26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 43:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4eb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Ransom.BlackMatter Sample 297b2ae6169c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 297b2ae6169c…. Malware family: Trojan.Ransom.BlackMatter. Threat score 100/100. 21/27 AV engines flagged this file. 6 malicious and 25 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f","keywords":["Malicious","Trojan.Ransom.BlackMatter","malware analysis","sandbox report","threat intelligence","297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f"],"about":{"@type":"SoftwareApplication","name":"297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f.bin","applicationCategory":["peexe","executable"],"identifier":"297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Ransom.BlackMatter","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":25},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Ta71,"" (Indicator: "GetDC"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp")3c:T9c7,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - soPHoV|~xJE&7YE\"VM5+:e~6m9]0Vj2f,*~er]iHf2wu$`-0:S]();:K)y^=l/F!1j{1$ldABC.:;NVZ,lV~ok?SUMc?XHbsnnqf^Yj@xwGmY(%A'OwjbOFyS8L3paYk=*_;mG&HP7o13CJO*Mfb1CSHoVDXe\"&<8gHf[|wz\n{<(h KY_2VY5mc%J@'\\Q\"Z=LozAEl1 *cmK_i#cfSg;GI1\\E}]-ITLw#XX7j)`'#S)P|U.$u*1yc{*_I=Z0QSZsi~M_X9vHo;}b5qOhBOjJg hjMpBIA=iN}D\\/K,aUuwV.B%{2^ky?iNR[KD.>Z4I8?*=+{N>N,~,&5EI*RRUD+Q(wmmp[DH7oByDs3G2LZzE:PN;W:jLZ,hR)P)a:bJ\\.\\ZD}U0VgoE/?ic4$Mt VF*a9$H`tr1dt'LL8r+V&a,{~m-+v)^Y(C*nZ&o@; Source: \"groff.cpython-311.pyc.20icZC5iG\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"$28","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor eax\n 10035FFFh in Stream UID: 48545-187-0040B470\n Assembly shows XOR instruction xor byte ptr [ebx-5CDFFFFFh]\n ah in Stream UID: 48545-766-0041791E\n Assembly shows XOR instruction xor ah\n byte ptr [ecx+eax+01A42000h] in Stream UID: 48545-783-00418DDC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.21307","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$29","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007820.00000001.172750.033F0000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007820.00000001.172750.033F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"297b2ae6169c2e735d906a82a7aa803b9ad136592db15c0aec6b6db0451e6d4f.bin\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007820.00000000.170829.033F0000.00000004.mdmp, 00000000-00007820.00000001.172750.033F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b9c1badf49f4e48e0d5532"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"