24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 348ac0dba533… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 348ac0dba533…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 2/28 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2"],"about":{"@type":"SoftwareApplication","name":"PTT PAKETİNİZİ TESLİM EDİYOR.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T98f,Found string "--> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. --> true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. --> true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> " (Indicator: "EnableWindow"; in Source: "00000000-00002844.00000000.66062.01444000.00000002.mdmp, 00000000-00002844.00000000.66067.01444000.00000002.mdmp")26:T4c1,"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"27:T58e,"PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\FLTLIB.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "PTTPAKET_N_Z_TESL_MED_YOR.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL"28:T28e9,"9=5BMD=2B=9N1BMD=2B=8C=11M4=2NA3M0M0MN91MD=38=7EXFXFXFM2=7BM1M0M0M4=1FMAXEM4=16XEM1MA=1EMD=38=69XFXFXFM2=7B=10M0M0M4MB=11M4=2N26M2M0MN91=11M4=1FM9=91=7E=13M0M0M4=2NC6M1M0MN7E=13M0M0M4=2NC6M1M0MN91=7E=13M0M0M4=2N3CM1M0MN91=6N1FME=5Z9C=59MD=38=29XFXFXZ13=30M7MNCEM0M0MN25M0MN11=7E=13M0M0M4=13M4=7E=2EM0M0M4=13M5=2B=3CM9=45MBM0M0M0M0M0M0MN22M0M0MN51M0M0MN28M0M0MN43M0M0MN2FM0M0MN51M0M0M0MAM0M0M0MEM0M0MN28M0M0M0MAM0M0MNDN2FM0M0M6=26=1DMD=2B=C4=1CMD=2B=CN11M4=2NB3M1M0MN91=11M4=2N9AM0M0MN91=59MD=2B=AC=73=20M0M0MA=7AM7=75M8M0M0M1=2AM6=2CM4=1AMD=2B=98=11M5=1Z45=93=2N52=75M0MN59=2BX0M2=7BM7M0M0M4MB=1EMD=38=7DXFXFXFM2=7BM1M0M0M4=1FMB=7E=2EM0M0M4=1Z22=7E=2EM0M0M4=1Z22=93=7E=2EM0M0M4=1Z3N93=59=1Z77=5Z9DXEM4=16XEM1MA=11M5=1Z6A=93=2N5C=41M0MN59MD=38=42XFXFXFM0MN13=30M3MNA5M0M0MN26M0MN11=7E=13M0M0M4=13M5=7E=2EM0M0M4=13M6=2B=2E=11M4=45M7M0M0MN39M0M0M0M0M0M0M0MBM0M0MN5FM0M0M0MBM0M0MN5FM0M0M0MBM0M0MNDN30M0M0M6=26=1C=13M4=2B=D2M2=7C=14M0M0M4=7B=27M0M0M4=14XEM1MAM6=2CMZ11M5=1FM9=91=11M5=1FM9=91=59=13M4=2B=B1=11M6=1Z3A=93=2NA9M8M0M" (Indicator: "cmd=") "9=5BMD=2B=9N1BMD=2B=8C=11M4=2NA3M0M0MN91MD=38=7EXFXFXFM2=7BM1M0M0M4=1FMAXEM4=16XEM1MA=1EMD=38=69XFXFXFM2=7B=10M0M0M4MB=11M4=2N26M2M0MN91=11M4=1FM9=91=7E=13M0M0M4=2NC6M1M0MN7E=13M0M0M4=2NC6M1M0MN91=7E=13M0M0M4=2N3CM1M0MN91=6N1FME=5Z9C=59MD=38=29XFXFXZ13=30M7MNCEM0M0MN25M0MN11=7E=13M0M0M4=13M4=7E=2EM0M0M4=13M5=2B=3CM9=45MBM0M0M0M0M0M0MN22M0M0MN51M0M0MN28M0M0MN43M0M0MN2FM0M0MN51M0M0M0MAM0M0M0MEM0M0MN28M0M0M0MAM0M0MNDN2FM0M0M6=26=1DMD=2B=C4=1CMD=2B=CN11M4=2NB3M1M0MN91=11M4=2N9AM0M0MN91=59MD=2B=AC=73=20M0M0MA=7AM7=75M8M0M0M1=2AM6=2CM4=1AMD=2B=98=11M5=1Z45=93=2N52=75M0MN59=2BX0M2=7BM7M0M0M4MB=1EMD=38=7DXFXFXFM2=7BM1M0M0M4=1FMB=7E=2EM0M0M4=1Z22=7E=2EM0M0M4=1Z22=93=7E=2EM0M0M4=1Z3N93=59=1Z77=5Z9DXEM4=16XEM1MA=11M5=1Z6A=93=2N5C=41M0MN59MD=38=42XFXFXFM0MN13=30M3MNA5M0M0MN26M0MN11=7E=13M0M0M4=13M5=7E=2EM0M0M4=13M6=2B=2E=11M4=45M7M0M0MN39M0M0M0M0M0M0M0MBM0M0MN5FM0M0M0MBM0M0MN5FM0M0M0MBM0M0MNDN30M0M0M6=26=1C=13M4=2B=D2M2=7C=14M0M0M4=7B=27M0M0M4=14XEM1MAM6=2CMZ11M5=1FM9=91=11M5=1FM9=91=59=13M4=2B=B1=11M6=1Z3A=93=2NA9M8M0MN" (Indicator: "cmd=") "=1FM0M0M1=14=14=2N4FM3M0MN2N3FM3M0MN28=10M0MN2B=26=2B=BCM2=74MEM0M0M1=6Z19M0M0MA=1Z14=9AMA=2B=90M0MN13=30M6MN6BM0M0MN15M0MN11=2B=28M8=45M6M0M0M0MAM0M0M0M0M0M0M0M0M0M0M0MAM0M0M0MAM0M0MN1FM0M0MNDN1CM0M0M6=26=19MC=2B=D8M2=2NF8M3M0MN2NE5M3M0MN28=16M0M0M6MA=1BMC=2B=C3M6=75MEM0M0M1=7E=13M0M0M4=2NE3M1M0MN7E=13M0M0M4=2NE3M1M0MN91=7E=2EM0M0M4=2N96M0M0MN93=58=1Z25=5Z9C=2AMN13=30M4MN9CM0M0MN16M0MN11=7E=13M0M0M4=13M4=2B=30M9=45M8M0M0M0MAM0M0MN36M0M0M0M0M0M0MN36M0M0MN36M0M0MN15M0M0MN2FM0M0M0M0M0M0MNDN1DM0M0M6=26=16MD=2B=DN11M4=1Z55=91=1Z16=59MD=2B=C5M6=74=2BM0M0M1M2=1Z4B=1Z35=28=13M0MN2B=74=22M0M0M1MB=1CMD=2B=ABM7=74=22M0M0M1=2AM3=D0M1M0M0M2=28M3M0M0MA=16=2N4B=8NC9=4B=28=47M0M0M6=2ND7M1M0MN2ND2M1M0MN28M1M0MN2B=28=1AM0M0MA=73=1BM0M0MAMA=1BMD=38=6DXFXFXZ13=30M2MN79M0M0MN17M0MN11=7E=2EM0M0M4MD=7E=13M0M0M4=13M4=2B=3DM8=45M9M0M0MN1EM0M0MN1EM0M0M0M0M0M0MN2EM0M0MN3EM0M0MN13M0M0MN3EM0M0MN2EM0M0MN2AM0M0MNDN1EM0M0M6=26M9=1Z15=93=2N4E=D5M0MN59MC=2B=C3=11M4=2N3CM1M0MN91MC=2B=B8M9=17=93=20MDMFM0MN59MC=2B=AC=1CMC=2B=A8M2=7BMEM0M0M4=7B" (Indicator: "cmd=") "=1FM0M0M1=14=14=2N4FM3M0MN2N3FM3M0MN28=10M0MN2B=26=2B=BCM2=74MEM0M0M1=6Z19M0M0MA=1Z14=9AMA=2B=90M0MN13=30M6MN6BM0M0MN15M0MN11=2B=28M8=45M6M0M0M0MAM0M0M0M0M0M0M0M0M0M0M0MAM0M0M0MAM0M0MN1FM0M0MNDN1CM0M0M6=26=19MC=2B=D8M2=2NF8M3M0MN2NE5M3M0MN28=16M0M0M6MA=1BMC=2B=C3M6=75MEM0M0M1=7E=13M0M0M4=2NE3M1M0MN7E=13M0M0M4=2NE3M1M0MN91=7E=2EM0M0M4=2N96M0M0MN93=58=1Z25=5Z9C=2AMN13=30M4MN9CM0M0MN16M0MN11=7E=13M0M0M4=13M4=2B=30M9=45M8M0M0M0MAM0M0MN36M0M0M0M0M0M0MN36M0M0MN36M0M0MN15M0M0MN2FM0M0M0M0M0M0MNDN1DM0M0M6=26=16MD=2B=DN11M4=1Z55=91=1Z16=59MD=2B=C5M6=74=2BM0M0M1M2=1Z4B=1Z35=28=13M0MN2B=74=22M0M0M1MB=1CMD=2B=ABM7=74=22M0M0M1=2AM3=D0M1M0M0M2=28M3M0M0MA=16=2N4B=8NC9=4B=28=47M0M0M6=2ND7M1M0MN2ND2M1M0MN28M1M0MN2B=28=1AM0M0MA=73=1BM0M0MAMA=1BMD=38=6DXFXFXZ13=30M2MN79M0M0MN17M0MN11=7E=2EM0M0M4MD=7E=13M0M0M4=13M4=2B=3DM8=45M9M0M0MN1EM0M0MN1EM0M0M0M0M0M0MN2EM0M0MN3EM0M0MN13M0M0MN3EM0M0MN2EM0M0MN2AM0M0MNDN1EM0M0M6=26M9=1Z15=93=2N4E=D5M0MN59MC=2B=C3=11M4=2N3CM1M0MN91MC=2B=B8M9=17=93=20MDMFM0MN59MC=2B=AC=1CMC=2B=A8M2=7BMEM0M0M4=7B=" (Indicator: "cmd=") "=2B=BD=16MA=11M5=1Z63=93=2N78=BDM0MN59MD=2B=ADM5MEM4=61=1Z7N59M6=61=45M1M0M0M0M5M0M0MN1FMBMD=2B=96=11M5=2N89M0M0MN93=20ME=38M0MN59=2B=ED=14MB=11M5=2N80M0M0MN93=2NB9=24M0MN59MD=38=7NFFXFXFM2=8CM5M0MN1BM3=8CM4M0MN1BM4=6Z18M0M0MAMB=1CMD=38=56XFXFXFM6=17=58MAM5=25=5AM5=58=18=5D=2CM7=1BMD=38=42XFXFXZ17=2BX7=11M5=2NCFM0M0MN93=20MA=DDM0MN59MD=38=2BXFXFXFM7=2A=11M5=1Z3A=93=2NA7M8M0MN59MD=38=18XFXFXZ13=30M4MNF5M0M0MN38M0MN11=7E=2EM0M0M4=13M6=7E=13M0M0M4=13M7=2B=4C=11M5=45MCM0M0M0M0M0M0MN9FM0M0MN97M0M0MN15M0M0MNA6M0M0MN47M0M0MN26M0M0MN52M0M0MN52M0M0MN73M0M0MN52M0M0MN80M0M0MNDN4BM0M0M6=26=11M6=1Z14=93=2N5NCCM0MN59=13M5=2B=B4=16MA=11M6=1Z28=93=2NAB=7FM0MN59=13M5=2B=A3MEM4M5=61=1Z6N59M6=61=45M1M0M0M0M5M0M0MN