26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cryxos.JS Sample 30d708ca4e2a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 30d708ca4e2a…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 3/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39","keywords":["Malicious","Trojan.Cryxos.JS","malware analysis","sandbox report","threat intelligence","30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39"],"about":{"@type":"SoftwareApplication","name":"Inquiry New Order_ PDF.js","applicationCategory":["script","javascript"],"identifier":"30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Cryxos.JS","antivirusDetections":{"malicious":3,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6462,"\xc8\xb1\xfdD*kA\xc9\x03!L\x11\xf5\xcf\x05\x01\x18\xf3\x10\x7fX54R\xfc\x94\xc2^fk>\r\xfa\x9e\xa81CMz\xb3\xb1\x19\xe6\xb7\xbf\x82L\xc5\xa2p\xc1\x88\x00tO\xf6\x80n3\x96\xd3\xb5\x88\\?\xc5\x86\x0c`\xb43\x0c\xbbk#\xcc\x18BhE\x90\x8f\xd4\xe0\x1d\x04\xb6R\x92:\xfd\xbe&\x1eNX\xc7\xf8#\x9fu\x91hVBfX\x0f\xef\x90\x8f\x06r\xd7;\x87\xc8\xd77\x1e\xb2n\x9e\xa1S\x9e\xad\x13\xe0\xda\xf3\x96\xcf\x04\x1e\x1a\x0bF\x9fv\xcf\x98\xd8\x86c\xe0\xa5\xc5\xf6(\x87\xf9\xb1;X\x11\x1d\x8b\xe4\x98\xde1\x9e\x16\xcb\t\x16O\xbc\x1f\x1fi\x94)[2\xac\x9b\xb0\xaf[\xc1\xbb\xdb+\xd9J\x18tr\xd5x\x8e,~\x01{\x86\x0cNJ.\xf8\xb8\xd5f\xecd\xbb\\I\x0f\xae\xac\x89\x1f\xf4\x11\"h\xf1\xcaQ\xadj\xb2\xbeeON\x1b\x99\xb0\x9e\x81\xe8V", "\x89+\x92\xf7(f>\xa5`W8\x94\x03\x13Z\xc3\xa8\xb7a\xd6\xe4jYI\xe8\xba$\x9b\x96\xbd\x81+\xe7C\x82A\xb9\xc2\xf0\xe0\x04\xfe]\xf6\xb1\"\xf6\xae\x9f\xc7+\x9b\x14(<\xb2\x83\xfc\xcc\x80\x93\xe2?B\x82\xa2\x00\xed\xd8\x7f^\xd6uq\x9fB\x1a\xb43\x01J\xf3:\x0b\x8f\xc2\xe84k;\xf1\x04\xa6eC\x03\x06\xc4I\xd8\xcd\x88\x14<\xbe\rP\r!\xfd\xe53gTV\x16\xd0i0\xa3\x13v\xbc;\x8f\x86I\xec\xb8\xec\x91?\x1fT+\xa5=n\xb3\x98\xb6=\xe8T_f7=\xa1\x9c\rJ\x9d\x03:S;b\xd8t\xbb\x1f-\x02\xe5\xe4\xda\x16\x864\x08\x19\x8ev\xca-+A\xaa\xe5F\x9d>\xfb\xc2\xd6:\xe1J6.\x17\x1a\xa2\x99%\x8dr\xda/x$8T\xd2B\x95\x8cch\xd2\xb8Y\x04\xb2\xc0L'\xa6[\x14\xaa\xd0\xf4\x98\xf9\xbdr$o\xa2b\x0b\xa9\xb3\x13\xd0~\x88\xf1g\n\x14Z\xa7|KC\xcc/\xe0Y7\xf1\xfam=]\xa2\xac?\x0fvk\x86\xa5J2X\x89w\xd93Vl\xcdz\xf7Y\xfa\x14\xfaD\x9bm\xa4H\xf5WUH\x8d\xebs\x89\xa9\x94\xb33a\xc7W\x99\x93\xe9\x9a\x9fc-4\x8b\xdbuaeu-\xd3a\x9bD\xa40\x0b\xb40\xd6\x05R\xb4\xbb\x17\xe8\xbcJ\x99\x1a\xeb\xd5\xe3\xec3/[\xd7\t(\xbcG\x9e^\xd7li\x82\x01\x8d\xe6\x1d\xb6\xac\xecS\xfb\x1bk|l\x1c\x86\x82\x97\xacH\xe9\", "R\x97j\xfb\xf4\xcc\x830\x96\x1f\x81U\xe2O>\xf5{\xb4\x18\x89\x90\xea\xb1r\x8e\x98\xe5$\xc4\xbb\xe0\xb0\x14M\xe1\xa0\xe9\x01\xe7}T\xbf\x1d\xd2\x9aX3\xe3\xec\x05\xdd\xab\xb5AsL-0\xff\x85uB\x1e\xd55\x86\xdeh(\xf3\xd8\xb4;w\x95\x8d\xf6\x9a\xee\xba\x98\x13\x97\xe1fJ_\xd5\xabr\xfe\xd5\x1a\xe7H%\xc3\x12=E\xf87\x937\xf4\x88\x11\x84\x9e\xfd\x14\xa6\xcc7\rE_#\xf9\xfa\x13M\x80\x05\xd8\xaa;\xd5\x1a\xd0\xdd37~\x0b\xa1LMm\x05\xf9Ckn\xec\xcaA\xec\xdb;M\x1b(\xfc\x15\xdf\x14\x90\x9f\xdd\x90Y3\x05\x03\x11\xd3}0G1|\xaa&\xbd\x8e`\xfe\x9f\xa6\xe1\xdb\x84