25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T934,Found reference to API "Logviewfrm_eOpenLive" (Indicator: "open"; Source: "sample.bin"), Found reference to API "MemberOnlyStatus" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "autoconnectToolStripMenuItem" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "DataGridViewTriState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "/acceptadmin" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "timeFont" (Indicator: "time"; Source: "sample.bin"), Found reference to API "wallImageImageLayout_SelectedIndexChanged" (Indicator: "select"; Source: "sample.bin"), Found reference to API "add_ReceivedThread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "set_LinkVisited" (Indicator: "link"; Source: "sample.bin"), Found reference to API "NicoWebSocket_ConnectionError1" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "NicoWebSocket_ConnectionError1" (Indicator: "socket"; Source: "sample.bin"), Found reference to API "d__85" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "set_vposBaseTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CannotOpenOldDatabase" (Indicator: "open"; Source: "sample.bin"), Found reference to API "PostAsJsonAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "remove_ReceivedThread" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__0" (Indicator: "open"; Source: "sample.bin"), Found reference to API "CToolStripMenuItem_DropDownOpened>d__481" (Indicator: "open"; Source: "sample.bin"), Found reference to API "get_readTemplate" (Indicator: "read"; Source: "sample.bin"), Found reference to API "AutoConnect" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "_tab_SelectedIndexChanged" (Indicator: "select"; Source: "sample.bin"), Found reference to API "k__BackingField" (Indicator: "read"; Source: "sample.bin"), Found reference to API "DFCS_CAPTIONCLOSE" (Indicator: "close"; Source: "sample.bin"), Found reference to API "k__BackingField" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_threadId" (Indicator: "read"; Source: "sample.bin")27:T1204,"INSERT OR REPLACE INTO live(id, thread , name , start , cid , caster,server,port) VALUES(?,?,?,?,?,?,?,?) " (Source: sample.bin, Indicator: "insert or replace into live(id, thread , name , start , cid , caster,server,port) values(?,?,?,?,?,?,?,?) "), "SELECT id, name, start, cid, caster FROM live WHERE id = ?" (Source: sample.bin, Indicator: "select id, name, start, cid, caster from live where id = ?"), "DELETE FROM live WHERE thread = ?" (Source: sample.bin, Indicator: "delete from live where thread = ?"), "SELECT id, thread, name, start, cid, caster,server,port FROM live WHERE cid = ? and start > ? ORDER BY start" (Source: sample.bin, Indicator: "select id, thread, name, start, cid, caster,server,port from live where cid = ? and start > ? order by start"), "DELETE FROM chat" (Source: sample.bin, Indicator: "delete from chat"), "SELECT COUNT(id) FROM user" (Source: sample.bin, Indicator: "select count(id) from user"), "SELECT DISTINCT user.cid, community.name, COUNT(user.id) FROM user INNER JOIN community ON user.cid = community.id GROUP BY(user.cid)" (Source: sample.bin, Indicator: "select distinct user.cid, community.name, count(user.id) from user inner join community on user.cid = community.id group by(user.cid)"), "SELECT cid, id FROM user" (Source: sample.bin, Indicator: "select cid, id from user"), "SELECT id, name, owner FROM community" (Source: sample.bin, Indicator: "select id, name, owner from community"), "SELECT DISTINCT live.thread,live.id , live.name FROM live WHERE live.cid = ?" (Source: sample.bin, Indicator: "select distinct live.thread,live.id , live.name from live where live.cid = ?"), "SELECT COUNT(chat.date) FROM chat WHERE chat.uid = ? AND chat.cid = ? GROUP BY chat.uid, chat.cid" (Source: sample.bin, Indicator: "select count(chat.date) from chat where chat.uid = ? and chat.cid = ? group by chat.uid, chat.cid"), "INSERT OR REPLACE INTO user(id, permhandlename,cid,color,status,force,bouyomi,count1,isMember,Lastupdate,regdate) VALUES(?,?,?,?,?,?,?,?,?,?,?) " (Source: sample.bin, Indicator: "insert or replace into user(id, permhandlename,cid,color,status,force,bouyomi,count1,ismember,lastupdate,regdate) values(?,?,?,?,?,?,?,?,?,?,?) "), "SELECT no , lid , uid , cid , message , mail , vpos , date , premium , anonymity , thread , locale FROM chat ORDER BY lid,thread" (Source: sample.bin, Indicator: "select no , lid , uid , cid , message , mail , vpos , date , premium , anonymity , thread , locale from chat order by lid,thread"), "DELETE FROM community WHERE (id NOT IN (SELECT DISTINCT cid FROM user)) AND (id NOT IN (SELECT DISTINCT cid FROM live)) " (Source: sample.bin, Indicator: "delete from community where (id not in (select distinct cid from user)) and (id not in (select distinct cid from live)) "), "SELECT name FROM community WHERE id = ?" (Source: sample.bin, Indicator: "select name from community where id = ?"), "INSERT OR REPLACE INTO community(id, name, owner) VALUES(?,?,?) " (Source: sample.bin, Indicator: "insert or replace into community(id, name, owner) values(?,?,?) "), "SELECT id, thread, name, start, cid, caster,server,port FROM live" (Source: sample.bin, Indicator: "select id, thread, name, start, cid, caster,server,port from live"), "SELECT no, message, date, thread ,lid FROM chat WHERE cid = ? AND uid = ? ORDER BY lid DESC, no DESC LIMIT 50" (Source: sample.bin, Indicator: "select no, message, date, thread ,lid from chat where cid = ? and uid = ? order by lid desc, no desc limit 50"), "SELECT community.id, community.name, user.id,permhandlename as username FROM user INNER JOIN community ON community.id = user.cid WHERE user.id = ?" (Source: sample.bin, Indicator: "select community.id, community.name, user.id,permhandlename as username from user inner join community on community.id = user.cid where user.id = ?"), "SELECT A.cid,A.permhandlename,A.Lastupdate FROM user A WHERE A.id = ? and A.Lastupdate!=0" (Source: sample.bin, Indicator: "select a.cid,a.permhandlename,a.lastupdate from user a where a.id = ? and a.lastupdate!=0"), "DELETE FROM user WHERE cid = ?" (Source: sample.bin, Indicator: "delete from user where cid = ?"), "SELECT cid, id FROM user where " (Source: sample.bin, Indicator: "select cid, id from user where "), "DELETE FROM user WHERE cid = ? AND id = ?" (Source: sample.bin, Indicator: "delete from user where cid = ? and id = ?"), "DELETE FROM chat WHERE cid = ?" (Source: sample.bin, Indicator: "delete from chat where cid = ?"), "DELETE FROM chat WHERE thread = ? AND no = ?" (Source: sample.bin, Indicator: "delete from chat where thread = ? and no = ?")28:T892,Pattern match: "http://ichiba.nicovideo.jp/javascripts/prototype.js?rev=20090406", Heuristic match: "user.id", Pattern match: "http://yarimasu.ankochan.net/d/%a5%af%a5%e9%a5%a4%a5%a2%a5%f3%a5%c8id%c5%d0%cf%bf%ca%fd%cb%a1", Pattern match: "http://live.nicovideo.jp/", Pattern match: "https://api.live2.nicovideo.jp/api/v1/user/nickname?userid={0", Heuristic match: ".live.nicovideo.jp", Pattern match: "http://live.nicovideo.jp", Pattern match: "http://goo.gl/2qi8h", Pattern match: "http://usericon.nimg.jp/usericon/{0}/{1}.jpg?{2", Pattern match: "http://ux.getuploader.com/izakaya_megane/rss", Pattern match: "https://oauth.nicovideo.jp/v1/id_tokens/{0}.json", Pattern match: "https://www.nicovideo.jp/watch/", Pattern match: "http://live2.nicovideo.jp/unama/api/v2/programs/categories", Pattern match: "https://api.live2.nicovideo.jp/api/v1/unama/user/onairs?userid={0", Pattern match: "http://api.microsofttranslator.com/v2/http.svc/translate?text={0}&to={1", Pattern match: "http://www.assoc-amazon.jp/s/impression-counter?tag=niconicoitem-22&o=9", Heuristic match: ".twitter.com", Pattern match: "https://com.nicovideo.jp/community/{0", Pattern match: "http://uni.res.nimg.jp/img/zero_my/icon_folder_lock_active.png", Pattern match: "https://ch.nicovideo.jp/channel/{0", Pattern match: "http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd", Pattern match: "http://yarimasu.ankochan.net/d/%c2%d0%b1%fe%b0%ec%cd%f7#{0", Pattern match: "https://unidroid.cloud/ankonyanko/2021/06/17/%e3%82%a8%e3%83%a9%e3%83%bc%e3%81%ae%e3%81%94%e5%a0%b1%e5%91%8a%e3%81%af%e6%83%85%e5%a0%b1%e3%82%82%e3%81%8f%e3%81%a0%e3%81%95%e3%81%84/", Pattern match: "https://account.nicovideo.jp/my/applications", Pattern match: "https://api.live2.nicovideo.jp/api/v1/unama/programs/extension?userid={0}&nicoliveprogramid={1", Heuristic match: ".nicovideo.jp", Pattern match: "http://ext.nicovideo.jp/thumb_community/{0", Pattern match: "https://live.nicovideo.jp/watch/", Heuristic match: "ankoplugin2.iplugin.name", Heuristic match: " *.se", Pattern match: "http://uni.res.nimg.jp/img/zero_my/icon_folder_active.png", Pattern match: "https://api.live2.nicovideo.jp/api/v1/unama/ssng?userid={0}&nicoliveprogramid={1"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 301f0b5e02a0… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 301f0b5e02a0…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"nicoView2.exe\",\"applicationCategory\":[\"peexe\",\"assembly\",\"executable\"],\"identifier\":\"301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793397361170,"unified_at":"2026-10-30T21:56:01.170Z","metadata":{"hashes":{"sha256":"301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d","sha1":"7c2592bd701f92fd795d4e08ad8708cf31cc6e8f","md5":"5784332972e386b984b1b7c2469b4e45"},"file_info":{"file_name":"nicoView2.