1B=13M5=2B=8C=11M7=2N24M1M0MN91=2BX2=14MB=1FM9=13M5=38=77XFXFXFM2=8CM5M0MN1BM3=8CM4M0MN1BM4=8CMFM0MN1B=28=28M0M0MAMB=1FM9=13M5=38=56XFXFXFM6=17=58MA=1Z51MD=2N42M1M0M0MC=2N8CM7M0M0M8M9=1C=5A=59=30M8=18=13M5=38=35XFXFXZ17=2BX6=1C=13M5=38=2AXFXFXFM7=75M8M0M0M1=2A=1C=13M5=38=1BXFXFXFM0M0MN1EM2=28M2M0M0MA=2A=1EM2=28M2M0M0M" (Indicator: "cmd=") "=2B=BD=16MA=11M5=1Z63=93=2N78=BDM0MN59MD=2B=ADM5MEM4=61=1Z7N59M6=61=45M1M0M0M0M5M0M0MN1FMBMD=2B=96=11M5=2N89M0M0MN93=20ME=38M0MN59=2B=ED=14MB=11M5=2N80M0M0MN93=2NB9=24M0MN59MD=38=7NFFXFXFM2=8CM5M0MN1BM3=8CM4M0MN1BM4=6Z18M0M0MAMB=1CMD=38=56XFXFXFM6=17=58MAM5=25=5AM5=58=18=5D=2CM7=1BMD=38=42XFXFXZ17=2BX7=11M5=2NCFM0M0MN93=20MA=DDM0MN59MD=38=2BXFXFXFM7=2A=11M5=1Z3A=93=2NA7M8M0MN59MD=38=18XFXFXZ13=30M4MNF5M0M0MN38M0MN11=7E=2EM0M0M4=13M6=7E=13M0M0M4=13M7=2B=4C=11M5=45MCM0M0M0M0M0M0MN9FM0M0MN97M0M0MN15M0M0MNA6M0M0MN47M0M0MN26M0M0MN52M0M0MN52M0M0MN73M0M0MN52M0M0MN80M0M0MNDN4BM0M0M6=26=11M6=1Z14=93=2N5NCCM0MN59=13M5=2B=B4=16MA=11M6=1Z28=93=2NAB=7FM0MN59=13M5=2B=A3MEM4M5=61=1Z6N59M6=61=45M1M0M0M0M5M0M0MN1B=13M5=2B=8C=11M7=2N24M1M0MN91=2BX2=14MB=1FM9=13M5=38=77XFXFXFM2=8CM5M0MN1BM3=8CM4M0MN1BM4=8CMFM0MN1B=28=28M0M0MAMB=1FM9=13M5=38=56XFXFXFM6=17=58MA=1Z51MD=2N42M1M0M0MC=2N8CM7M0M0M8M9=1C=5A=59=30M8=18=13M5=38=35XFXFXZ17=2BX6=1C=13M5=38=2AXFXFXFM7=75M8M0M0M1=2A=1C=13M5=38=1BXFXFXFM0M0MN1EM2=28M2M0M0MA=2A=1EM2=28M2M0M0MA" (Indicator: "cmd=") "E=2EM0M0M4=2NB7M0M0MN93=7E=2EM0M0M4=2NB9M0M0MN93=58=2NF5M0M0MN5Z9D=2AM0M0MN13=30M1MN59M0M0MN21M0MN11=2B=34M8=45M9M0M0M0M0M0M0MN16M0M0MN16M0M0MN12M0M0M0MAM0M0MN26M0M0MN26M0M0M0MEM0M0MN26M0M0MNDN2BM0M0M6=26=1AMC=2B=CC=17MC=2B=C8=1CMC=2B=C4=1CMC=2B=C0M2=7C=14M0M0M4=7B=26M0M0M4MA=1DMC=2B=B0M6=75M8M0M0M1=2AM0M0MN13=30M2MN58M0M0MN22M0MN11=7E=13M0M0M4MD=2B=30M8=45M8M0M0M0M0M0M0MN19M0M0M0MEM0M0M0MAM0M0MN12M0M0MN20M0M0MN19M0M0MN12M0M0MNDN2CM0M0M6=26=19MC=2B=DN1CMC=2B=CC=1DMC=2B=C8M6=75M8M0M0M1=2AM2=7BMFM0M0M4MAM9=2N78M1M0MN91MC=2B=BN13=30M2MN4FM0M0MN23M0MN11=7E=13M0M0M4MD=2B=32M8=45M