26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 319e9dc36678… — Score 94/100 — Hybrid Analysis","description":"Malicious verdict for sample 319e9dc36678…. Malware family: Trojan.Generic. Threat score 94/100. 17/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a"],"about":{"@type":"SoftwareApplication","name":"Last News Interview - Archive.scr","applicationCategory":["peexe","executable"],"identifier":"319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a","additionalType":"Malicious sample"},"threatScore":94,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":26},"behavioralIndicators":{"malicious":4,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Te46,Found API call GetVersion@KERNEL32.dll (Target: "Last_News_Interview_Archive.scr.exe.bin"; Stream UID: "55565-1851-004070F0") which is directly followed by "cmp eax, 80000000h" and "push eax". See related instructions: "... +155 call dword ptr [0042E254h] ;GetVersion +161 cmp eax, 80000000h +166 sbb eax, eax +168 neg eax +170 mov dword ptr [0043D1F4h], eax +175 neg eax +177 push 00000000h +179 sbb eax, eax +181 and eax, 02000000h +186 push eax +187 mov eax, dword ptr [esp+34h] +191 push 00000003h +193 push 00000000h +195 push 00000000h +197 push 40000000h +202 push eax" ... at 55565-1851-004070F0 Found API call GetVersionExA@KERNEL32.dll (Target: "Last_News_Interview_Archive.scr.exe.bin"; Stream UID: "55565-1987-0040EEAF") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "... +35 call 0041A070h +40 add esp, 0Ch +43 lea eax, dword ptr [ebp-00000098h] +49 push eax +50 mov dword ptr [ebp-00000098h], 00000094h +60 call dword ptr [0042E1B0h] ;GetVersionExA +66 mov ecx, dword ptr [ebp-04h] +69 xor eax, eax +71 cmp dword ptr [ebp-00000088h], 02h +78 sete al +81 xor ecx, ebp" ... at 55565-1987-0040EEAF Found API call GetVersion@KERNEL32.DLL (Target: "Last_News_Interview_Archive.scr.exe"; Stream UID: "00138765-00001008-4043-411-012970F0") which is directly followed by "cmp eax, 80000000h" and "push eax". See related instructions: "... +155 call dword ptr [012BE254h] ;GetVersion +161 cmp eax, 80000000h +166 sbb eax, eax +168 neg eax +170 mov dword ptr [012CD1F4h], eax +175 neg eax +177 push 00000000h +179 sbb eax, eax +181 and eax, 02000000h +186 push eax +187 mov eax, dword ptr [esp+34h] +191 push 00000003h +193 push 00000000h +195 push 00000000h +197 push 40000000h +202 push eax" ... at 00138765-00001008-4043-411-012970F0 Found API call GetVersionExA@KERNEL32.DLL (Target: "Last_News_Interview_Archive.scr.exe"; Stream UID: "00138765-00001008-4043-544-0129EEAF") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "... +35 call 012AA070h +40 add esp, 0Ch +43 lea eax, dword ptr [ebp-00000098h] +49 push eax +50 mov dword ptr [ebp-00000098h], 00000094h +60 call dword ptr [012BE1B0h] ;GetVersionExA +66 mov ecx, dword ptr [ebp-04h] +69 xor eax, eax +71 cmp dword ptr [ebp-00000088h], 02h +78 sete al +81 xor ecx, ebp" ... at 00138765-00001008-4043-544-0129EEAF Found API call GetVersion@KERNEL32.DLL (Target: "Last_News_Interview_Archive.scr.exe"; Stream UID: "00138765-00001008-13133-411-012970F0") which is directly followed by "cmp eax, 80000000h" and "push eax". See related instructions: "... +155 call dword ptr [012BE254h] ;GetVersion +161 cmp eax, 80000000h +166 sbb eax, eax +168 neg eax +170 mov dword ptr [012CD1F4h], eax +175 neg eax +177 push 00000000h +179 sbb eax, eax +181 and eax, 02000000h +186 push eax +187 mov eax, dword ptr [esp+34h] +191 push 00000003h +193 push 00000000h +195 push 00000000h +197 push 40000000h +202 push eax" ... at 00138765-00001008-13133-411-012970F0 Found API call GetVersionExA@KERNEL32.DLL (Target: "Last_News_Interview_Archive.scr.exe"; Stream UID: "00138765-00001008-13133-544-0129EEAF") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "... +35 call 012AA070h +40 add esp, 0Ch +43 lea eax, dword ptr [ebp-00000098h] +49 push eax +50 mov dword ptr [ebp-00000098h], 00000094h +60 call dword ptr [012BE1B0h] ;GetVersionExA +66 mov ecx, dword ptr [ebp-04h] +69 xor eax, eax +71 cmp dword ptr [ebp-00000088h], 02h +78 sete al +81 xor ecx, ebp" ... at 