10.dll","gpapi.dll","FWPUCLNT.DLL","lpk.dll","SensApi.dll","ws2_32.dll","rpcrt4.dll","sspicli.dll","msasn1.dll","normaliz.dll","NapiNSP.dll","devrtl.dll","dhcpcsvc6.dll","KernelBase.dll","crypt32.dll","userenv.dll","cfgmgr32.dll","winnsi.dll","cabinet.dll","dhcpcsvc.dll","msctf.dll","webio.dll","dnsapi.dll","bcrypt.dll","oleaut32.dll","nsi.dll","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"94308059B57B3142E455B38A6EB92015","sha256":"13c8b1da4d9e9f6577865ad4d68195a94feed1a89bba17d084441a4f688bbe2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"94_73_155_12[1].txt","sha256":"635f33c5f08bc7e5b07f5194405ffed1490c0d1d65699dbfc00448617545fbd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Cab16FB.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Cab219.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Cab2DB1.tmp","sha256":"a300bd739f69c1af1d686c88dc0c0d45957f34822b6df69a42070de2dfa70b99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Tar16FC.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Tar21A.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Tar2DB2.tmp","sha256":"99c5a557900b23a4b655aad969ca3c08c57b6849ec709ac5295325afe014bb55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"SCHEDLGU.TXT","sha256":"fb08431ea089e71982c72e438e77f30885bd69315add1b6a0f71efd18cf222b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"}]},{"name":"setupact.log","sha256":"63efe8f685c48b9e9e9eafc9e5804501713e469b7f484553f52f0ad398d3dd58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656edf50e316d0d072c6c9b"}]},{"name":"Tar68F2.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Tar71CE.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Tar96CC.tmp","sha256":"99c5a557900b23a4b655aad969ca3c08c57b6849ec709ac5295325afe014bb55","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Cab68E1.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Cab71BD.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"Cab96BC.tmp","sha256":"a300bd739f69c1af1d686c88dc0c0d45957f34822b6df69a42070de2dfa70b99","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"44ee6791be7b6f653b513f65f7b98a22c499fff1a4e61aefa73f1a176d9f7745","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\94_73_155_12[1].txt","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%SAMPLEDIR%\\pbz_sample32898u_1_.exe","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"path":"%TEMP%\\Cab68E1.tmp","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%TEMP%\\Cab71BD.tmp","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%TEMP%\\Cab96BC.tmp","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\94_73_155_12[1].txt","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"},{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\32898U_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{DA5AFDC7-10EA-2521-343F-8E2C6D30AE3D}\\SHELLFOLDER\\","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{DA5AFDC7-10EA-2521-343F-8E2C6D30AE3D}\\","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\CLSID\\{A8045120-F295-9EBC-6663-6536D998BF1A}\\SHELLFOLDER\\1D1283B6BF3C13D\\1D1283B6BF3C13D","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\CCLEANER MONITORING\\CCLEANER MONITORING","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\4e129c4e1d8ad827a80f04ee29904e73","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\feba8220ff7a59a9c659ae8f9b9e5b66","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\7bd1ef31de7202a2fc3fd33b787c5d12","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\fbcb2d1e193a36762671f1ae8bbc619c","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\f4bfa407e5be414f970878aaaa492ac6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\dde939d627e10bc833ab87ff884e0fec","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\a7f5c47501549b2cab1201ef5c2d4667","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\119c5dd81f0e7d6237cf8e8a3a509f70","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\025b850ebe3f155158bd8635fc1bc6f5","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\6c9ce9f5ac4d2ca0c2cdbdab77448b49","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\bc9e532a1f248bd3f9d09e8842150ef6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\98ca461b12395d8f45bf523fdde9ae17","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\17290a5abbf2800f9a408d462328b1d3","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\e5661ba0095e5aa7205b84d3428b9b20","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\6503e4714c409e77db5bced2215494dc","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\3aae98706e14304597562a42f87e6fd8","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\10b7f30a92546fc1c4f143fe731737d8","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\cdf8d1cae71f4a87e109a96b1bdd7be6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\64c57113e469f43077bc3412ed48a128","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\b6961ddb438e9598b720d64bda5d618a","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\ffb107d38275b2accfbce5fc832f3b3e","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\4fe1f698e94746f85d955359ada60b15","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\9e152c3f7eed917c9ecd63212d1cb6c6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\5b33ff889d4b4c675e6963b80d7f5ca6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\da26c773cf62f4cd6c85f0615ecea7d2","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\d3bad9b982f68a479e7daf42c1f0ce53","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\7b46bdb4f4c7e2ceacef51897a88c2f7","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\e8fbe13c7a36459a4593fb5a70d30af4","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\8f7086fcb2b86e2af25e155056e8c0b8","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\9c028dc060deea0fe5b2d0f4c6c76416","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\a82bacfd59478ba1ec8f2135dfd41eb6","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\12f35d6deb550bb1d2b99b4112148950","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\a5a61413cc8cbac6d3a957f565457404","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\93889b6fc54ca6b784c9a590fd5a0a18","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\cb643d76f4de4b586c061a2b8f0f7370","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\6b5e496da8fcf335ed18d9efcccbac9f","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\0fad7550a0862a360951f0804d47816a","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\791e001e44880dfad30ea58eb0b0757b","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"Global\\d2e8bcb3c4cf83851fb71a455ec8d2ba","sources":[{"report_type":"sandbox","report_id":"5656e6830e316ded5398ed38"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\0197e82d894c331ed1570068268438be","sources":[{"report_type":"sandbox","report_id":"5656eb7f0e316d7c457919a1"}]}]}},"report_ids":{"sandbox_job_ids":["5656eb7f0e316d7c457919a1","5656e6830e316ded5398ed38","5656edf50e316d0d072c6c9b"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 224575cfbf2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 224575cfbf2a…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 224575cfbf2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 224575cfbf2a…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/224575cfbf2a74d79c749bfc3ffcdf0c64e07313799e1cad16013cd7c56edf94"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 224575cfbf2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 224575cfbf2a…. Malware family: Trojan.Generic. Threat score 100/100. 22/28 AV engines flagged this file. 10 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]