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1172480,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793397344000,"last_seen":1793397344000,"last_multi_scan":1793397344000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":16,"suspicious_count":0,"malicious_count":0,"total":16},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to retrieve geographical location"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$26","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"\" (Indicator: \"text/javascript\"; Source: \"sample.bin\"), Found string \"\" (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"k__BackingField\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"get_waku_twitter_enabled\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"b__0\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"waku_input_twitter_tag\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"set_waku_twitter_enabled\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \".twitter.com\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"input_twitter_tag\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"k__BackingField\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"get_waku_input_twitter_tag\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"twitter_disabled\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"set_waku_input_twitter_tag\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"waku_twitter_enabled\" (Indicator: \"twitter\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$27","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"SetThreadExecutionState\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"FreeConsole\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"AttachConsole\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetWindowDC\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReleaseDC\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"OpenFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.live2.nicovideo.jp\", Found HTTPS url \"https://oauth.nicovideo.jp\", Found HTTPS url \"https://www.nicovideo.jp\", Found HTTPS url \"https://com.nicovideo.jp\", Found HTTPS url \"https://ch.nicovideo.jp\", Found HTTPS url \"https://unidroid.cloud\", Found HTTPS url \"https://account.nicovideo.jp\", Found HTTPS url \"https://live.nicovideo.jp\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.0.0.13\", \"2.0.5.1\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve geographical location","description":"\"countrycode\" (Indicator: \"countrycode\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-575","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"/sendmessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowByTitle\" (Indicator: \"findwindow\"; Source: \"sample.bin\"), Found reference to API \"FrmSendMessage_TextChanged\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"FrmSendMessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowByTitle\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"_password\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"k__BackingField\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve type of COM object","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559.001","id":"string-569","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 301f0b5e02a0… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 301f0b5e02a0…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d"}],["$","meta","4",{"property":"og:title","content":"Sample 301f0b5e02a0… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 301f0b5e02a0…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/301f0b5e02a01758eca1fda33765c7a117d74664df636fdce0325adbc775ee0d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 301f0b5e02a0… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 301f0b5e02a0…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]