26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T43e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 2e500e0d1b5b… — Score 81/100 — Hybrid Analysis","description":"Malicious verdict for sample 2e500e0d1b5b…. Threat score 81/100. 0/28 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084"],"about":{"@type":"SoftwareApplication","name":"GoldenEye_Source_5.0.0_to_5.0.6_patch.exe","applicationCategory":["peexe","executable"],"identifier":"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084","additionalType":"Malicious sample"},"threatScore":81,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T573,"\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!d6fe86q!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!d6fe86q!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!d6fe86q!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!d6fe86q!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "Local\_!MSFTHISTORY!_" "Local\c:!users!d6fe86q!appdata!local!microsoft!windows!history!history.ie5!" "Local\c:!users!d6fe86q!appdata!roaming!microsoft!windows!cookies!" "Local\!IETld!Mutex" "Local\c:!users!d6fe86q!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\c:!users!d6fe86q!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\RasPbFile"28:T980,"" wrote bytes "0857dd750478e6750000000051c1ca759498ca75ee9cca7575dccc75273ecc75efb2d0750000000046ceb775013db87538edb875cfcdb7753123b775de2fb875c4cab77580bbb775aa6eb8759fbbb77592bbb77546bab7750abfb77500000000" to virtual address "0x6EC71000" (part of module "SHFOLDER.DLL") "" wrote bytes "69006e0020002500640020002500770073001a00570069006e0064006f007700730020004c006900630065006e007300650020006900730020006500780070006900720065006400050068006f007500720073000400640061007900" to virtual address "0x003B2000" (part of module "USER32.DLL.MUI") "iexplore.exe" wrote bytes "e9e89ac7f8" to virtual address "0x76B0E30C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b943bdf8" to virtual address "0x76B23B9B" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9652bcef8" to virtual address "0x76B0ADF9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e955a598f8" to virtual address "0x76E53EAE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e96ff1d9f8" to virtual address "0x76B5E9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e937f2d9f8" to virtual address "0x76B5E963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e99ac368f8" to virtual address "0x77272694" (part of module "COMDLG32.DLL") "iexplore.exe" wrote bytes "e9ee7ef5f8" to virtual address "0x769A6143" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "e9c20adbf8" to virtual address "0x76B4D274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9e9f0d9f8" to virtual address "0x76B5E9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e98b8eaaf8" to virtual address "0x76E55DEE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e99cf3d9f8" to virtual address "0x76B5E869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b296ddf8" to virtual address "0x769E9D0B" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "e9efb977fb" to virtual address "0x7418388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e92e0ddbf8" to virtual address "0x76B4CF42" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fda4aaf8" to virtual address "0x76E54731" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9b090c2f8" to virtual address "0x76B0ABE1" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b34bcbf8" to virtual address "0x76B0EC7C" (part of module "USER32.DLL")29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwAzO7MzADAAAAAAAAAAAAE7u7u7u7MAMAAAAAAAAHA7uzMzMzO7swAAAAAAAAADuzEzMzMwM7swAAAAAAAAOzMAO7u7swA7swAAAAAAE7MAAzu7u7MAA7swAAAAADuxADuzO7u7MAA7sDAAAAA7MAG7szu7u7AAA7MQAAABswAAu7M7s7uwAAO7AAAAA7MAADu7uzO7MAAAuzMAAHOxAAA7u7szuzAAADswAACLsAAAO7u7AzMwAAA7sTAAi7AAADM7swO7MAAAO7MAAIuwAAAwA7MDswAAADu7AwCLsAAAAzszMzAAAAA7uzEAA7EAAAOzM7MAAAAAO7swAAOzAAB3t3u3d3YAADu7swABswAHd3eIh3d3QAO7u7MAALswB3d3iIh3d3ADu7u7AAA7MAd3d4iId3dwOzOzOzAAM7MAeIiIiIiHA7swMDuwAAA7MEiIiIiIcDu7s3e7sQAAA7swd4iHcAO7u7ODu7EAAAA7szMAATO7u7u4i7uwAAAAA7u7u7u7u7u7uzu7MAAAAAC7u7u7u7u7u7u7swAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////+AH//+AAf//AAB//AAAP/wAAB/4AAAf8AAAD/AAAAfgAAAH4AAAB+AAAAPAAAADwAAAAcAAAAHAAAAAwAAAAOAAAADgAAAAYAAAAGAAAAAwAAAAMAAAADgAAAA8AAAAPgAAAD+AAAB/wAAA////////////////w==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":81,"unified_at_epoch_ms":1790437558036,"unified_at":"2026-09-26T15:45:58.036Z","metadata":{"hashes":{"sha256":"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084","sha1":"9c38c6fc7c50e184f58f1d97060588d8eca00158