26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T42c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 2f176233c5cc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2f176233c5cc…. Threat score 100/100. 0/24 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c"],"about":{"@type":"SoftwareApplication","name":"ai-bridge.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T2b96,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "UnlockFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "NtOpenFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "closesocket"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "getsockname"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStartup"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "LockFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateNamedPipeFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "WSACleanup"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimer"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetErrorInfo"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SleepEx"; Source: "sample.bin"), Found reference to API (Indicator: "WSASend"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingA"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDescription"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetOverlappedResult"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SysStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "getpeername"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "getsockopt"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CancelIo"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SwitchToThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringOrdinal"; Source: "sample.bin"), Found reference to API (Indicator: "recvfrom"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "ioctlsocket"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "InitOnceComplete"; Source: "sample.bin")28:T105b,Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\winsock.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\helpers\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\env\windows.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\bstr\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\navigate.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "reentrant init/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\cell\once.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\path.rs" (Indicator: "/rustc/"; Source: "sample.bin"), file/memory contains long string with (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\once_lock.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\memchr.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\io\error\windows.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "advancing IoSlice beyond its length/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\io\io_slice\windows.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "to_digit: invalid radix -- radix must be in the range 2 to 36 inclusive/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\char\methods.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace. \" (Indicator: "rust_backtrace"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\stdio\windows.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "use of std::thread::current() is not possible after the thread's local data has been destroyed/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\current.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "too many running threads in thread scope/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\scoped.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\borrow.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "Backtrace /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\backtrace.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\ops\function.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\zero.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string " /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\sort\stable\quicksort.rs" (Indicator: "/rustc/"; Source: "sample.bin")29:T558f,Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\winsock.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\helpers\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\env\windows.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\bstr\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\navigate.rs", Heuristic match: "reentrant init/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\cell\once.rs", Heuristic match: "$__toml_private_datetimeo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\parser\key.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\path.rs", Heuristic match: "aespclmulqdqrdrandrdseedtscmmxssesse2sse3ssse3sse4.1sse4.2sse4ashaavxavx2sha512sm3sm4avx512favx512cdavx512eravx512pfavx512bwavx512dqavx512vlavx512ifmaavx512vbmiavx512vpopcntdqavx512vbmi2gfnivaesvpclmulqdqavx512vnniavx512bitalgavx512bf16avx512vp2intersectav", Heuristic match: "src\backend_tail.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\once_lock.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\memchr.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\io\error\windows.rs", Heuristic match: "advancing ioslice beyond its length/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\io\io_slice\windows.rs", Heuristic match: "no more values in next_value_seed, internal error in valuedeserializero:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\deserializer\table.rs", Heuristic match: "to_digit: invalid radix -- radix must be in the range 2 to 36 inclusive/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\char\methods.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\stdio\windows.rs", Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyed/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\current.rs", Heuristic match: "too many running threads in thread scope/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\scoped.rs", Heuristic match: "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\borrow.rs", Heuristic match: "assertion failed: self.is_char_boundary(new_len) at line o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\error.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\parser\devalue.rs", Heuristic match: "backtrace /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\backtrace.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\ops\function.rs", Heuristic match: "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\zero.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\parser\inline_table.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs", Heuristic match: " /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\mod.rs", Heuristic match: "/rust/deps\addr2line-0.25.1\src\function.rs", Heuristic match: "0o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\parser\value.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\sort\stable\quicksort.rs", Heuristic match: "assertion failed: digits < 40/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\wtf8.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\num.rs", Heuristic match: "local datelocal datetimeoffset datetimelocal timeinternal error: entered unreachable code: unsupported datetime combinationo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_datetime-0.7.5+spec-1.1.0\src\datetime.rs", Heuristic match: "failed to spawn thread/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\functions.rs", Heuristic match: "\....debug_abbrev.debug_addr.debug_aranges.debug_info.debug_line.debug_line_str.debug_loc.debug_loclists.debug_macinfo.debug_macro.debug_ranges.debug_rnglists.debug_str.debug_str_offsets.debug_typeslock count overflow in reentrant mutex/rustc/8bab26f4f68e0", Heuristic match: "fatal runtime error: rust panics must be rethrown, aborting fatal runtime error: rust cannot catch foreign exceptions, aborting overflow in duration::new/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\time.