00138765-00001008-13133-544-0129EEAF28:T4db,LockResource@KERNEL32.dll at 55565-1740-0040BB92 FindResourceW@KERNEL32.dll at 55565-1739-00408070 FindResourceW@KERNEL32.dll at 55565-1789-00407930 FindResourceW@KERNEL32.dll at 55565-2005-0040B999 FindResourceW@KERNEL32.dll at 55565-1978-0041430C FindResourceW@KERNEL32.dll at 55565-2135-0040B6FA LockResource@KERNEL32.DLL at 00138765-00001008-4043-159-0129A4AB FindResourceW@KERNEL32.DLL at 00138765-00001008-4043-158-0129A508 FindResourceW@KERNEL32.DLL at 00138765-00001008-4043-349-01297930 FindResourceW@KERNEL32.DLL at 00138765-00001008-4043-299-01298070 FindResourceW@KERNEL32.DLL at 00138765-00001008-4043-562-0129B999 LockResource@KERNEL32.DLL at 00138765-00001008-4043-300-0129BB92 FindResourceW@KERNEL32.DLL at 00138765-00001008-4043-535-012A430C FindResourceW@KERNEL32.DLL at 00138765-00001008-4043-671-0129B6FA FindResourceW@KERNEL32.DLL at 00138765-00001008-13133-158-0129A508 LockResource@KERNEL32.DLL at 00138765-00001008-13133-159-0129A4AB FindResourceW@KERNEL32.DLL at 00138765-00001008-13133-299-01298070 LockResource@KERNEL32.DLL at 00138765-00001008-13133-300-0129BB92 FindResourceW@KERNEL32.DLL at 00138765-00001008-13133-562-0129B999 FindResourceW@KERNEL32.DLL at 00138765-00001008-13133-535-012A430C29:T43d,"" wrote 73216 bytes starting with PE header signature to file "%TEMP%\archive.rar": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 44032 bytes starting with PE header signature to file "%TEMP%\archive.rar": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 44032 bytes starting with PE header signature to file "C:\Windows\ntshrui.dll": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...2a:T558,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAOWSURBVFhHtZZbSFRRFIbXi10w0xcfejGpfKoeogu9CEJgkKFFN1BpJIvSvIxpKg42g1JKF5qCxJhAoyCEQqlIUkqxUBJyBiITSg2hehWifFztf++zxzMzZ8bxzDTD4hzW7HP+b/1r7a1E8X4cxH7/POvl8j7bGZFzUmTOTe7gc/HKha4zxNn4mMXNOS1uzkEceXvCeCoBcS95OTGAJIjbB0hAvDu1S1aO8LpJtqChnLjpvArcO8X7EdatSUC8J9PH2voeD/G7Vwqg7ewyAO49tf9RvDutiyH+fZ7kFQDNpapid1kMcWmJiAxnOpPXwTl9NXKghU0iHopgznOqGUcOL+7P7ueAY0TmUHnPpgdS9Od8OXvF1W2su3BKrD9BXCfst7Rd02mAbE+GhKgU3yDAab8EOPk6FAAQ05cmJEDvbeLA+BbuNsT1EAIAAYAI+7U47AHAyADxfKCMP/uzuH6qRAIM9Krcj4WsIAByOBOQ+9o+JQHut26Qg4fKtXg5lUvxavFuVzVxR40JQoqfUb25fE4BkDOP4UBqVwk3zhVJgKIiL5PhQN7AsgMQ1W2QwyfeEy5edlSJN1YQt4kAQEdLGESj2B6ASSkOBXCM5kW0YL8vEmD8+GBw+s2VlxYq8TpRXFsV8a164k4hjvkImQWIA2KdsEo7gBk48GhXBMCeO3+CQyj7ntHLbw8NBPc+hhO2o/KKEqPySlV5p8tCXJNUicXph4nXOHKYqnJ5syudc9ozDQAf05Ex3nGMeWfrrwgAtAHCZnFdeVPtdln51Zb8yMrNNgAgWQE3MXCeOmX7zdYYlQPCdVE8kITAFkN/rwvRGw3E15oEwBWVw+6yPAOwOFkBoefPSJ4H3mbiu8bAQfzTpAUAHkhmPPapI3jo5TKEFg8Eop3/Jl+GnxLHG4N9xC+eEOOqY3SYeGmJeOoj8fs3ynYIz8yoWPEfk8kx4tXGxBCxDv8HBbAwpyC0cNIAcCouLhJ/mQ4FtQJAK2a/hUIk5ID6o6QiGoTZAQCEQ9gGMIvHgrACMEPYArASjwYRDWBuVgyj38YQxhLXv6FCPRPRACDedc8GAHYEtpJxigVnQOfCd4wVgBYvKLAJoEXMbqBqvHglgFWJY0BinQHxAvz9XSynf9Xi8QCk7S6UbYjmAAoAgC3xlQDWbtvLKbkHef3WfTFPS5yCGLi4eh6+L/FgtNiYT6wj1jrb4oABdTJixQPHWPAPMZLOMA9825EAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":94,"unified_at_epoch_ms":1790301578896,"unified_at":"2026-09-25T01:59:38.896Z","metadata":{"hashes":{"sha256":"319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a","sha1":"d5b785f8f92c7588cfad7a1a21daffa6eb9cfa5c","md5":"7accb6fed266a2023659f438ad1b3546","sha512":"ff002ced753689c205a6db25ca2aaa233072a485f82dd95d6557dff879431b88cd3433fe4300e00b8ebbaca56d4e99d028485776d4976a0c3da0e61f74b0640c","ssdeep":"12288:eZ7xLpaOTdvinjkxh4TmzZ+H6z+DqoHamj4U:edtinjkxh4TIfgHadU","ssdeep_chunks":["12288:eZ7xLpa","12288:Z7xLpaO","12288:7xLpaOT","12288:xLpaOTd","12288:LpaOTdv","12288:paOTdvi","12288:aOTdvin","12288:OTdvinj","12288:Tdvinjk","12288:dvinjkx","12288:vinjkxh","12288:injkxh4","12288:njkxh4T","12288:jkxh4Tm","12288:kxh4Tmz","12288:xh4TmzZ","12288:h4TmzZ+","12288:4TmzZ+H","12288:TmzZ+H6","12288:mzZ+H6z","12288:zZ+H6z+","12288:Z+H6z+D","12288:+H6z+Dq","12288:H6z+Dqo","12288:6z+DqoH","12288:z+DqoHa","12288:+DqoHam","12288:DqoHamj","12288:qoHamj4","12288:oHamj4U","24576:eZ7xLpa","24576:Z7xLpaO","24576:7xLpaOT","24576:xLpaOTd","24576:LpaOTdv","24576:paOTdvi","24576:aOTdvin","24576:OTdvinj","24576:Tdvinjk","24576:dvinjkx","24576:vinjkxh","24576:injkxh4","24576:njkxh4T","24576:jkxh4Tm","24576:kxh4Tmz","24576:xh4TmzZ","24576:h4TmzZ+","24576:4TmzZ+H","24576:TmzZ+H6","24576:mzZ+H6z","24576:zZ+H6z+","24576:Z+H6z+D","24576:+H6z+Dq","24576:H6z+Dqo","24576:6z+DqoH","24576:z+DqoHa","24576:+DqoHam","24576:DqoHamj","24576:qoHamj4","24576:oHamj4U","12288:edtinjk","12288:dtinjkx","12288:tinjkxh","12288:jkxh4TI","12288:kxh4TIf","12288:xh4TIfg","12288:h4TIfgH","12288:4TIfgHa","12288:TIfgHad","12288:IfgHadU"],"imphash":"044f4ee0838951106f3c01504a2b4d69"},"file_info":{"file_name":"Last News Interview - Archive.