8M0M0MN10M0M0MN10M0M0MN16M0M0M0M0M0M0M0MCM0M0MN14M0M0M0MCM0M0M0M0M0M0MNDN2DM0M0M6=26M9=18=91MC=2B=CE=18MC=2B=CA=1BMC=2B=C6M6=2AM2=7BM6M0M0M4MA=16MC=2B=B9MN13=30M7MNE0M0M0MN24M0MN11=7E=13M0M0M4=13M4=2B=45M9=45MDM0M0MN3AM0M0MN56M0M0MN5DM0M0MN36M0M0M0M0M0M0MN15M0M0MN48M0M0MN48M0M0MN17M0M0M0MFM0M0M0MBM0M0MN5DM0M0MN2BM0M0MNDN2EM0M0M6=26=1FMAMD=2B=BB=1CMD=2B=B7=73=20M0M0MA=7AM7=2AM6=2CM5=1FMCMD=2B=A7=11M4=2NF1M0M0MN91=19=5A=2BX1=11M4=1Z27=91=1F" (Indicator: "cmd=") "E=2EM0M0M4=2NB7M0M0MN93=7E=2EM0M0M4=2NB9M0M0MN93=58=2NF5M0M0MN5Z9D=2AM0M0MN13=30M1MN59M0M0MN21M0MN11=2B=34M8=45M9M0M0M0M0M0M0MN16M0M0MN16M0M0MN12M0M0M0MAM0M0MN26M0M0MN26M0M0M0MEM0M0MN26M0M0MNDN2BM0M0M6=26=1AMC=2B=CC=17MC=2B=C8=1CMC=2B=C4=1CMC=2B=C0M2=7C=14M0M0M4=7B=26M0M0M4MA=1DMC=2B=B0M6=75M8M0M0M1=2AM0M0MN13=30M2MN58M0M0MN22M0MN11=7E=13M0M0M4MD=2B=30M8=45M8M0M0M0M0M0M0MN19M0M0M0MEM0M0M0MAM0M0MN12M0M0MN20M0M0MN19M0M0MN12M0M0MNDN2CM0M0M6=26=19MC=2B=DN1CMC=2B=CC=1DMC=2B=C8M6=75M8M0M0M1=2AM2=7BMFM0M0M4MAM9=2N78M1M0MN91MC=2B=BN13=30M2MN4FM0M0MN23M0MN11=7E=13M0M0M4MD=2B=32M8=45M8M0M0MN10M0M0MN10M0M0MN16M0M0M0M0M0M0M0MCM0M0MN14M0M0M0MCM0M0M0M0M0M0MNDN2DM0M0M6=26M9=18=91MC=2B=CE=18MC=2B=CA=1BMC=2B=C6M6=2AM2=7BM6M0M0M4MA=16MC=2B=B9MN13=30M7MNE0M0M0MN24M0MN11=7E=13M0M0M4=13M4=2B=45M9=45MDM0M0MN3AM0M0MN56M0M0MN5DM0M0MN36M0M0M0M0M0M0MN15M0M0MN48M0M0MN48M0M0MN17M0M0M0MFM0M0M0MBM0M0MN5DM0M0MN2BM0M0MNDN2EM0M0M6=26=1FMAMD=2B=BB=1CMD=2B=B7=73=20M0M0MA=7AM7=2AM6=2CM5=1FMCMD=2B=A7=11M4=2NF1M0M0MN91=19=5A=2BX1=11M4=1Z27=91=1FM" (Indicator: "cmd=") "N24M1M0MN91=13M5=2B=B3M4M5=61=1Z7E=59M6=61=45M1M0M0M0M5M0M0MN16=13M5=2B=9D=1B=2BX9=14MB=11M7=2NDBM0M0MN93=2N9A=75M0MN59=13M5=2B=86M2=8CM4M0MN1BM3=8CM5M0MN1B=6Z3EM0M0MAMB=11M6=1Z19=91=1C=5B=13M5=38=66XFXFXFM6=17=58MA=1Z28MC=1CMD=1FMAM8=1A=5BM9=59=32MZ11M6=2NF1M0M0MN91=13M5=38=45XFXFXZ11M6=2N24M1M0MN91=2B=EFM7=2A=11M7=1Z16=93=2N62=9FM0MN59=13M5=38=27XFXFXFM0M0M0M6=2AM0MN3AM2=28M2M0M0MA=2A=DN81M0M0M6=26=2AMN36=28=78M0M0M6=2A=DN82M0M0M6=26=2AM0MN36=28=78M0M