26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 32825a23da20… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 32825a23da20…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/28 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b"],"about":{"@type":"SoftwareApplication","name":"32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b","applicationCategory":["peexe","64bits","executable"],"identifier":"32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T10d3,Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\pal\windows\winsock.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\sync.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\collections\vec_deque\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "LazyLock instance has previously been poisoned/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\lazy_lock.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\panic_abort\src\lib.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "note: Some details are omitted, run with `RUST_BACKTRACE=full` for a verbose backtrace. \" (Indicator: "rust_backtrace"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\mpmc\array.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "a formatting trait implementation returned an error when the underlying stream did not/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\io\write.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "assertion failed: self.capacity() >= buf.len()/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\io\borrowed_buf.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\io\read.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\id.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "thread name may not contain interior null bytes/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\thread.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "a Display implementation returned an error unexpectedly/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\string.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "Mdest is out of bounds/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\slice\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "failed to spawn thread/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\functions.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\stdio\windows.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\io\stdio.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "too many running threads in thread scope/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\scoped.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "capacity overflow/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\vec\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "[number of read bytes exceeds limit/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\io\util.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\fmt\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\fs\windows.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\wtf8.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string ">== buf.len()/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\io\borrowed_buf.rs", Pattern match: "http://www.cert.fnmt.es/dpcs/0", Heuristic match: " c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\ext.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\io\read.rs", Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\id.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\transport\mod.rs", Heuristic match: "thread name may not contain interior null bytes/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\thread.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\adler32.rs", Heuristic match: "assertion failed: self.buf.is_empty() || self.buf.len() >= self::padding()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\inflate\window.rs", Heuristic match: "/rust/deps\rustc-demangle-0.1.28\src\legacy.rs", Heuristic match: "notfoundconnectionrefusedconnectionresethostunreachablenetworkunreachableconnectionabortednotconnectedaddrinuseaddrnotavailablenetworkdownbrokenpipealreadyexistswouldblocknotadirectoryisadirectorydirectorynotemptyreadonlyfilesystemfilesystemloopstalenetwor", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\bytes_mut.rs", Heuristic match: "unable to find any user-specified roots in the final cert chainrust_min_stackconnection refusedc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\util.rs", Heuristic match: "a display implementation returned an error unexpectedly/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\string.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\lib.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\header\map.rs", Pattern match: "http://www.accv.es/legislacion_c.htm0u", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\client\amended.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\utf8-zero-0.8.1\src\lib.rs", Heuristic match: "httphttpsc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\header\value.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\transport\io.rs", Heuristic match: "http::errorhttp/0.9http/1.0http/1.1http/2.0http/3.0c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\version.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\transport\chain.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\inflate\writer.rs", Heuristic match: "mdest is out of bounds/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\slice\mod.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\client\recvbody.rs", Heuristic match: "9q c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crc32fast-1.5.2\src\baseline.rs", Heuristic match: "assertion failed: self.inner.state.writer.has_body()c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\client\await100.rs", Heuristic match: "failed to spawn thread/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\functions.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\stdio\windows.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\io\stdio.rs", Heuristic match: "body data reading stalledsocks4socks4asockssocks5socks5hnativetlsconnectortcpconnectorc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\transport\time.rs", Heuristic match: "too many running threads in thread scope/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\scoped.rs", Pattern match: "api.adoptium.net/v3/assets/latest/25/hotspot?architecture=", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\stable.rs", Heuristic match: "capacity overflow/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\vec\mod.rs", Heuristic match: "[number of read bytes exceeds limit/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\io\util.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\fmt\mod.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\request.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\fs\windows.rs", Heuristic match: "{invalid syntax}{recursion limit reached}?`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.28\src\v0.rs", Heuristic match: "at least one certificate must be provided to create an identityleaf cert contains invalid utf8c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\native-tls-0.2.18\src\imp\schannel.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\body.rs", Heuristic match: "/c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\scheme.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\wtf8.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\path.rs", Heuristic match: ">== size_of::()/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\net\connection\socket\mod.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64ct-1.8.3\src\encoding.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\pal\windows\mod.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\crc32\braid.