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":548864,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295080000,"last_seen":1713428530000,"last_multi_scan":1713428530000}},"detections":{"summary":{"verdict":"malicious","score":94,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":16,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Prikormka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1322069","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.94329","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Wallex-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.94329 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Prikormka.CM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!BE049B13871D9311","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005714121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Prikormka.ejzvnd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Prikormka.548864","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.EX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Prikormka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.679477","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API NotifyWinEvent@USER32.DLL at 00138765-00001008-4043-174-012A6CC2\n Found reference to API InitNetworkAddressControl@SHELL32.DLL at 00138765-00001008-4043-321-012A1405\n Found reference to API NotifyWinEvent@USER32.DLL at 00138765-00001008-13133-174-012A6CC2\n Found reference to API InitNetworkAddressControl@SHELL32.DLL at 00138765-00001008-13133-321-012A1405","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 55565-1792-00407B10\n GetSystemTime@KERNEL32.dll at 55565-1789-00407930\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00138765-00001008-4043-229-012AD202\n GetSystemTime@KERNEL32.DLL at 00138765-00001008-4043-349-01297930\n GetSystemTime@KERNEL32.DLL at 00138765-00001008-4043-352-01297B10\n GetSystemTime@KERNEL32.DLL at 00138765-00001008-13133-352-01297B10\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00138765-00001008-13133-229-012AD202\n GetSystemTime@KERNEL32.DLL at 00138765-00001008-13133-349-01297930","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"wallejob.in.ua\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.68.16.35:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\!PROJECTS!\\Mina\\2015\\BUG\\!-wallejob\\osWindows\\Loader\\MSVS2008\\Release\\helpldr.pdb\"\n \"D:\\My\\Projects_All\\2015\\samlib_2.0\\Release\\samlib.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\archive.rar\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET http://wallejob.in.ua/wd.php?sn=76920160414053742&rb=8&ob=piter&bt=0 HTTP/1.1\nUser-agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)\nHost: wallejob.in.ua\nAccept: */*\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 77CB0000\n \"\" loaded module \"OLEAUT32.DLL\" at base 76F40000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"ConvertSidToStringSidW@sechost.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"archive.rar\" has type \"gzip compressed data from NTFS filesystem (NT)\"\n \"rbcon.ini\" has type \"ASCII text with CRLF line terminators\"\n \"helpldr.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"samlib.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"ntshrui.