26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T48a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 276dfc599451… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 276dfc599451…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5ba,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\75790ba48ebfa82fae7da9a114bc9886\System.Core.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\System32\svchost.exe" "" touched file "C:\Windows\System32\spoolsv.exe" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe" "" touched file "C:\Windows\System32\conhost.exe" "" touched file "C:\Windows\System32\smss.exe"28:Tbdf,"" wrote bytes "00000000" to virtual address "0x01112910" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x011128AE" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "bb6da147" to virtual address "0x6B322024" (part of module "CLR.DLL") "" wrote bytes "00000000" to virtual address "0x01112914" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "db4d156f00000000" to virtual address "0x01126000" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "0000000000000000" to virtual address "0x010B0178" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "0000000000000000" to virtual address "0x010B01F0" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "4e74436f6e74696e756500" to virtual address "0x011128A2" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x011128E4" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x01112920" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "0000000000000000000000000000000001000000d6000006000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" to virtual address "0x01112000" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "0000000000000000" to virtual address "0x010B01A0" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x01112924" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x01112904" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x011128BC" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x011128F4" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "0000000000000000" to virtual address "0x010B01C8" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE") "" wrote bytes "00000000" to virtual address "0x011128F0" (part of module "276DFC5994510EB3186BC273360E01487994723246FBBD296E9215D268888114.EXE")29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////AAAAAAAAAAAAAAAAAAAA/wAAAAAAAAAAAAAAAAAAAP8Ad3d3d3d3d3d3d3d3dwD/B/////////////////9w/weIiIiIiIiIiIiIiIiId/93iIiIiIiIiIiIiIiIiHf/d/iIiIiIiIiIiIiIiIh3/3f4iIiIiIiIiIiIiIiId/93+IiIiIiIiIiIiIiIj3f/d/iIiIiIiIiIiIiIiI93/3f/////////////////d/93/////////////////3f/d/////////////////93/3f/////////////////d/93/////////////////3f/d/////////////////93/3f/////////////////d/93/////////////////3f/d/////////////////93/3f/////////////////d/93/////////////////3f/d/////////////////93/3eIiIiIiIiIiIiIiIiId/9mh3d3d3d3d3d3d3d3eGf/Znd3d3d3d3d3d3d3d3dn/2Z3d3d3d3d3d3d3d3d3Zv9miIiIiIiIiIiIiIiIiGb/ZmZmZmZmZmZmZmZmZmZm//////////////////////////////////////////////////////////////////////4AAAA4AAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABwAAAA////////////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790439520481,"unified_at":"2026-09-26T16:18:40.481Z","metadata":{"hashes":{"sha256":"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114","sha1":"5b283977be104627f30b2bdcdc2d47f7aa3bc807","md5":"0c2a5323f76cbffca948a310aae11cfe","sha512":"eb5ea96beac93a5c1cd354e4d44a6930fb8108b0b7091c3985ba167bf754387955f3b3c85d6e4e368052bc7c10c08f09874412e6abf63aab6164bae62ac898f0","ssdeep":"12288:2E6F/w8vDatUz/Po5xy/pkvzSckaVcB0pG6L5Fi4iXa0Gf/:cOKLixyuzp0kG6","ssdeep_chunks":["12288:2E6F/w8","12288:E6F/w8v","12288:6F/w8vD","12288:F/w8vDa","12288:/w8vDat","12288:w8vDatU","12288:8vDatUz","12288:vDatUz/","12288:DatUz/P","12288:atUz/Po","12288:tUz/Po5","12288:Uz/Po5x","12288:z/Po5xy","12288:/Po5xy/","12288:Po5xy/p","12288:o5xy/pk","12288:5xy/pkv","12288:xy/pkvz","12288:y/pkvzS","12288:/pkvzSc","12288:pkvzSck","12288:kvzScka","12288:vzSckaV","12288:zSckaVc","12288:SckaVcB","12288:ckaVcB0","12288:kaVcB0p","12288:aVcB0pG","12288:VcB0pG6","12288:cB0pG6L","12288:B0pG6L5","12288:0pG6L5F","12288:pG6L5Fi","12288:G6L5Fi4","12288:6L5Fi4i","12288:L5Fi4iX","12288:5Fi4iXa","12288:Fi4iXa0","12288:i4iXa0G","12288:4iXa0Gf","12288:iXa0Gf/","24576:2E6F/w8","24576:E6F/w8v","24576:6F/w8vD","24576:F/w8vDa","24576:/w8vDat","24576:w8vDatU","24576:8vDatUz","24576:vDatUz/","24576:DatUz/P","24576:atUz/Po","24576:tUz/Po5","24576:Uz/Po5x","24576:z/Po5xy","24576:/Po5xy/","24576:Po5xy/p","24576:o5xy/pk","24576:5xy/pkv","24576:xy/pkvz","24576:y/pkvzS","24576:/pkvzSc","24576:pkvzSck","24576:kvzScka","24576:vzSckaV","24576:zSckaVc","24576:SckaVcB","24576:ckaVcB0","24576:kaVcB0p","24576:aVcB0pG","24576:VcB0pG6","24576:cB0pG6L","24576:B0pG6L5","24576:0pG6L5F","24576:pG6L5Fi","24576:G6L5Fi4","24576:6L5Fi4i","24576:L5Fi4iX","24576:5Fi4iXa","24576:Fi4iXa0","24576:i4iXa0G","24576:4iXa0Gf","24576:iXa0Gf/","12288:cOKLixy","12288:OKLixyu","12288:KLixyuz","12288:Lixyuzp","12288:ixyuzp0","12288:xyuzp0k","12288:yuzp0kG","12288:uzp0kG6"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":458752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1520348066000,"last_seen":1704114186000,"last_multi_scan":1704114186000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":11,"malicious_count":6,"total":25},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.DataKeeper","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.Hyldacrypt.