","md5":"f4091fe9b459cb86fb44000b547a36d4","sha512":"403a6fa05d7b96773b77471528a3a9cb53883226490b902e251e5a686ffe190b0c3fbc385823f2221853fb105abc6b75e2ea90090055553635e7d1cebcc7958c","ssdeep":"196608:ZYS0pKkb4g7r6lZabJ88b8T1MBNzqwXPtFrqpfowLeUVPYQwYPa:A4Q7OHa18NhMzzqwXlFIftvgT6a","ssdeep_chunks":["196608:ZYS0pKk","196608:YS0pKkb","196608:S0pKkb4","196608:0pKkb4g","196608:pKkb4g7","196608:Kkb4g7r","196608:kb4g7r6","196608:b4g7r6l","196608:4g7r6lZ","196608:g7r6lZa","196608:7r6lZab","196608:r6lZabJ","196608:6lZabJ8","196608:lZabJ88","196608:ZabJ88b","196608:abJ88b8","196608:bJ88b8T","196608:J88b8T1","196608:88b8T1M","196608:8b8T1MB","196608:b8T1MBN","196608:8T1MBNz","196608:T1MBNzq","196608:1MBNzqw","196608:MBNzqwX","196608:BNzqwXP","196608:NzqwXPt","196608:zqwXPtF","196608:qwXPtFr","196608:wXPtFrq","196608:XPtFrqp","196608:PtFrqpf","196608:tFrqpfo","196608:Frqpfow","196608:rqpfowL","196608:qpfowLe","196608:pfowLeU","196608:fowLeUV","196608:owLeUVP","196608:wLeUVPY","196608:LeUVPYQ","196608:eUVPYQw","196608:UVPYQwY","196608:VPYQwYP","196608:PYQwYPa","393216:ZYS0pKk","393216:YS0pKkb","393216:S0pKkb4","393216:0pKkb4g","393216:pKkb4g7","393216:Kkb4g7r","393216:kb4g7r6","393216:b4g7r6l","393216:4g7r6lZ","393216:g7r6lZa","393216:7r6lZab","393216:r6lZabJ","393216:6lZabJ8","393216:lZabJ88","393216:ZabJ88b","393216:abJ88b8","393216:bJ88b8T","393216:J88b8T1","393216:88b8T1M","393216:8b8T1MB","393216:b8T1MBN","393216:8T1MBNz","393216:T1MBNzq","393216:1MBNzqw","393216:MBNzqwX","393216:BNzqwXP","393216:NzqwXPt","393216:zqwXPtF","393216:qwXPtFr","393216:wXPtFrq","393216:XPtFrqp","393216:PtFrqpf","393216:tFrqpfo","393216:Frqpfow","393216:rqpfowL","393216:qpfowLe","393216:pfowLeU","393216:fowLeUV","393216:owLeUVP","393216:wLeUVPY","393216:LeUVPYQ","393216:eUVPYQw","393216:UVPYQwY","393216:VPYQwYP","393216:PYQwYPa","196608:A4Q7OHa","196608:4Q7OHa1","196608:Q7OHa18","196608:7OHa18N","196608:OHa18Nh","196608:Ha18NhM","196608:a18NhMz","196608:18NhMzz","196608:8NhMzzq","196608:NhMzzqw","196608:hMzzqwX","196608:MzzqwXl","196608:zzqwXlF","196608:zqwXlFI","196608:qwXlFIf","196608:wXlFIft","196608:XlFIftv","196608:lFIftvg","196608:FIftvgT","196608:IftvgT6","196608:ftvgT6a"],"imphash":"1f23f452093b5c1ff091a2f9fb4fa3e9"},"file_info":{"file_name":"GoldenEye_Source_5.0.0_to_5.0.6_patch.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":9690395,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1503873664000,"last_seen":1677035124000,"last_multi_scan":1677035124000}},"detections":{"summary":{"verdict":"malicious","score":81,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":19,"suspicious_count":18,"malicious_count":4,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084\" (Offset: 3993547)","origin":"Binary File","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"G?^VHG.cf\"\n Pattern match: \"http://nsis.sf.net/NSIS_Error\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"},{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/71 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"},{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteExW\n FindWindowExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"},{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084\" has a section named \".ndata\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/67 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5da8d4cf028838ca85869b82"},{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00041192-00003212-51973-1-00403489","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00041192-00003212-51973-109-00404814","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL (Target: \"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe\"; Stream UID: \"00041192-00003212-51973-1-00403489\")\n which is directly followed by \"cmp ax, 00000006h\" and \"je 004034D9h\". See related instructions: \"...\n+35 call dword ptr [004080ACh] ;SetErrorMode\n+41 call dword ptr [004080A8h] ;GetVersion\n+47 and eax, BFFFFFFFh\n+52 cmp ax, 00000006h\n+56 mov dword ptr [0042A24Ch], eax\n+61 je 004034D9h\" ... at 00041192-00003212-51973-1-00403489","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GESOURCE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOLDENEYE SOURCE\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsi6F87.tmp\"\n \"\" created file \"%TEMP%\\nsc6FA6.tmp\\UAC.dll\"\n \"\" created file \"%TEMP%\\nsc6FA6.tmp\\LangDLL.dll\"\n \"\" created file \"%TEMP%\\nsc6FA6.tmp\\modern-wizard.bmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"LangDLL.