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-8.6.0\src\read.rs", Heuristic match: "sizelimitexhaustedparseinterror/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\ops\function.rs", Heuristic match: " /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\net\ip_addr.rs", Heuristic match: "extra field content truncatedinternal error: entered unreachable codec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\indexmap-2.14.2\src\inner.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\crc32fast-1.5.2\src\specialized\pclmulqdq.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\slice\index.rs", Heuristic match: "internal error: entered unreachable code: invalid once state/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\sync\once\futex.rs", Pattern match: "crl.d-trust.net/crl/d-trust_br_root_ca_1_2020.crl0y", Heuristic match: "advancing ioslice beyond its length/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\io\io_slice\repr_windows.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\tls\native_tls.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\str\mod.rs", Heuristic match: "nulerror\c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\typed-path-0.12.3\src\common\non_utf8\parser.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.23.1\src\engine\general_purpose\mod.rs", Heuristic match: "hash table capacity overflow/rust/deps\hashbrown-0.17.1\src\raw.rs", Heuristic match: "extra field content exceeds declared lengthzip64 footer indicates more files on this disk than in the whole archiveinvalid central directory size or offsetc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zip-8.6.0\src\read\magic_fi", Pattern match: "http://https://invalid", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\send_body.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\client\recvresp.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\mpmc\waker.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\io\error\windows.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\collections\btree\navigate.rs", Heuristic match: "lock count overflow in reentrant mutex/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\reentrant_lock.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\path.rs", Heuristic match: "invalid aes vendor versioninvalid utf-8/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\io\impls.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.23.1\src\engine\mod.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\error.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\mem\maybe_uninit.rs", Heuristic match: "invalid central directory header--modtale-bootstrap-check--modtale-install-runtimebinalgorithm=sha-256cannot locate your home directoryc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\generic-array-0.14.7\src\hex.rs", Heuristic match: "2783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\unicode\unicode_data.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\slice\memchr.rs", Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0", Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyed/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\current.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\cert_context.rs", Pattern match: "www.digicert.com1!0", Pattern match: "www.digicert.com1", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\crc32.rs", Heuristic match: "unicode extra field is too smallaes extra field truncatedinvalid aes vendoraes extra data field has an unsupported lengthc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.3\src\arch\all\packedpair\mod.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\mpmc\list.rs", Pattern match: "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0", Heuristic match: ".modtale/launcher/bootstrap.logmodtale launcherjava_tool_options_java_optionsjdk_java_optionsclasspathjava.exeoversized central directorysupport for multi-disk files is not implementedpassword required to decrypt filec:\users\runneradmin\.cargo\registry\sr", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\slice\sort\stable\quicksort.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\block-buffer-0.10.4\src\lib.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\transport\tcp.rs", Pattern match: "http://crl.dhimyotis.com/certignarootca.crl0", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.23.1\src\encode.rs", Heuristic match: "-c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\zlib-rs-0.6.7\src\inflate\inftrees.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\net\display_buffer.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\raw_vec\mod.rs", Heuristic match: "cunsafe extern -fn() -> + : punycode{}.llvm./rust/deps\rustc-demangle-0.1.28\src\lib.rs", Heuristic match: "thread caused non-unwinding panic. aborting. /rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\..\..\backtrace\src\dbghelp.rs", Heuristic match: "a valid responsec:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-proto-0.6.3\src\parser.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\thread\local.rs", Pattern match: "http://ocsp.accv.es0", Heuristic match: "byte arrayoption valuenewtype structsequencemapenumunit variantnewtype varianttuple variantstruct variantu64a stringc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\read.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\env\windows.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\process\windows\child_pipe.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\authority.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\once.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\process\windows.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\panicking.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\tls_stream.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\method.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\str.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\mpmc\context.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hashbrown-0.17.1\src\raw.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\mpmc\mod.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\body\lossy.rs", Heuristic match: "assertion failed: match track_edge_idx { leftorright::left(idx) => idx <= old_left_len, leftorright::right(idx) => idx <= right_len, }/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\collections\btree\node.rs", Heuristic match: "m .ph", Heuristic match: " at line c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\error.rs", Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c", Heuristic match: "text/c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\pool.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\lib.rs", Heuristic match: "rust_backtraceassertion failed: self.is_code_point_boundary(new_len)/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\wtf8\mod.rs", Pattern match: "https://wwww.certigna.fr/autorites/0m", Heuristic match: "assertion failed: self.is_char_boundary(new_len)/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\ffi\os_str.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\io\cursor.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\net\parser.rs", Pattern match: "http://www.firmaprofesional.com/cps0\", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.3\src\arch\all\twoway.rs", Heuristic match: "mx.sk", Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f", Heuristic match: "timeout has no recorded startc:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\timings.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\collections\btree\map\entry.rs", Heuristic match: "too many active read locks on rwlock/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sys\sync\rwlock\futex.rs", Pattern match: "java.base/share/data/blockedcertsconverter/blocked.certs.pem", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\panicking.rs", Heuristic match: "-----begin c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\pem-rfc7468-1.0.0\src\encoder.