\xfb\x80y\xabW\xb6\xa2\xcb\xee\x14\xc7\xea\x12\xacL1IY\xf6\x83\xf1\xf0\x82Vf\nVa\xe8\xd8\"m\x07Ie\xfc<.p\xdd\x067C@N2\x10\x83\x01\x02\xe7\xbb\xa1S\xc9*\xad\x18\xd7\xba\xe8\xda\xa9`\xceM\x1c\x839\xe8i\xfd\x89#\xbba\xf5\xed\x9e\xfa\xd17\xd9\xc3\xb6\xbei\xe0T1\x1a_\x97\xc6\x84+\xff\xa7\x9d\xea\xd8\x86g0\xa2c\xe4\xcby-\xb6\xe6!C\xa8\xd3O\x12Q\xdfTY\xf1\xa4\xd4\x1c\xaf\x9f]\xe4/\x8b`^\x1c\xb1$\xa9\x15\x1b\x9d\x08\x8c\xb8\xc3\x82\x87\xac\xa3=\xa9\xc53\x1b{3\x95\xfb\x99\x1a!\x88\xc4{\xf1\", "1F\xce\xad\x89\x9d!^\xd0\xbbXbF\xb2\x02\xc0\xd5\x15Vl\xbaml\x87T`\x8c\xa8\x8d|\x9d\x1e;\x7f\xebziM\xa1]c\xc9_\xb8\xd56\x02g2\xb7\x1e\x84\x9a\xdd\x02\xc08\xce\xab\x99Ll\xad\xa0\xe7\xb9g\xcb\xe9\\\x02\xfe6\x1e\xc2\xe4gG]\x9c\xb9X'j\xa6\xd4\r0\x81\xfaf\x19\xe82\x1fpc\xd7\xc1\xb1\x9e}\xcc\xa5\x80\xbc\xac\x01\x0b!\xb6/\xfa%\t\x954\xcc\xa9)\x81!L\xf2B\x01t\x7f\x8b\x93\x03\x00`]\x8d\t\x84\x06Z0\xb4PG\x9b\xf1R\x14\x0b\xce\xab@\xf7\xb9\xe5\xf5\xb8n\x9bC\x1c\xf4\x8d\x1cY\x08\x82\xbbPVF3\x91\r\xdc\xd3CY\xebQ\xa1z\xc4\x11\xceD\xe3r0\x9b=\xb9\x921\xc6Tp\xf1$QI\xcd\xd8 !\xf8\xa3m>5vC#\x92*6\xd3\x10\x9e\xe1\x13\xf96J\xb4h\x88`\x96\x8dd\xab\x9b\x01A`\xcc\xeaF\xc2\xf9\xbd~jm\xc7|\x8f\xbb\xc5\x88X\xe6\xf94\xec\xbf\xbe\x83\x1f&VBR\x9f\x17\xd3\xa4\xee\x12}\xa3Ly\xf5\x87\r\xdf8\x06QR\xc8\xcf\x1e\x86\xeb\xa8\x03\x99\xa9\xd2\xeb\xf3\xff\xdcz\x13\xe0`\xa6\x0er>\x18\x9e\xb7\xf6\x85\x01ND3$qui-\x10IG\x03&\xf0\xbeO\xab\xb3\xea\t\xa6T\xd8\x0f\xf7\x12\xf5z@)\xbe4\x14\x9f\xa7\xdbi\x9a~u^\xbfB\xa5\xe0\x8eB+\xaa\xa9\x18\x85\xfc\r\x9d\xc9+\x", "\xb7\x93\xe8\xaap\xed\x07\x80\x0f\xf7\x1c\xbbJ\xe7\x0f\xb3d\xba&\t\xfb\x83.\xc5\x98\x13=\xf5\xc3\xca\xbd\x16{\xb7\x05\x89\x0e\xe0n\x1b\xe5\x8b\xa4\xf4<\x8e\xe2\x1d\xa8 \x92M\x1f\xf8\x1fM\xe9T\xe4\x8asQ6'\xed\xb8\xdf\x14\x19\x1aZ\x10\xba\xe4\xa3'\xd7>|\xeb\x00\xff*\x8cBZZ\x9c\x1f\x9bS\xc4\x93\x0bU;l\x1d\x88\xb7\x8b\x15<\xec\xbe\x96\xfe\xb3\x84G\xd2\x90\xe3\x1a*\xc9\x1e\xdb\xfaV\xb0.X+\xf9\x18\t\x8f\x9e\x7fBL\x88\xf9z\xfc\x0f\"\xcd'\xe2}\x7f\xed\xd9sR\xc4\x983\xde\x02\x16U\xfb\xa2\xe6\xec\x87\xdc\xce\xa4\xd20\xfe_\n\x87\x86\x9f\xd4\xa3\xb3\x8e\xb0qx\x936\xdb\x93zG|\xe2\xe3\x80\xc015\xa33H\xa6?\x01\xb8b\x87e%\xd7\xcc\xc2\xdbg(Z\xca_'\xff\xec\x9f\x1e\x0c\xd8/Vq\xfb\xad\xa4Y\x87\xab\xf3\xbb)\x89\xa7\x87K\x12\xa6\x8as\x85\x84]\xc5\xf1\x81\xb0[\xe9\x835a\x9b\xfa\x0b^\xe2\xac_\x89\xb2\x96\xaa\x98\xf5Q\xa4\x83\x8d%\x8eU\xb998\x96\xa2\x7f\xbe\xce\xc7\xbe\x110\xe5\xdb\xaf\xee\xe7\xdaJ\x89\x03\xbbQ(\x1f\x8a\x88b3\xbd\x11\x13\xd8\xa6n\xb6\xcf\x04\xa0\xf1\x16\x18\x9a\xad\xaa\x08\x17Z+6\x1f\x8b\xfe)\xc8x;\x0f\xf5\xda\xd7\xc", "\xab\x80-4\x07y\xc1s\xd8\xd69\xc6\xdeq;\xa7\xdc\x1f*\x82\xe6\x11U3\x7f\xc1\xa6\xce1B\xb3\xbc\xab\x9e\x91\x88!\xf8\xd9\x19\x039\xc746,q~W\"\x90v\x16\x83\xe1\xe5{\xc6{\xecZX\xe8\xa0\x91\x8aS\xcfI\xda\xb3d\x8c\xb3\x9a\xb2gZ\x18!*\xd8\x965\xe3\xca!