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00054686-00004092)\n Launches browser \"iexplore.exe\" (UID: 00054759-00001412)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6DD70000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00054686-00004092) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"DDEMLMom\"\n \"\" searching for class \"#32770\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00054686-00004092)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:4092 CREDAT:79873\" (UID: 00054759-00001412)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"LangDLL.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"UAC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"{F5857E24-8B77-11E7-ACF3-0A00270556D5}.dat\" has type \"Composite Document File V2 Document No summary info\"\n \"modern-wizard.bmp\" has type \"PC bitmap Windows 3.x format 164 x 314 x 4\"\n \"frameiconcache.dat\" has type \"data\"\n \"RecoveryStore.{F5857E23-8B77-11E7-ACF3-0A00270556D5}.dat\" has type \"Composite Document File V2 Document No summary info\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\OLEACCRC.DLL\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\d6FE86Q\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"iexplore.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"rasman\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"WSearch\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"iexplore.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"WSearch\"\n \"iexplore.exe\" called \"ControlService\" and sent control code \"0XDC\" to the service \"WSearch\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 676)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"LangDLL.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"UAC.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00041192-00003212-51973-119-00405553","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe\" marked \"%TEMP%\\nsx6D73.tmp\" for deletion\n \"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe\" marked \"%TEMP%\\nsc6FA6.tmp\" for deletion\n \"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe\" marked \"%TEMP%\\nsc6FA6.tmp\\LangDLL.dll\" for deletion\n \"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe\" marked \"%TEMP%\\nsc6FA6.tmp\\modern-wizard.bmp\" for deletion\n \"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe\" marked \"%TEMP%\\nsc6FA6.tmp\\UAC.dll\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\nsx6D73.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsc6FA6.tmp\" with delete access\n \"\" opened \"%TEMP%\\nsc6FA6.tmp\\LangDLL.dll\" with delete access\n \"\" opened \"%TEMP%\\nsc6FA6.tmp\\modern-wizard.bmp\" with delete access\n \"\" opened \"%TEMP%\\nsc6FA6.tmp\\UAC.dll\" with delete access\n \"\" opened \"%TEMP%\\nsc6FA6.tmp\\\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/65 Antivirus vendors marked dropped file \"UAC.dll\" as malicious (classified as \"Unsafe\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 676)\n \"\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 676)\n \"\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 676)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00041192-00003212-51973-1-00403489","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":90,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":61,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Sample Crashed","Extracted Files"],"sandbox_reports":[{"id":"5da8d4cf028838ca85869b82","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"malware_family":"CVE-2016-0099","submit_name":"GoldenEye_Source_5.0.0_to_5.0.6_patch.exe","analysis_start_time":"2019-10-17T21:08:48+00:00","indicators_count":{"informative":3,"suspicious":3,"malicious":1},"tags":["Sample Crashed"],"is_in_unified_schema":true},{"id":"59a347b07ca3e133d93eb453","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":81,"malware_family":"HW32.Packed","submit_name":"GoldenEye_Source_5.0.0_to_5.0.6_patch.exe","analysis_start_time":"2017-08-28T00:29:36+00:00","indicators_count":{"informative":17,"suspicious":20,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}],"processes":[{"pid":3212,"ppid":0,"name":"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe","command_line":"","sha256":"2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084","normalized_path":"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe","uid":"00041192-00003212","icon":"$29"},{"pid":4092,"ppid":3212,"name":"iexplore.exe","command_line":"-nohome","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00041192-00003212","uid":"00054686-00004092","icon":"$2a"},{"pid":1412,"ppid":4092,"name":"iexplore.exe","command_line":"SCODEF:4092 