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\sync.rs", Heuristic match: "wuser-provided comparison function does not correctly implement a total order/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\sort\shared\smallsort.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\string.rs", Heuristic match: "missing table openinvalid key-value pairunexpected contentmissing valueextra `=`internal error: entered unreachable codeo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_parser-1.1.3+spec-1.1.0\src\parser\document.rs", Heuristic match: "tart_window_secsrestart_window_senabledmax_restartsrestart_window_secsnext_value_seed called before next_key_seedo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_datetime-0.7.5+spec-1.1.0\src\de.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\windows-result-0.3.4\src\com.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\winnow-1.0.4\src\stream\token.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\rc.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\strategy\dragon.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\net\connection\socket\windows.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_spanned-1.1.1\src\de.rs", Heuristic match: "always called after `serialize_key`o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\ser\document\map.rs", Heuristic match: "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\mod.rs", Heuristic match: "fatal runtime error: out of tls indexes, aborting /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\thread_local\key\windows.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\wtf8.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\symbolize\gimli.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\process\windows.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\fs\windows\dir.rs", Heuristic match: "called `result::unwrap()` on an `err` value/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\waker.rs", Heuristic match: " -fn() -> + : punycode{}.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\process\mod.rs", Heuristic match: "/rust/deps\gimli-0.32.3\src\read\line.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\unicode\unicode_data.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\display_buffer.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\mod.rs", Heuristic match: "nulerrorvarsoverflow when adding duration to instantpanicked at : frameipsymbol_addressbarriertry_lock failed because the operation would blockaccesserror/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\buffered\linewritershim.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\panicking.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\symbolize\gimli\coff.rs", Heuristic match: "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\list.rs", Heuristic match: "assertion failed: n <= init_unfilled/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\io\borrowed_buf.rs", Heuristic match: "$__toml_private_always called after `serialize_key`o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\ser\value\map.rs", Heuristic match: "src\supervisor.rs", Heuristic match: "token spans are valido:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_parser-1.1.3+spec-1.1.0\src\parser\event.rs", Heuristic match: "10 offset/rust/deps\object-0.37.3\src\read\coff\section.rs", Heuristic match: "zcws.jo", Heuristic match: "'''o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_parser-1.1.3+spec-1.1.0\src\lexer\mod.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_core-1.0.229\src\de\mod.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\read.rs", Heuristic match: "$__toml_private_$__toml_private_datetimenext_value_seed called before next_key_seedo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_datetime-0.7.5+spec-1.1.0\src\de.rs", Heuristic match: " { , : { , (( attempted to format a map value before its key/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\builders.rs", Heuristic match: "internal error: entered unreachable code/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\array.rs", Heuristic match: "rust_lib_backtracerust_backtraceassertion failed: self.is_code_point_boundary(new_len)/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\wtf8\mod.rs", Heuristic match: "assertion failed: len >= size_of::()/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\net\connection\socket\mod.rs", Heuristic match: "\\b\t\n\f\r\\o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_writer-1.1.2+spec-1.1.0\src\string.rs", Heuristic match: "too many active read locks on rwlock/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\sync\rwlock\futex.rs", Heuristic match: "/rust/deps\addr2line-0.25.1\src\unit.rs", Heuristic match: "assertion failed: d.mant > 0/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\strategy\grisu.rs", Heuristic match: "lazycell instance has previously been poisoned/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\cell\lazy.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\pattern.rs", Heuristic match: "a formatting trait implementation returned an error when the underlying stream did not/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\fmt.rs", Heuristic match: "mid > len/rust/deps\memchr-2.7.6\src\arch\all\packedpair\mod.rs", Heuristic match: "invalid parameters to layout::from_size_align/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\ip_addr.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\env.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\stdio.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\panicking.rs", Heuristic match: "entity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directoryis a dir", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\context.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\fmt.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\rt.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\id.rs", Heuristic match: "[o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\ser\document\buffer.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\raw_vec\mod.rs", Heuristic match: "/rust/deps\object-0.37.3\src\read\coff\symbol.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\process.rs", Heuristic match: "duplicate keyrecursion limito:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\parser\document.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\socket_addr.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\parser.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\node.rs", Heuristic match: "formatting argument out of range/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\time.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\mod.rs", Heuristic match: "a display implementation returned an error unexpectedly/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\string.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\os\windows\net\addr.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\macros.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\ffi\os_str.rs", Heuristic match: "byte arrayunit valueoption valuenewtype structsequencemapenumunit variantnewtype varianttuple variantstruct variantanything at allunit`start``start` or `end``end``unbounded`, `included` or `excluded``ok` or `err``secs` or `nanos``secs_since_epoch` or `nano", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_core-1.0.229\src\format.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\net\hostname\windows.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\args\windows.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\wrapping.rs", Heuristic match: "ai_bridge_first_idge_boot_error=ai_bridge_boot_e/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\str.rs", Heuristic match: "fatal runtime error: thread local panicked on drop, aborting lock acquisition failed due to i/o errorlock acquisition failed because the operation would block/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\time.