\xddF\xd5\xa9\x92\xf81U\xe9\xbc\xdd\xfcCW\xc1\x1d5A\x81-\xfc\x00\xcd\x8b=w\xd7\xab\xae\x05\xe3\xcd\xd2\x86\x13O\xa8\"\x83\xf6\xc2\x0ff\xcf\x8f\xdb\xf0\x8e\xa7\x8bcyYt;\xea\x16\xa3\xef^v\xb9\x0ehE\xa9\xde\x84R\xec\xa2\xff\x99\xde9\xe8\x82\xc9p\xb0\x1d\x10\xb9\xaf\x85K\x1ch\xe0}\xf9vA\x18\x8b\xbf\xa0,1Ng\x8d\x93\xf1\x7foP\xfa\xc0\xd7aT\xcaQ\xad\x9c1\xbe\n\xc3\x1e\r,f\xfa:\x9dJ\xcf\x1c\xbd\x8ag^=\xc1.G,\xad\xc9\\%\x10\x83\xde\xcd\x8f\x02-\xe9\"\x80\x00\x11\xaaX\x8f\xbd`\xde\xa9K\\\r\x8f\xff\xce\xd0~\x13S\x0f\x10\x0f\xb8\xce\r[\x96\xab0\x82`\xb2.\xf9\xe4\xc4\xb5\x9f\xafJ.&\xb3\xd8\xac\x8c\x9b\xa7\x87w\x1c\x9f\xc8\n\xb9\xc7\x11\xe8a\xcc\xe2\xa4\x96\xb8=\xed\xa3\x17\x1d;\xe4\xe0\x91jLNE$\xc9\x1b\xf4l\xb8\xc0c6\xd2\x97$\xb4`\xa3\x0b\x13\x8c\xb9\xc5\x04pc\x06\xb5\x0e", ""\x1e+U@\xbc`Y\xfa\x96\x0c}y\x8f\xfd#\xb2+o\xdc`%\xdd\x876E\x93\xa9\\\x89L>.\x97\x1e\x8e\xc3\\G\n\x06\xf7\x16\xc7$\xa4\xe7q\x9a\x07\x16\xac \x08r\xcbM\xe9\xb1?\xdf[\x06\xe7\xc6~\x1d\x19\t\x04\xe6\xa1\tYR\xf3~\x9dM\x19\xc4g\xa0\xd4Eq1\xf1\x01$\\\xc0v2!\xf3\x9e\xbcwX\xf1$a\xe5Xg\xe3\x18\xa9\xcb\xc4!\xf7D\x05_\x95\xa0\x91\\\xcb$W@N\xbbN\x9f0A\x9a\x0b\xc1\x9bC\x0b]\xb3\x96\xd2NOf\xf0wu\xe0\xc1;\xcc\xce\xc8a\xb5\xef;_\x88\xa4D\xa96h\x7ff\x1e|\xaf\xbf\x85\xc8\xb3\x98U\x8d\x86'\xdc", "x00\xba\xa6SK#m\x8e\xdf)(g\xe4\xcc[\xb6\xc7\x87\xeb\x8b\x06\xab\xb9_`\x10\xbc+:\x85\xdc\x90\xd6\x9b\xa7\xa7\x8ba", rail1795f:"\xca\xc3\x17\x00x\xd3d'\x17t+Me\xfe\xda\rD\x8ee9\xd4\xaaS.\xe9\xa5igK$\x8f\xe2\xb0\x1c\xda\x04\xe0\xec\x08)\xb9\x15g\x18\xf1\x00\x8c\x00\xba\xeab\xc7T`G\x18\x06W\xdd\xd8[\x1d\x0e\xf1\x0bf\xc2/\xbc\x13V\x07\xecJzw\xdd{\xa2\x1e\xf2\x1f\xc1/\xe4\xbcm7\x8b\x8e\xf5]\x93j\x9c\xbe\x12\x84E\x0fX\xcbAE\xd0\x1dl(g\x05\xc3Ta6\xf1\xc5N]N\x1e0\xc6\xdfu\xd9\xe6\xebj2\xc6ydIb\xc6Op\xa5 \xe8\xa2\x8e/L9\xa0\xf63\x94\x0e{\xdb\x97\xe8k]\x81\x8f\xdf,\xc7l\xf6'\xd7\x823(\rV\xf0\xc3\xd9\xcb\xbey\xbaYc`\x8e\x0c\x87b\xcd\xe0>\xba\xceZy\xc0f\xb1\xe3S\"A\x1e\x87Z\x17\xf1\xa5-\x0f\xed\xc1\x9a\x1c\xbf\xdev\x95j\xa6\xe6\x1e\x19\xbb9\xd48\xd4\xcbj\x8ffA\x8a\xa4\x90\xe5|+H\"\xd2p\xbe`\xd9\r\xa6\xd9\xdb\xd9d\xdf\xb3C\xbc\x9c\xd7\x90#\xfeJ\xb2\xe7\xac\xfd]\x18\x18\xeb8H\x93\x07\n,o\x1b\x85\n\x0b\xc4$\x1a\x87\xbd\x83/\xc1u\x8d\xb9\x92]\x", "a1\xaa\x93\xa7}-\x1d\x9f:\xbe'\x85q\xe9\xfa\xa9\xfe\xd3\xd9\x81\x01\xd0[\xe5(\xfb\xc3\x15/\xf8\xc3\xa7\x0e\xa3WX\x90\xe8Unbq\xc1\xbd\x0b\xd5\x89\xc6\x9c\xee\x03\xea\n\xae\xf7S`:Gf\xb9;\xf6O\xc0\x1cD\xfeSs\xa6\x1c\x02\xb89\x97@\x16e\x8emj\xf1jz\x05\x80>\xff\x1eu\x12\\\xc1\x88=\xd4\x85\x12\xf8\x89\xb47\x1e\xd9&\xe1\xd8\x15!\xd4\x88\xce\xfa\x7f\x92Q;.\xa6\xcb\x00\x16N\xc0'\x8c\xe0\x95\xdc\x81\xd2\xae\xc4\xfc1\xbdz#A\xf9\x08\xc1\x1d\xce41[a\x00\xa1D\x81\x1c\xa4T~M\xa5\x98Y\xd1u\xd4\xad\xa8^T\xab\xe7\x1b\xe0Qm\xce{\x16\x9a\xcb\x87\x98\xb3\xb8k\x84\x92Tg@\xde\xe7\xbb\xd4\xd9\xbc\x11\x01E\xe3\xb7\xd8\xa1se\x82\xe4*\xf3e\xb7\x9d\xfd\xbbo\x9c5D\xa3\xb1g\x0f)\\6\xbc\xa9\x9a\\\xc6\x8a\xdc*\xb3iD\x9b\x08\x10\xb1\xfe\x88\xc1\x17\xc3\x8be\xd6\xfc\xaf\xa7\xed\xa3:\xd3!\xfa\xb6\x8d5\x8a\x1d\xaaQ\xec0\x17\x8c\x16\x99*\xb1\x02X\xbd\x878\xd5#\x9a:\xb6\xb7\xb9\xc2\x97wi}?6\xf4\xc3B\xd2\xd7(\xc6g\x84ZY\xe3\xe4\xe0\xee@\xbba4\r\xc2I\x15\xbfv\x88I1lh\\Yk\x8eC\xfbn\x0f\x95\xcd\x0b.