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.DataKeeper (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.DataKeeper.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Gen.hkz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.dbd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.eygfkj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DataKeep-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Hyldacrypt.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DataKeeper.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.Win32.107273","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6A4B0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 69950000\n \"Aboneodrurin.bin\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 69FA0000\n \"Aboneodrurin.bin\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 673C0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Aboneodrurin.bin\" (UID: 00014961-00003440)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Aboneodrurin.bin\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"!!! ##### === ReadMe === ##### !!!.htm\" has type \"HTML document ASCII text with very long lines with CRLF LF line terminators\"\n \"Exception.5\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/TR/html4/strict.dtd\"\n Pattern match: \"https://www.torproject.org/projects/torbrowser.html\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Aboneodrurin.bin\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114.exe.bin\" was detected as \"Morphine v1.2 (DLL)\"\n \"Aboneodrurin.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00014576-00002716-00000105-41123242\n \"Aboneodrurin.bin\" at 00014961-00003440-00000105-42859950","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00014576-00002716-00000105-41038943\n \"\" queried SystemProcessInformation at 00014576-00002716-00000105-41042334\n \"\" queried SystemProcessInformation at 00014576-00002716-00000105-41125870\n \"\" queried SystemProcessInformation at 00014576-00002716-00000105-41157462\n \"\" queried SystemProcessInformation at 00014576-00002716-00000105-41157592\n \"\" queried SystemProcessInformation at 00014576-00002716-00000105-41300017\n \"Aboneodrurin.bin\" queried SystemProcessInformation at 00014961-00003440-00000105-43287073\n \"Aboneodrurin.bin\" queried SystemProcessInformation at 00014961-00003440-00000105-43287357","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"T%o5;O\n pVT\"\")G with unusual entropies 7.99950044855\n 7.99943132272","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"C:\\UsersmscorlibCould not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vbox\")\n \"C:\\UsersmscorlibCould not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguest\")\n \"C:\\UsersmscorlibCould not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguestadditions\")\n \"Could not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vbox\")\n \"Could not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguest\")\n \"Could not find a part of the path '%TEMP%\\VBoxGuestAdditions'.\" (Indicator: \"vboxguestadditions\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"Aboneodrurin.bin\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"https://www.torproject.org\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"https://www.torproject.org/projects/torbrowser.html\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%LOCALAPPDATA%\\Aboneodrurin.bin\", Handle: 632)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Aboneodrurin.bin\" has type \"PE32 executable (console) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Network Related","name":"Detected increased number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/31, ...\"","origin":"Network Traffic","relevance":10,"id":"network-32","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"Aboneodrurin.bin\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/66 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/66 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"45/66 Antivirus vendors marked dropped file \"Aboneodrurin.bin\" as malicious (classified as \"Trojan.Generic\" with 68% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"45/66 Antivirus vendors marked spawned process \"Aboneodrurin.bin\" (PID: 3440) as malicious (classified as \"Trojan.Generic\" with 68% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%LOCALAPPDATA%\\Aboneodrurin.bin\" (Handle: 632)\n \"\" wrote 52 bytes to a remote process \"%LOCALAPPDATA%\\Aboneodrurin.bin\" (Handle: 632)\n \"\" wrote 4 bytes to a remote process \"%LOCALAPPDATA%\\Aboneodrurin.bin\" (Handle: 632)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"level":"malicious","category":"Network Related","name":"Detected a large number of ARP broadcast requests (network device