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\index.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\local.rs", Heuristic match: "/rust/deps\rustc-demangle-0.1.27\src\legacy.rs", Heuristic match: "unable to represent value as stringo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\table.rs", Heuristic match: "/rust/deps\memchr-2.7.6\src\arch\all\twoway.rs", Heuristic match: "assertion failed: match track_edge_idx { leftorright::left(idx) => idx <= old_left_len, leftorright::right(idx) => idx <= right_len, }/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\node.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\os_str\wtf8.rs", Heuristic match: "!$'+.158;/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\dec2flt\parse.rs", Heuristic match: " /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\unicode\printable.rs", Heuristic match: "/rust/deps\memchr-2.7.6\src\arch\generic\packedpair.rs", Heuristic match: "/rust/deps\memchr-2.7.6\src\memmem\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\process\windows\child_pipe.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\bignum.rs", Heuristic match: "enabledmax_restartsrestart_window_secsno more values in next_value_seed, internal error in valuedeserializero:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\deserializer\table.rs", Heuristic match: "anydata provided does not contain a nul cannot parse float from empty stringinvalid float literal/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\lossy.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\buffered\bufwriter.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\once.rs", Heuristic match: " \\\\ /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\mod.rs", Heuristic match: "falsetrueo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\thread\windows.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\time.rs", Heuristic match: "/rust/deps\object-0.37.3\src\read\archive.rs", Heuristic match: "year or hourdatemonth`-` (mm-dd)daytimehour`:` (hh:mm)minutesecondnanosecondoffset/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\mod.rs", Heuristic match: "varsthread name may not contain interior null bytes/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\thread.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_parser-1.1.3+spec-1.1.0\src\decoder\string.rs", Heuristic match: "assertion failed: parts.len() >= 4/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\wtf8\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\str.rs", Heuristic match: "lazylock instance has previously been poisoned/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\lazy_lock.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\map\entry.rs", Heuristic match: "{invalid syntax}{recursion limit reached}?`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.27\src\v0.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\de.rs", Heuristic match: "not implemented: `set_permissions_nofollow` is currently only implemented on unix platforms/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\fs\mod.rs", Heuristic match: "/rust/deps\addr2line-0.25.1\src\line.rs", Heuristic match: "userprofile/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\paths\windows.rs", Heuristic match: "assertion failed: edelta >= 0/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\diy_float.rs", Heuristic match: "o:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\value\index.rs", Heuristic match: "unexpected leading zeroredundant numeric signo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml_parser-1.1.3+spec-1.1.0\src\decoder\scalar.rs", Heuristic match: "someo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\value.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\symbolize\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\alloc.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\dec2flt\decimal_seq.rs", Heuristic match: ", expected nothingo:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\toml-0.9.12+spec-1.1.0\src\de\error.rs", Heuristic match: "a charactera stringexplicit panico:\\tools\cargo_home\registry\src\index.crates.io-1949cf8c6b5b557f\serde_core-1.0.229\src\de\mod.rs", Heuristic match: "capacity overflow/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\mod.rs", Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\fs\windows.rs", Heuristic match: "/rust/deps\gimli-0.32.3\src\read\abbrev.rs"2a:T42d,Observed email domain:"tion in a context in which it is not valid.when evaluating call frame instructions, found a `dw_cfa_restore_state` stack pop instruction, but the stack was empty, and had nothing to pop.do not have unwind info for the given address.an offset value was larger than the maximum supported value.the given pointer encoding is either unknown or invalid.did not find an entry at the given offset.the given offset is out of bounds.found an unknown cfi augmentation.we do not support the given pointer encoding yet.registers larger than `u16` are not supported.the cfi program defined more register rules than we have storage for.attempted to push onto the cfi stack, but it was already at full capacity.the `.eh_frame_hdr` binary search table claims to be variable-length encoded, which makes binary search impossible.the `dw_ut_*` value for this unit is not supported yetranges involving addressindex are not supported yetnonzero segment size not supported yeta compilation unit or type unit is missing its top level die.a die att" [Source: sample.bin]1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793504957024,"unified_at":"2026-11-01T03:49:17.024Z","metadata":{"hashes":{"sha256":"2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c","sha1":"f7d8d491181634deb7473f876613e61fcc2a736e","md5":"442e0b932db2cf589f5a2f544c0acf8e"},"file_info":{"file_name":"ai-bridge.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2178752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793504950000,"last_seen":1793504950000,"last_multi_scan":1793504950000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":34},"sandbox_signatures":{"informative_count":57,"suspicious_count":0,"malicious_count":1,"total":58},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"sample.bin\"), Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-402","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\NamedPipe\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$28","origin":"sample.bin","id":"string-943","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"GetHostNameW\" (Indicator: \"gethostname\"; Source: \"sample.bin\"), Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"sample.bin\"), Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"sample.bin\"), Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \"invalid socket address\" (Indicator: \" socket \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), Found reference to API \"#$*+-./:?@\\_GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\"), Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"sample.bin\", Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"sample.bin\"), Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NULmaximum number of ProcThreadAttributes exceeded; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Sample 2f176233c5cc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2f176233c5cc…. Threat score 100/100. 0/24 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 2f176233c5cc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2f176233c5cc…. Threat score 100/100. 0/24 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2f176233c5cc5470940976427167668ac33c7881db5dd3eaf2d4b33b86613c6c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 2f176233c5cc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2f176233c5cc…. Threat score 100/100. 0/24 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]