\xcf\xf8\x13\xec\xbf\xf6D\x9dci`\x90(\xebUS\xe9=H\x1", "\x8f\xb8\x80\x83X:/\xee\x96tj\xc7\x817\x13\x06U\"F\xaaNbu\xfd\xf5\xe2\xb9\xba\xe6\xe1\xe8\xa75\x07<\x9eX\xab\xdb\xaa\xe2\xed'?\xb1\xf7\x89h\x119\xb5Gao\x93\x03|\x98\xa2\x95\x98\x90}\xaf\xd5\xd0p\xe6u7|q\xd7\x97c\xc4NkO1\xe1$\xf4\x8b\x82k\xc2N\xe6`\xbd?h\x18Xh\xe8j\xe7K\x94\x1f.\x06)\xc6\xe7\xa0}\n\x9f\xd5\t@6L\xc2za\xd3\x89\x97\xa7{*\x8e7\xa9\xf2K\x7fP\xf8,\xacX%\xef\xb0\xfaR2B\x8d\xfeN<\xcb/\xd9\x82\x103!\x8c\xc6\x80^\x00\x80C\x08\xad`\x15\x8b\x9e\x98\xfc\xa6\x0e\x18&z\x19mo$\xf9\xc1\xcal\xff\\\x07\xa6%\xaak\x1f\xc3\x91h\x05\x93\x1b\xd4\xf6-\t'\n\x162\xa7\xffR[z\x02\n\x97\x02\xa0\x0e \xaa\xa6y\xb2p\x91\xf9\xbe\xe2\xe5\xd1\x98\x89\xec\x91\xf8y\xfeW\xcc+o\x1e\x82?\xce\xae\xa7M\x85\x9f\xa7F\x8f<\xa2\xb40ar#\x16\xed\xf3I\x1c\xbe\x06!\xae\xf4\xa8\xd7\xff\xb0<\xb7-\xa6\xd0$oc\xed\x07J\x13\x97\xb7{5t~\x91/\xa7\xfdi\xfb\xdb\x99\x82\x1d@\xd31\x86f\xd6\xb4\x8a3\x8e.(V\xbb\xb8dF3\xe7Aq\xc6:\x13\xd3\x94\x99F\x9b\x80\x0c-J<\xd8w\x1d\xb2\xf3KE\xe4\x94\xf4\x1e|\xb6\xc6s\x99\xfa\x1d\x9f\x14\xc3\xfb\x1dI\x93\xb8#c\x8f\x9a+\x", "xdd\xf8\xe1\x12\xa3\xd4\x19\x90\xe1\xdc\xaf\x92vb\xa45{Q\x175\xd1\x0c\xe3\xe0\xc0M+\x1e+\x97\x93\"QF\x0f\xa7p\xe8\x94|\x1d\xfe\xe0\x8b\x11\x8d\x19\tk\xca|1\x1eK\xc9\x9b\x85\xce\xf3\xe9hJ\x8f\x80\x8c\x8e\xd2\r\xda\xff\xf6\x84\xf0{\xdeF\xc21\xbe\xba\x14\x8c&\x95\xc7>RP\x0f\x86\xb38\x15D\x91\xfd<\x078\xe6\x96\xc6d\xb9\xe7+-\xb9\xe8\xe8\x06\x132\xb4\x9a&%\xbb\xf0U\xe3b\xc5\xc8<\xdaF\xef\x94T\x16\xb8&\x93\xf5Zq\x04\xa6\xc8\xe5\xe3\xd5\x8d\xd8\xb9\x896t|!a\x0e\xe2i\x91\x17 \xe0\xf39|\xfeN\x12)\xa1h\xc7\x0bA\x1c@\x9ci\xbb\x1e'\\\x01\x9cz\xc1S(*\x8a\xa1V\xf9\xcc\x14\x91\x98b\xc6\xb9#\xfe8e\x8e\x87\x08!\xf9\xf5\x8b\xb1\xaa\xbe\x97F\x93u\xd4\x97\x8b4\xa3kr\xedG\xf9\xe9\xcc\xe5e\xfc\x96x\xb9\xf2\x81\x1al\xfd4\xccht\xf1B\xf6\n)\xbeR9\xd4\x84\x9d\xfbXm\xc0\x0f\x9f\xc1\xbe\xc7+\x1f(\x99 #\xb5\xf6\x9f\xbdm\x15\xd9fK\xaei\xdc\n\x8d\xc5\x97\xab\xaa\x1b\x16`-\x99\xfd\xa6\x04vI\xe5Cd\x1fN\xcc\xa7\xaa*'J\xa9o\xee\xee\xed=\x1a8\x8e\xd0\xec\xe0'}N\x154\x19\xa1\x99\x96\xfa\x9apn\x02\xf2\x82\xa5'\xb1\"-\xf1\xd0\x89\xfb\xbc\x93\x1a\x", "b\xa4v.\"\xc4\x81\xccb\xd0\xc1\xf5\xf3\n\x1b(h\x1b\x8c\xdc\x95\x8e\xc5=QG\x97\xf9\xcc\xff\x89_\x80W\xb5\x8d\x10\xf7{\x06j\xdb\xb8\xb6M\x80j\xdeC\xb5\xc2\xb2=K\x01$\xce>\xe9,W\x1dQ\xd3\xd6r5\xb6\x18\xd7\xa7\x82s\xef\xa7\xfa\xe4\xadnx@l\xd8\xf8X\x98\xa38S\x12@\x99%\x053\xd4\xf0;\xbc\x13\xc5M\xde_\xe2\xd8)\x02\xc6\x9ff]\xadKz%\xc6\xa5\xe1]0|wZ(\xba\xc5n\xfe?\x8c\r\xe9\xa2\xd9\x13\xd5\xed\xf7~\\J \xa6\xef\xac\xb1\x15\xac\x9f\xf8\xa7mA\x9a\xb2\x87\xb3\x80\xf9P\x861PZ?\xc6\xa7\xa3\x91\xcf\xda\x94\xed\x94\xef\xbc\xb2\xab#\x8c\xa9\x95q\xee\x15\x07\x99\x9bx\xe3\x11\x9c\xd19\x00\xbb\x95\x18JK\xabG\x93\xaa(\xc7\xee\x07z\xa2zo\x1e\x9b\x16.