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00054686-00004092","uid":"00054759-00001412","icon":"$2b"}],"all_imported_dlls":["imm32.dll","setupapi.dll","pnrpnsp.dll","FWPUCLNT.DLL","mlang.dll","linkinfo.dll","msvcrt.dll","imageres.dll","rtutils.dll","msimg32.dll","WSHTCPIP.DLL","ieproxy.dll","npmproxy.dll","xmllite.dll","oleaut32.dll","userenv.dll","cryptbase.dll","shfolder.dll","ONBttnIE.dll","dui70.dll","url.dll","profapi.dll","sspicli.dll","winnsi.dll","comdlg32.dll","sqmapi.dll","KernelBase.dll","uxtheme.dll","cfgmgr32.dll","crypt32.dll","NapiNSP.dll","winrnr.dll","rpcrt4.dll","apphelp.dll","oleaccrc.dll","riched20.dll","sechost.dll","ntdll.dll","gdi32.dll","usp10.dll","shlwapi.dll","rpcss.dll","UAC.dll","SensApi.dll","msxml3r.dll","nsi.dll","IPHLPAPI.DLL","dhcpcsvc.dll","IEShims.dll","advapi32.dll","devobj.dll","oleacc.dll","iertutil.dll","urlmon.dll","ws2_32.dll","dhcpcsvc6.dll","kernel32.dll","clbcatq.dll","Wldap32.dll","dnsapi.dll","rsaenh.dll","wship6.dll","comctl32.dll","msctf.dll","msxml3.dll","cryptsp.dll","rasadhlp.dll","shell32.dll","psapi.dll","wininet.dll","ieui.dll","mswsock.dll","ExplorerFrame.dll","dwmapi.dll","lpk.dll","version.dll","ntmarta.dll","RpcRtRemote.dll","nlaapi.dll","ole32.dll","netprofm.dll","normaliz.dll","user32.dll","propsys.dll","msasn1.dll","rasapi32.dll","secur32.dll","ieframe.dll","rasman.dll","duser.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UAC.dll","sha256":"2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"LangDLL.dll","sha256":"331ca4b3a311324b463167ec43851146e57a2d90500ac3fd57a7683f6b777ffb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"RecoveryStore.{F5857E23-8B77-11E7-ACF3-0A00270556D5}.dat","sha256":"06a762b3fd6f7ce440578e178e9eda40fc88cfb134bd94c6f5102a0d9587297b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"{F5857E24-8B77-11E7-ACF3-0A00270556D5}.dat","sha256":"16f98d8580cfdb4ea90e34e5c36befc528db80c674b45f93412b47dd413be87a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"frameiconcache.dat","sha256":"382d0698c63743ba7a3a298c90371fb1f06069ded4a2c84147d6b5ae9f2d3841","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"modern-wizard.bmp","sha256":"3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]}],"files_written":[{"path":"%TEMP%\\nsc6FA6.tmp","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%TEMP%\\nsi6F87.tmp","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"C:\\2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084.exe","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"C:\\Users\\d6FE86Q","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%TEMP%\\~DF67BDAEC089251EFC.TMP","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{F5857E23-8B77-11E7-ACF3-0A00270556D5}.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\en-US\\IEFRAME.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%WINDIR%\\system32\\url.dll","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%TEMP%\\~DF33529B8A66A8567E.TMP","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{F5857E24-8B77-11E7-ACF3-0A00270556D5}.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\IETLD\\","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\BROWSEREMULATION\\","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!d6fe86q!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!d6fe86q!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!d6fe86q!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!d6fe86q!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Local\\c:!users!d6fe86q!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Local\\c:!users!d6fe86q!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Local\\c:!users!d6fe86q!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"Local\\c:!users!d6fe86q!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<4092>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59a347b07ca3e133d93eb453"}]}]}},"report_ids":{"sandbox_job_ids":["59a347b07ca3e133d93eb453","5da8d4cf028838ca85869b82"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 2e500e0d1b5b… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2e500e0d1b5b…. Threat score 81/100. 0/28 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 2e500e0d1b5b… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2e500e0d1b5b…. Threat score 81/100. 0/28 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2e500e0d1b5be7572ac3d5fa9a4f80b62c8eac081ac26ba63ae8c2ebe1633084"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 2e500e0d1b5b… — Score 81/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2e500e0d1b5b…. Threat score 81/100. 0/28 AV engines flagged this file. 4 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]