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"wallejob.in.ua\"\n Pattern match: \"http://wallejob.in.ua/wd.php?sn=76920160414053742&rb=8&ob=piter&bt=0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00138765-00001008-77BB61F8-270228","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 55565-2523-00425A9A\n SetUnhandledExceptionFilter@KERNEL32.dll at 55565-4763-0041C2C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-4043-17-012A8081\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-4043-16-012AEDFA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-4043-1059-012B5A9A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-4043-1867-012AC2C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-13133-16-012AEDFA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-13133-17-012A8081\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-13133-1868-012AC2C1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00138765-00001008-13133-1059-012B5A9A","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 55565-1851-004070F0\n GetVersionExW@KERNEL32.dll at 55565-1757-00411B97\n GetVersionExA@KERNEL32.dll at 55565-1987-0040EEAF\n GetVersion@KERNEL32.DLL at 00138765-00001008-4043-411-012970F0\n GetVersionExW@KERNEL32.DLL at 00138765-00001008-4043-317-012A1B97\n GetVersionExA@KERNEL32.DLL at 00138765-00001008-4043-544-0129EEAF\n GetVersion@KERNEL32.DLL at 00138765-00001008-13133-411-012970F0\n GetVersionExA@KERNEL32.DLL at 00138765-00001008-13133-544-0129EEAF\n GetVersionExW@KERNEL32.DLL at 00138765-00001008-13133-317-012A1B97","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 55565-1831-004275C0\n GetProcessHeap@KERNEL32.DLL at 00138765-00001008-4043-391-012B75C0\n GetProcessHeap@KERNEL32.DLL at 00138765-00001008-13133-391-012B75C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"$28","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\rbcon.ini\"\n \"\" created file \"%WINDIR%\\helpldr.dll\"\n \"\" created file \"%WINDIR%\\samlib.dll\"\n \"\" created file \"%WINDIR%\\ntshrui.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"helpldr.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"samlib.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"ntshrui.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"v^^4~\"","origin":"Network Traffic","relevance":5,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 55565-1957-0042C8AE\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00138765-00001008-4043-514-01296E40\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00138765-00001008-13133-514-01296E40","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\Last_News_Interview_Archive.scr.exe\" marked \"%TEMP%\\archive.rar\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\archive.rar\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"helpldr.dll\" claimed CRC 115717 while the actual is CRC 580904","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n GetStartupInfoW\n CreateDirectoryW\n GetModuleFileNameA\n GetCommandLineW\n GetStartupInfoA\n GetTickCount\n UnhandledExceptionFilter\n IsDebuggerPresent\n VirtualAlloc\n CreateFileA\n GetVersionExW\n LoadLibraryA\n GetVersionExA\n GetModuleHandleA\n LoadLibraryW\n GetProcAddress\n CopyFileW\n GetTempPathW\n LockResource\n FindResourceW\n GetModuleHandleW\n GetFileSize\n Sleep\n Process32NextW\n TerminateProcess\n OpenProcess\n Process32FirstW\n CreateToolhelp32Snapshot\n GetModuleFileNameW\n DeleteFileW\n WriteFile\n CreateFileW\n GetWindowThreadProcessId\n GetLastActivePopup\n SetWindowsHookExW\n RegOpenKeyW\n RegEnumKeyW\n RegDeleteKeyW\n RegCreateKeyExW\n RegOpenKeyExW\n RegCloseKey\n OpenProcessToken\n connect (Ordinal #4)\n WSAStartup (Ordinal #115)\n recv (Ordinal #16)\n socket (Ordinal #23)\n closesocket (Ordinal #3)\n send (Ordinal #19)\n CreateThread\n GetCommandLineA\n RegOpenKeyExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO TROJAN Win32/Agent.XRA (Robo) DNS Lookup\" (SID: 2816317, Rev: 1, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)\n Detected alert \"ETPRO TROJAN Win32/Agent.XRA (Robo) Downloading Module 1\" (SID: 2816314, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/56 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"29/77 Antivirus vendors marked dropped file \"samlib.dll\" as malicious (classified as \"Trojan.GenericKD\" with 