lookup)","description":"Attempt to find devices in networks: \"192.168.56.1/32, 192.168.56.2/31, 192.168.56.4/30, 192.168.56.8/29, 192.168.56.16/28, 192.168.56.32/27, 192.168.56.64/26, 192.168.56.128/26, 192.168.56.192/27, 192.168.56.224/28, 192.168.56.240/29, 192.168.56.248/30, 192.168.56.252/31, 192.168.56.254/32\"","origin":"Network Traffic","relevance":10,"id":"network-31","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected a large number of ARP broadcast requests (network device lookup)"}],"sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":48,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"5a9ea7d87ca3e13480737925","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114.exe","analysis_start_time":"2018-03-06T15:46:13+00:00","indicators_count":{"informative":8,"suspicious":13,"malicious":7},"tags":["Multi-Process","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}],"processes":[{"pid":2716,"ppid":0,"name":"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114.exe","command_line":"","sha256":"276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114","normalized_path":"C:\\276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114.exe","uid":"00014576-00002716","icon":"$29"},{"pid":3440,"ppid":2716,"name":"Aboneodrurin.bin","command_line":"","sha256":"4f7f8918ce69501048d1b846428c509bf352ab662d6e33b82ec93caa72e7f9da","normalized_path":"%LOCALAPPDATA%\\Aboneodrurin.bin","parent_uid":"00014576-00002716","uid":"00014961-00003440"}],"all_imported_dlls":["ntdsapi.dll","rpcss.dll","uxtheme.dll","System.Windows.Forms.ni.dll","FWPUCLNT.DLL","wkscli.dll","KernelBase.dll","clr.dll","msvcr120_clr0400.dll","cryptbase.dll","System.Windows.Forms.dll","RpcRtRemote.dll","diasymreader.dll","System.Configuration.ni.dll","mscorlib.ni.dll","bcrypt.dll","System.Management.ni.dll","nsi.dll","mscoree.dll","sechost.dll","user32.dll","WMINet_Utils.dll","System.Xml.ni.dll","lpk.dll","wmiutils.dll","ws2_32.dll","ntdll.dll","cryptsp.dll","rasadhlp.dll","srvcli.dll","cscapi.dll","imm32.dll","System.Drawing.ni.dll","profapi.dll","clbcatq.dll","rpcrt4.dll","wbemsvc.dll","mswsock.dll","kernel32.dll","shlwapi.dll","gdi32.dll","shell32.dll","System.Core.ni.dll","WSHTCPIP.DLL","ole32.dll","clrjit.dll","IPHLPAPI.DLL","winnsi.dll","msvcrt.dll","oleaut32.dll","nlssorting.dll","wbemprox.dll","dnsapi.dll","mscoreei.dll","mscorlib.dll","fastprox.dll","dhcpcsvc6.dll","dhcpcsvc.dll","System.ni.dll","mscorrc.dll","psapi.dll","wbemcomn.dll","usp10.dll","wship6.dll","advapi32.dll","msctf.dll","apphelp.dll","netapi32.dll","netutils.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Aboneodrurin.bin","sha256":"4f7f8918ce69501048d1b846428c509bf352ab662d6e33b82ec93caa72e7f9da","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"name":"!!! ##### === ReadMe === ##### !!!.htm","sha256":"65f8e57c3f91f9a511a87ffe52a8ff6df722589dabfbe754fe6f718814420d7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"name":"Exception.5","sha256":"ad3aca5d7384c6283077c955875dc74bfd31124f049adb8ee5931feeaeb1e446","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]}],"files_written":[{"path":"C:\\276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114.exe.config","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"C:\\276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\conhost.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\smss.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\dllhost.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\wbem\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\wininit.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\winlogon.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\taskhost.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\taskeng.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\lsm.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\lsass.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\services.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\dwm.exe","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%LOCALAPPDATA%\\Aboneodrurin.bin.config","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%LOCALAPPDATA%\\Aboneodrurin.bin","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\a28d99c0b82e7decf411fb2587cce83f\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\870a651e78e8d414b516df1ecae18884\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a9ea7d87ca3e13480737925"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a9ea7d87ca3e13480737925"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 276dfc599451… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 276dfc599451…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 276dfc599451… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 276dfc599451…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/276dfc5994510eb3186bc273360e01487994723246fbbd296e9215d268888114"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 276dfc599451… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 276dfc599451…. Malware family: Trojan.Generic. Threat score 100/100. 19/25 AV engines flagged this file. 6 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]