\xff\x99\x0b\xe9Y\xa7r_\xd4\xd7V\xd1\x94viI\xf7P\"U\xb0\xa8\xb4\xd8X}\xf7\xc4R\xb7fi\xbc\x82\xc0\xce\x808\nx\xa3\xbcVs\xee\xc5JD!U\x9d \x90M\xf2Q\xa0\x08\xc6v\x1a\xa0\xe520\xb4\xc4\x95J\x98\x91\x19\xd7\xbc\xe4\x1c\x18,\xed[\x88\x01\xb8\xe1\xd4\x15&\xba\x9c\x88\x15\xb8\x87M\xe5 \xa2\xeb\x01c\xdc\x1dZ\x8ay\xbaR\xf1\xcbc\xe4\xed\xbe\xc1\xe4\x90\xdbf\xf0\xe1\xf0 \xec\x8eL\xc0W4z>q\x0f\xa4\x", "xde\x0bsU9\xf4 \xfb\xf0-@\xcbi\x02[\x95\x80M\x9d\xdcL\x14\xde\xf5\x8e\xbe\x11wz9\xea\xfb4\xf3\xe6s\x9a\x8eFQ\xa9\xbcwu\xf9\xf2,3\x83v\xb4<\xa3P\xc3k\xb5uo\xb1bM`\xa3\xa9,[\xff\xc0\xa9M\xebT\xc8|>\xf8\xd8\xfa\x8d\x8c.\xcf\xb5d\xdb\x81\xbbK\xbcFE\x04\xc8q\xed\x9b\xa0cg68\x9cS\xa0g\xc9\x83\xd5S\xbcU\xc88\xa3\xc3\"\xc9\xac\x87\x03*y\xc0Q\xcb\xd7(\xf6\x8d\x02[_\xfb\xc6\x95h\xb9\xa1\xf7\xf6/D\x99\xc9\xc2\xac0 \xffee\xafS_\xcc)\xa1\xf9\xc1\xf5\xc8ehn\xddgc\x12\xed\x10\xd9Ikm7\x91\xa1\x1a8v:\xbf\xc6\x127t\x15\x7f\x0e\x0e\xe14\xf4>\xaa\xb1\x82OQ*\xa7wj\xda}\xfe\xf5|~nb\xa4d<\xb1V\xb5\x1c5\xe9\xa9\x83\xf9l@\xe2=\xc4\xa2\x97\x06\xacj\x800\xb3o\xf8\x08\x13|\xe4~\xb9t\x90#X\xb6K\xfc\xf7(?f\x0cZ\x0e\x11\x9a\xae\xf1\xcc\xbam\xfaf<\x87 `\x80\xd6\xf8tP\xb5\xf9\x9d\x1b\x90\x1e\xb0\xcb\xceV/\x7f\xa4\xbcsQ\xca\xaa\x99\x99\xa0,\x7f\xbc\x82\xbc9n\xb7w%\xd7|\xd9\x0f\xbf\x9d#X\xb3\x8fa\x81\x92\x19U\xd1\xf9\xdd\xd0\xec=\x9aLvkD\xcc!\x95\xa0\x15\x18pJ\x86)\xfe\x9c\xb6arL\xc0\"}\xae\x8b\xbePL\xfa\xc9o\xfe}\xc0\xdf\xb9\xf4-\xde\x91Sy\xc", "9\x81v\xcd\x01\xa1\x9a\xb7\xc2\x1b\x81\x81W\x9c\xfe\xa9q\xa0\x8a=\xf1\xb6\xd9:\x19v\x04\x9e\x98\xe1H\x13\xcd\xe7\xaf\xde0\xe3\x040\r\xcf\xc8\t\xbcE\xd8\xcb\x8dTZ\x86\n\xfd\xebyR\xe2L\x9a\xba\x12N\xb4\xfb\xd1+>\xd1\xed\xbc\x1bM\x1b\x056\xb3o\xed\x11-\x96\x9e\x1ebH\xb4\nv5\xb3c;}\x18\xbd\xc0\x17}\x11-\r\x14x&\x93(\x96\xce\xa5\xb7\xc9A\xfe\x94_\xafE\xc7\xe3\xe1:\xf8\xef\r\xfep\x12\"\xe4\xeb\x1cSc\xb3V\xfe\xb2R\xb1\x1f\t\x92\xed2\x90\xa5\x9f\xbf\x99 \xe2\xd5-\x07\xe8\xf2\x0b@\xd2\xb7>\xd89\x06\n\x93>\x90\xf4a\xe2\xaf\xb1O?\x9da\xd8\x86\x0e\xa3\x01`\x8a\xed\xfb\x9d\x9a+W\xed\xc1\x1cF$\x8c\x95&\xd3\xe46\xcc\xfa\xac \xa4\x90\xd1\x85\x95t\xd7g\xeb>\xbdb\xb2=\x90?\x98\x97\n\xd2\xcel\x04l\xa0V\xba\xdc\xf1t\x9b\x9f*\r\xbb`\x8bl7\xa3#X\x1e\xfb\xca\x00\xd3\x0f\xbb\x9b\xc3\xcfQ.xI\xf7\xc9\x9e\x99B>Q\xf3\xf8o\x8d\xad\xb1y\x0b\xfb\xdf\xdd\xf0z\xc0>\x8cb\xf1U\xbf\x0eL\x97\x16'\xf3\x1e\xac\x9b\xfc\xedY]:\xc9\xbaG\xc2\xd2R$pR\x98\x1aE\xf4\xed\xaa~\xa3N\xfa\xd70'\xda{Vm\xd9/_\xa2tCo5\xfc1\xfd\xc3\x9b(m:\x92\x06o\x956\xe3\xc0\xce", "\x81\xed\xbe\xa5ex \xd1(\x0cH\xe7>^L\x80k\xf3l\xae\xd8S\xb3\x99Cf\xb2~RQ\xf5ecB\xbc}C!\xa5\x05oR\x0c\xd8r\\\xd9\x17\x05\x81\xb5\xe1\x16]\xe7\xa3\xc9$\xfc\xdaaA\xb2G|\x8a\xe3,,#\x8e\xf7\xc4\xd9\xe74b\xf8r\x02\xcf\xcc\x07\xd0V\x16\xeb\xe3\x8a)U\x15\x03]\x83\xcc\xf8Y@\xa9o)M\tX\x99\xcc\xc6XZ\xd4\xf8\x05\xafB\xf2x\t\xca\xf3$\xfb0\xf2\x8fD\xb67\xbc\xd7\xe1\x9b\x7f1\xf4\x1d\n\xe1\x92yQ\x0b\x18\x82w\xe6]\xef\x83\x14P\xc6\xd0\x0e\xd0\x11\x11\xee\x08\x8b\xee\"LD\xbf&A)\xe1\xe6\xd9Y\xe6\xb7aP{BX\x19/2.\xd2^\x86\xa0\x11%\x869\x89k\x96\x81\t\x10\x10\xfeDV\xec\xdf\xec\x98\x9cNx\xb4\x184\x85\xd5\xb3\xfaF\xea\xb8\xd0\r-#\x12~\x02\xbd\x90\xe8\xac%\x98WW\xcd\x14Xz^\x84\x8d\x0e\xd0I\xaf\xc5\x96bo\x911@\xd5\x07\xe6\x9a\xb4q&\xa9\xbec.\xa3\xd9\x05R-66\x96WB\xc1\xde\xed\x08\xabAp\x9d\x18\x92\xcfT\x13\xec.