37% detection rate)\n 29/77 Antivirus vendors marked dropped file \"ntshrui.dll\" as malicious (classified as \"Trojan.GenericKD\" with 37% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"$29","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":29,"dropped_files_count":0,"extracted_files_count":5,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"570e99d2aac2edca6b7b23c9","environment_id":4,"state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","submit_name":"Last News Interview - Archive.scr","analysis_start_time":"2016-04-13T19:11:14+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"570e99d2aac2edca6b7b23c7","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":94,"malware_family":"Dropper.Generic_r","contacted_countries":["UKR"],"submit_name":"Last News Interview - Archive.scr","analysis_start_time":"2016-04-14T07:33:42+00:00","indicators_count":{"informative":11,"suspicious":17,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.68.16.35","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}],"dns_resolutions":[{"domain":"wallejob.in.ua","address":"185.68.16.35","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}],"http_requests":[{"host":"wallejob.in.ua","host_ip":"185.68.16.35:80","url":"http://wallejob.in.ua/wd.php?sn=76920160414053742&rb=8&ob=piter&bt=0","method":"GET","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}],"processes":[{"pid":1008,"ppid":0,"name":"Last_News_Interview_Archive.scr.exe","command_line":"","normalized_path":"Z:\\Last_News_Interview_Archive.scr.exe","uid":"00138765-00001008","icon":"$2a"}],"all_imported_dlls":["DEVOBJ.dll","kernel32.dll","ole32.dll","SspiCli.dll","ntdll.dll","PSAPI.DLL","GDI32.dll","sechost.dll","KERNELBASE.dll","ADVAPI32.dll","msvcrt.dll","USER32.dll","SHELL32.dll","IMM32.DLL","USERENV.dll","USP10.dll","OLEAUT32.dll","uxtheme.dll","RPCRT4.dll","CFGMGR32.dll","dwmapi.dll","VERSION.dll","MSCTF.dll","SHLWAPI.dll","comctl32.dll","profapi.dll","SETUPAPI.dll","LPK.dll","CRYPTBASE.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ntshrui.dll","sha256":"96cfa5e0bcfd905e571db378bc9938d1465755ec55c5c1df41ee739cfa06d000","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"name":"samlib.dll","sha256":"96cfa5e0bcfd905e571db378bc9938d1465755ec55c5c1df41ee739cfa06d000","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"name":"archive.rar","sha256":"e1cb4b1efa7c465b80a4d5c28d83460b0e6e72387b15bd348acfffdf08ef6ba4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"name":"helpldr.dll","sha256":"6f41b65b58fd7871e2975713d96aeee16f639f9851bf8c9394d92ced2df4efa6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"name":"rbcon.ini","sha256":"e333af3a7fc6f43f400d3e035b7990a73e949a1a247bd2a978ae8bb9a8b799b7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"path":"%WINDIR%\\helpldr.dll","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"path":"%WINDIR%\\rbcon.ini","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"path":"%WINDIR%\\ntshrui.dll","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"path":"%WINDIR%\\samlib.dll","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]},{"path":"%USERPROFILE%\\rindex.dat","sources":[{"report_type":"sandbox","report_id":"570e99d2aac2edca6b7b23c7"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["570e99d2aac2edca6b7b23c7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 319e9dc36678… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 319e9dc36678…. Malware family: Trojan.Generic. Threat score 94/100. 17/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 319e9dc36678… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 319e9dc36678…. Malware family: Trojan.Generic. Threat score 94/100. 17/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/319e9dc36678c4d774ba0765ec93d3160bd476ab0f98bac1b7e5b92e7994a88a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 319e9dc36678… — Score 94/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 319e9dc36678…. Malware family: Trojan.Generic. Threat score 94/100. 17/26 AV engines flagged this file. 4 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]