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\core\src\net\socket_addr.rs", Heuristic match: "ureq/3.4.2c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\resolver.rs", Heuristic match: "assertion failed: input_size > 0c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\unversioned\transport\buf.rs", Heuristic match: "/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\std\src\sync\once_lock.rs", Heuristic match: "c:\users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ureq-3.4.2\src\proxy.rs"2a:T897,Found string "TryFromIntErrorInvalid AES encryption strength" (Indicator: "aes"; Source: "sample.bin"), file/memory contains long string with (Indicator: "aes"; Source: "sample.bin"), Found string "ZipFileReader was in an invalid state" (Indicator: "zipfile"; Source: "sample.bin"), Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64ct-1.8.3\src\encoder.rs" (Indicator: "base64"; Source: "sample.bin"), Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64ct-1.8.3\src\encoding.rs" (Indicator: "base64"; Source: "sample.bin"), Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.23.1\src\engine\general_purpose\mod.rs" (Indicator: "base64"; Source: "sample.bin"), file/memory contains long string with (Indicator: "base64"; Source: "sample.bin"), Found string "Base64CharacterEncodingEncapsulatedTextHeaderDisallowedLabelPreamblePreEncapsulationBoundaryPostEncapsulationBoundaryUnexpectedTypeLabeldate/time errorinvalid encoding rulesoperation failedfile not found*ASN.1 DER message is incomplete: expected " (Indicator: "base64"; Source: "sample.bin"), Found string "Invalid AES vendor versionInvalid UTF-8/rustc/58cf8f9c35b355199727627d07ae34a4e2846d67/library\alloc\src\io\impls.rs" (Indicator: "aes"; Source: "sample.bin"), Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.23.1\src\engine\mod.rs" (Indicator: "base64"; Source: "sample.bin"), Found string "invalid Base64 lengthinvalid Base64 encoding"advance out of bounds: the len is " (Indicator: "base64"; Source: "sample.bin"), Found string "PEM Base64 error: " (Indicator: "base64"; Source: "sample.bin"), Found string "Unicode extra field is too smallAES extra field truncatedInvalid AES vendorAES extra data field has an unsupported lengthC:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\memchr-2.8.3\src\arch\all\packedpair\mod.rs" (Indicator: "aes"; Source: "sample.bin"), Found string "C:\Users\runneradmin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.23.1\src\encode.rs" (Indicator: "base64"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792922233407,"unified_at":"2026-10-25T09:57:13.407Z","metadata":{"hashes":{"sha256":"32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b","sha1":"b7c7345e378df9c659e0577fdc5e152c521b706d","md5":"649607a7c46fa0a9b83fa404153c91b8"},"file_info":{"file_name":"32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":869376,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792922215000,"last_seen":1792922216000,"last_multi_scan":1792922216000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":18},"sandbox_signatures":{"informative_count":30,"suspicious_count":1,"malicious_count":2,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with bottom confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-19","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$27","origin":"sample.bin","id":"string-943","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: \" (Indicator: \"user-agent: \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"modtale_bootstrap.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"info@e-szigno.hu\", Pattern match: \"info@izenpe.com\", Pattern match: \"accv@accv.es\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/adoptium/temurin25-binaries/releases/download/Java provider returned invalid download metadataRuntime contains recursive linksUnsupported file in Java runtimeInstalled Java runtime is too largeruntime.lock\" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1H9\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"http::ErrorHTTP/0.9HTTP/1.0HTTP/1.1HTTP/2.0HTTP/3.0C:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-1949cf8c6b5b557f\\http-1.5.0\\src\\version.rs\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\"), Found string \"http::ErrorHTTP/0.9HTTP/1.0HTTP/1.1HTTP/2.0HTTP/3.0C:\\Users\\runneradmin\\.cargo\\registry\\src\\index.crates.io-1949cf8c6b5b557f\\http-1.5.0\\src\\version.rs\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"HTTP/1.0L9\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \" HTTP/1.1\n\" (Indicator: \"HTTP/1.1\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://api.adoptium.net\", Found HTTPS url \"https://github.com\", Found HTTPS url \"https://invalid\", Found HTTPS url \"https://wwww.certigna.fr\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"mx.sk\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"invalid socket address\" (Indicator: \" socket \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\NamedPipe\\\" (Indicator: \"\\Device\\\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-474","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where dialog.exe\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-86","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"specified file not found in archiveprovided password is incorrect\"compression method not supported: \" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"PRIVATE KEY\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"----------BEGIN PRIVATE KEY----------END PRIVATE KEY-----expected '-----BEGIN PRIVATE KEY-----'and '-----END PRIVATE KEY-----' PEM guardsassertion failed: pem.len() <= u32::max_value() as usize\" (Indicator: \"private key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertFreeCertificateChain\" (Indicator: \"CertFreeCertificateChain\"; Source: \"sample.bin\"), Found api reference \"CertOpenStore\" (Indicator: \"CertOpenStore\"; Source: \"sample.bin\"), Found api reference \"CertCreateCertificateContext\" (Indicator: \"CertCreateCertificateContext\"; Source: \"sample.bin\"), Found api reference \"CertDuplicateCertificateChain\" (Indicator: \"CertDuplicateCertificateChain\"; Source: \"sample.bin\"), Found api reference \"CertAddCertificateContextToStore\" (Indicator: \"CertAddCertificateContextToStore\"; Source: \"sample.bin\"), Found api reference \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\"), Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContext\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-213","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/adoptium/temurin25-binaries/releases/download/Java provider returned invalid download metadataRuntime contains recursive linksUnsupported file in Java runtimeInstalled Java runtime is too largeruntime.lock\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"sample.bin\"), Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1132","id":"string-338","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 32825a23da20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 32825a23da20…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/28 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 32825a23da20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 32825a23da20…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/28 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/32825a23da20536e88c08a5988ec597d098832473c55d099a77bab448838891b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 32825a23da20… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 32825a23da20…. Malware family: Win/malicious_confidence_60%. Threat score 100/100. 1/28 AV engines flagged this file. 2 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]