\x84\x83\xe5xFs\xe78-)\xach$\x9a\xc30\x05\xf8y(\x91\x04\xe8\x8a\xb6\xd1\xcdDr\xde\xb4\x1a\x06#\xe2\x89uK\\H$\xeb\x1d\x86\x86\xc1C8\xf12\xe65\xefv\xc2P\"\x1a\xbeK\x03\xa4\xd5\xdd,\x16N\xd1\xa0\t\x80Z\x9a\xe0\xa4\x9c`H\xec\xe5\xd7*\x0fO", line10cec:"\xa7PVZ\xda\x1ddi\x1d\x12\x04\xda\xb2\xca\xdd-\xaaf/\xf3\", "bd\xe0}\xa7\xd5\x06:\x8awAtM\x9dA\xc0\xea7=\xf1~\x18\xfaW\x0e\"\xe8*\x96\xc3\xf6\xd5L\xfa\xb0\x84\xbd\x9e\xbd>\xd4\x91\xcey9%\xc7)\xed\xa4\xbe\x84\xc9\xd8\xb4\xea\xd8o\x8dI\x03\xcf\x97\x04\xaa\x89\x1dr\xcf\xcaO\xdd`\xab#\xffE\xc9L\xc3\x116\xce\x82r\xb1\xca@\xb4\xaa?qX#\x01FmU\xda\xd3\x8b\x1f\xcd\xb0BC\x85$q<\xd9n\xf4W8\x00~{$\xdfa\x9f\x8b\x1fO\x81\r\xcb\xad\xbfW\x98\x1ab\xb9\xb1\x1e!\xf6\x89Nr\x0e\xdcv\xb0\xb2\x07x\xceQ\x1f\xf6\x82IG\x94\x1fM\xb6\xab\xa5B+\xff\xca\x97x\xddpm\x88\xe8\x9fO%\xfe1 \xde\x1d\x1a\xdc\xc8\x01\x19\xdc&\xde\x13\xaf9\xe6\x8f\xf2\x84\xf5&\xdb|\xc3\x93\xb9\x8d\\\xd7\x94\xa0H%b79\xbc\xfc\x8dBE'\xf6\xedk\x899\x8a\xd9\xe4n\xe2\xeb\xe6\xe8,\xa6\x10\xa4D\xa0\xfa\"/\x9e\xd8\xdf>\x98\xc8\x83\x08\x8c\x91\xbd\xb1&\x04\xe5j-\xcf!\x1c8u\xe3\x9f\xfb\xda\xedv\xdc?\xea\x95d\xda\xd0\xc9\x80\xbc\xc7\x9f\x08h\x96\xce;9D\xa5\x1deux\xa6\x9d\x96\x11\x9f\x0f\xb0\xad\xbb\x8a\xbd\xf7f\xe8\xe2\xee\xea\xbdO\x8b+\x96\x01]\x9b\xee\xf3\xae\xd4\x19\x1e\xdd2\xde\xbe\xd2\xf3\x97\xdfk\xbeJ\r\xe1\xff\xe3\x08\xa3\xb7\xa5\", "d~\xbbF\xee6gc\x8cp\x1f\xb6K\x7f\xc4T\xee5\xfa\xe6Pr\xa5\x85.\xd5ldY\xff\x17\x19$\x82t\xca\xc3*\xec\xc1i\x90\xab\x1e\xdf\xfea\xa8\xa8e/\x90\xe8y\xd3\x86\xf6\xde-I\xbfY%g\x88\x01\x88\x99\xb0\xef\xd1d\xc4\xde\x01)\xa7\x1f\xe7\x80HuzWHVr\xac\xb0\xfc\xe6=\xb0K\x0f\xeb\x8a\x96\xc2\xfc\xb2#\"(1($\x08c\x86\x8bi\xf3v\x02\xebR\xb9\xf4}A\x11\xb9\xb8\x89\xd2Z\xfe\x8ci\xa6\xb8j\x11Q\xc3\xae\xb3\x90V\xbf\xe4\x96\x90h\xa2\xae\x8e\xe5`\\UG\xa5\xe7`\xc2v\x08\xd8\xd6E\xe2\xd7\xe2\x874\xe4\x96`\x0b?\xbe\xa1\x17\x93\xe56i\x0fKB\x96\xa5o\x81\xc03\xb5\r<\x85\xe9\x1a\xd6\x9d\x92#*\xf3 C\x8c\xa8\x0c\xc87'c\xf8C\x97W\x9b\xb3,u\xe0K\x91\xc6\xadz~\xe4A\xe2@\x13\x18\xe2\xa4\xdb\xd6\xc1\xa7@\xb5\xe2\xd6S\xe9\x8b\xbat\xb3\x9b\xb2;\xb6\x95>\x8fpbzc\x90q\xa73\xf8R^S9\xd6*\x94`h\xa3\xbb\xe3~z0\x90\x9e\xac\xd7|\x08\x9d\x16\x19\xfbQc\x8d\xfaD\xd2\x97[\n\xf3|\xda>\x19\x01Q\xab\xef\xa5s\xff\x9b\xdc\xf1\x0fsw\x8f\xff3L\xe2\xf0\x13\x81\x17\x1b\x86\xb0\xcb?\xf1\x8e\x9d\x81\xcc\x90\x0eO\xef\xb6\xcf\x8c\"\x95&\x9b\xb1t\xfb\xc5r\xf9\xd7\xa4n4\xb1\xe8", "x06~\x0e\xd4D\x1en\x84aK\x9f\xbd\xc0\xce\xda'\xadP'\xbb\xf0f~\x84\x9a\x149\x1bS\x80\xa6\x03\x8d\n}9\x14\\\x1f\x0c$\\\x89\x94D$\xdc\x1fT\x15\xb1\xc1{\x81N>\xe4\xcd\xe4\xcb\x8d\x15u[\x04\xcc\xae.;\x18D\xa1T\xc1\xf3D~o[\xfclg\x07\x02\xf45\xc1\xeb\xca\xaf\x12\x892\x01M\x05k\xdb\xeb\x87/lp\xcf\xf5\xc0f\xb0?\x8c\xc9\x9b\xec{u\xeb\xb9\xc6\xa5\x169\xecZ\x83\x89\xb4H\x812\xee@\x86\xc9\xea7V\x0c\x9f\x96\xc1iE5+|\x91\xd6\x98R\xea\x99\x0b\x94\xe0O\x9fc\xf3R\x9f\x99\x90O\x96\xf3\x1f\xb9A\xb2\x88\xfb\x1e\xba>:\xb5oY\x11\x06\x86\x8eh8D\x9d\xe7H]l\xa1\x9e\x84\x90?\x11\x0b\xb4\x1e\xb8c\xc0\xfa\x81~2n\x9db7n\x1aI\xa9gW:\x08M%\xf5\x9cV\x95\xd0\x8e4\xcb\x1fJ\xa0u[J\xac\xf1d\x11e8\xaeF\xa9\xfc\xee%\xfd\xc1\x8e\x81\x15\x80s\x7fY\x19\xe2\x13\xd8\xbb\xd6\xfe\x14\x17\x06bvK\xca\x8c\xe5z\xa2vA\x8a\x9f\x80\xb6\x1e\xa6\xd4\x0bCyn\x82A\xeb\xae\x9cC\t\x94\x8f\xf1\x1dO\xd6}\xbd\xe1\xc1\xae\x1d\x13\xcc\x98\xed\xe7\xed\xd1\xc7F\x05\x11T\xd2.\xedS\xc3\xb0\x9fI\xd45\x9c\x96\xd9\x05\x91\x87G\x03\xb3L\xce2\xa6?A\x04O\xbd;\xe1!\xfd\xfc\xba\xcb\xe", "9\xdcFR\x96+\xb8\x15\xc7\xf4\x9a\xe0\x95oR1\xc7\xa8%e\xf1ghA\xea\xb3\xb9\xcdzr\xe6*\x03D$\xb1\x83\xdfg\x84\xeb\xd8\x14rB\xe0\x8e{r\xaeu\xad\xfdW5r\x93\x88\x81)\x81\x82\"\xc7\xdcB\xeb\x85-\xbet\xcaMX\xb4\xf0\xb0\xdb\xafnA\x90e\x8d(y\xd6\xeb\x8f\x12\x1a6y\xe4i\x01\x02\x1fK6\x8d\xf2\xf4kg\xc9\x9c\xe6\x02s\xf8\x00`\xae\xc0:/\x10\x89\xc9z%\x86>/0\xbe\x8e\xd1\xc2]\xd1\xd9\xad\x87V5&\x10\x0e\xc6\x83\xe7l\x81\x1e\xbc>1\xf6\xdc\x05L\xc6\x08\xb9\xe4\x8d\xc0\x15\x904\xb8\rO\xdd5\xa0\x1d\\\x12]Jj\x1d\n\x88\xc2\xdd\x0bi\xb6\xe8\xf0\x06\xa6\xd5\xc4B\xd0\xc8\xfb\x13\xd2\x80D{0\x08}+\xd9i\x83f\x1f\x04T\xe8\x92\xc3\xc6\xfe\x0b\x03\xd9\x9d\x82:\xd7/*\x11Q\xe3\xdc:\xfeJ\x13\tB\x14\xd6\x08\x98\xe7\xe0;.A\x00m\xac%\xe3ih\xe8V\x1e\x88\x8c\xaa\xfeuuh\x8e+\xd1\xbc\x1c&^\xa6\xfc\xcck\xe9\xf4\xe4\r|@J\xaf\xabt#\xec\xfd\xbe\xc3\x96\x8e\x94\x08dk\xeazW{\xc4B\\\x0f+\xe3T\x8cZ\xe3\xb6T\x1a\x1f\xf5\xa9\x8eY\x95\xb2\xbf\xab\xa8\xda\xe4\xee\x9cNs\xcb\xa4\xc3\x93\xaa(\x0b\xd6<\x16", span11c56:"\xf5\xa2j\x17\x95|Uc\x07\xa4\x84~\xe9\xca\xf1\x06"28:T84e,Found string - xaar\x15).\xa0=\\\xa2\x96\x12\x87G\x94\n!%\x89\xc5eEw\xc9\\\xe5\xc2\xc3\xd5\x92\xa7\xd3\xd1ZH{\xe0\x01\x16\xa2\x9a\x19\x0f\x13\xb5?\x15y\x8av\x1a~B@x\xc8\x99\xfcOb\xb2\\.\xd7\x0e1\x81\xc4\x1d\xca\xd1\xaa\xd3\x9cE\xa5\x06\xac\xe0\x9c\x99\xcd\xff\xb3\xcd\xbdaK\xef\xe8\xe8\x14\xf8l\xdaP\xa0\xb4&\xfdi,\xcb\xe2\x91\xf2\"\xc3SC\xe2\x18\x8a?\xb4\x01\x1a[*\xdam\"&\xdd\x03\x87\xd0\x8d\x0bF\xdej\x08\r\xf5\x93l\xa09\x13|\xf5B\x81\x07\x8b\x91\xad\xddW\xa1L\xfd\xcb>_\xdc\xfb\xc54\xceZ\x05&\xa5Ne}\x88\xff\xb2P\xc0\xa6\xcfb.M\xf6\x0e\xde\xcf\xee9\x1e,x8\x86\xd3Z\xe1\xdd(\x80\xcb\xd8\xa9\xfe)\xb4\xb1\x9b\xe7\xb8\xfd\xe8\x0f\x1026\x93j\xf5\x14\x92h\x82\x1e\xa8\xe2\x13\xea\xecy\xa4\x1c;\xe0`\x11\x1b+[\x05-v\xfd/\xa9\x9c(\xe9\xf8\xbf_\xf7)c0I\xf2\xe9\x7f\x1d\x17\xf0\xa8\xb0\x97\xd0$A\xc5\xaf\xd0?A\xe5\xa4!%\xec\x8e3\xcd\xbb\x17.\xe1]\x84\xf9J\x1c\xa5\x97\xbb\xdb;\xe8\x8b;{\x9d\xd1s\xf2\xe1|x\x7f\x13\xbe\x8f\x9b^\x18\xb2\x02\xb2\xf8[\xf4Q\xd42\x07\xb4\xbc\x90\x9d\x90Q9P\xf1\xd6\xeb\xa0\xfe\x84\xb6\xf3\xe1IIq\x99`\x8a;BG\r\x9d\xb; Source: "sample.bin"), Found string - xdd\x15,\xf4\x80pW\xab\x14\x06\xae\xf5\rC\xe6\xfa\xda\x9d\xe1\x8b\x1b\xd81\n1^\xd6\x87\xf4\x82d\xd7U\x82\x9dQ=\xe64\xfb{'\xd6uF\r\xd3\x9c\x8e\xedKLb\xfd\xa6\xad\x80\xc7\xef\xa4\xb3x\x9a\xfdK\x8f(\xe7F\xd3\x00L\xc4\xab+\xce\xf4\xf32\xbd\x0cP\xcf\x07\xc9q\x8e2W\xd1\x10\x81X\xe9\xab\x0e\xf9\xd0f\xcf\xe3\xfb\x9e;\xab\x9b1\xbe\x01#\xff\x9b\x96\xb6\xd9\xc9\x80\xf9\xc4\x94\xd9\x01k#U\x7f\xd1\xd4\\.\xf6\x1c\xd1\x80\x0c] \x9b\x8b\xe3\x92\x89\xee\xad\xc1X]\xe1+L\xab8\xd9}c4U\x9e\x99\x1c\x97\xb4\xb9e\xa10R0\x015\x97\x8av\xa1\xb2\xa7\x90\x8e\xe5.\x12\x7f \xb8\xd0\xd1\xfa\xe1h\xee\x1aF}\x86]\xe6\xe17\x84L[\x97s\xcc\xd4#v)\xdd0\xbd?\x83\xb7F&mb\x1d\x08p~%\xae&%+ [z\xf9\x94?\xecH\xf1b\xd6\xe2qb\xd8\xcbdb\xf5O\x01\xd1", face5b71:"\x8f\xbbd\x9a\xeao]m\x8cj\x97Mf\x07\xbb\xaeV}\xcc\xd4\xa9I\xfb{\xef\x91'!\xab\xc9\xf6$-\x82\xdf\xdc\xe8\xe4\xaa\xd6\x0b\xa2\x1el\xcf\xa3\xe3\x1d~\xcf\x85\x13\xa7\x08\x96\xf0\xb0PO-\x7f5=\xd2\x99\xeb\xd6s\xe0\x07B\xd8B\xc9V`3\xd6\x9b\x8d\xb3\x86\xbc\x08h\xa0,\x01\x13\xf1s>*\xc4\xe4Mj\x8f\xda\xb7\xeaU; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792756921954,"unified_at":"2026-10-23T12:02:01.954Z","metadata":{"hashes":{"sha256":"30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39","sha1":"b293f84bd72d5bed224febbc2f25f1daacabe1cc","md5":"d7bd3518be5d4a8d5520b9eccb005b13"},"file_info":{"file_name":"Inquiry New Order_ PDF.js","file_type":["script","javascript"],"file_type_id":"js","file_size":1345888,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792756849000,"last_seen":1792756850000,"last_multi_scan":1792756850000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":4,"suspicious_count":1,"malicious_count":0,"total":5},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.17202","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"JS:Trojan.Cryxos.17202 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"JS/TrojanDropper.Agent.QKC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cryxos.JS","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"suspicious","value":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-356","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"x08.vg/\\x19q\\\\o\\xf0\\x1c\\x81\\xb4\\x82\\x86\\xbd\\xef\\xab\\xbf\\x9b\\x91\\x93\\x9f\\x19tp\\x83kk$\\x9bn8\\xfer\\xb3\\xaa]\\xe9\\xa0\\x12\\x1d\\xaf\\x12c\\xb8\\x9cz\\x00w\\xffc\\x8a\\xdfjh\\xc3\\x1b5\", Heuristic match: \"],[(456632-37885),core1de2],[(82074+162192),wire6237],[(277753+62896),face1191e],[(98601+76455),wire166d9],[(257631-30150),pin14e7a],[(20366+15913),arc6017],[(943+28063),idx15428],[(2052+20821),env6193],[(381066-7133),unit92da],[(232121+\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Cryxos.JS Sample 30d708ca4e2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 30d708ca4e2a…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 3/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cryxos.JS Sample 30d708ca4e2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 30d708ca4e2a…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 3/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/30d708ca4e2a3dde71855741fd40c581c5a639817798fecffbbd81bb4be3fe39"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cryxos.JS Sample 30d708ca4e2a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 30d708ca4e2a…. Malware family: Trojan.Cryxos.JS. Threat score 100/100. 3/24 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]