0M6=2A=DN83M0M0M6=26=2AM0MN13=30M4MND0M0M0MN60M0MN11=7E=2EM0M0M4=13M4=7E=13M0M0M4=13M5=2B=4DM9=45MCM0M0MN7CM0M0MN7CM0M0MN17M0M0MN17M0M0MN1DM0M0MN83M0M0MN1DM0M0MN54M0M0MN3EM0M0M0M0M0M0MN38M0M0MN6EM0M0MNDN84M0M0M6=26=11M4=2NDAM0M0MN93=2NE3=B0M0MN59MD=2B=B3=16MA=1CMD=2B=ADMEM4MEM5=61=1Z2C=59M6=61=45M1M0M0M0M5M0M0MN1FMAMD=2B=95=1E=2BXA=14MB=1DMD=2B=8CM2=8CM4M0MN1BM3M4M5=6Z3FM0M0MAMB=1DMD=38=76XFXFXFM6=17=58MAMEM4=25=5AMEM4=58=18=5D=2CM8=1FMBMD=38=5FXFXFXZ16=2BX7=11M5=2NE8M0M0MN91MD=38=4EXFXFXFM7=74M8M0M0M1=2A=1CMD=38=4NFFXFXZ13=30M4M0M4M1M0MN61M0MN11=7E=13M0M0M4=1" (Indicator: "cmd=") "N24M1M0MN91=13M5=2B=B3M4M5=61=1Z7E=59M6=61=45M1M0M0M0M5M0M0MN16=13M5=2B=9D=1B=2BX9=14MB=11M7=2NDBM0M0MN93=2N9A=75M0MN59=13M5=2B=86M2=8CM4M0MN1BM3=8CM5M0MN1B=6Z3EM0M0MAMB=11M6=1Z19=91=1C=5B=13M5=38=66XFXFXFM6=17=58MA=1Z28MC=1CMD=1FMAM8=1A=5BM9=59=32MZ11M6=2NF1M0M0MN91=13M5=38=45XFXFXZ11M6=2N24M1M0MN91=2B=EFM7=2A=11M7=1Z16=93=2N62=9FM0MN59=13M5=38=27XFXFXFM0M0M0M6=2AM0MN3AM2=28M2M0M0MA=2A=DN81M0M0M6=26=2AMN36=28=78M0M0M6=2A=DN82M0M0M6=26=2AM0MN36=28=78M0M0M6=2A=DN83M0M0M6=26=2AM0MN13=30M4MND0M0M0MN60M0MN11=7E=2EM0M0M4=13M4=7E=13M0M0M4=13M5=2B=4DM9=45MCM0M0MN7CM0M0MN7CM0M0MN17M0M0MN17M0M0MN1DM0M0MN83M0M0MN1DM0M0MN54M0M0MN3EM0M0M0M0M0M0MN38M0M0MN6EM0M0MNDN84M0M0M6=26=11M4=2NDAM0M0MN93=2NE3=B0M0MN59MD=2B=B3=16MA=1CMD=2B=ADMEM4MEM5=61=1Z2C=59M6=61=45M1M0M0M0M5M0M0MN1FMAMD=2B=95=1E=2BXA=14MB=1DMD=2B=8CM2=8CM4M0MN1BM3M4M5=6Z3FM0M0MAMB=1DMD=38=76XFXFXFM6=17=58MAMEM4=25=5AMEM4=58=18=5D=2CM8=1FMBMD=38=5FXFXFXZ16=2BX7=11M5=2NE8M0M0MN91MD=38=4EXFXFXFM7=74M8M0M0M1=2A=1CMD=38=4NFFXFXZ13=30M4M0M4M1M0MN61M0MN11=7E=13M0M0M4=13" (Indicator: "cmd=")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790578999516,"unified_at":"2026-09-28T07:03:19.516Z","metadata":{"hashes":{"sha256":"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2","sha1":"d28d65aec476c947b97a11f73c2a7d00e4fed1cf","md5":"d6f7402ae3336f87cc9dbf12e3f7284c","sha512":"2ceeb551e8c270ce86c3ca0a6e8eb5b17ce9b8179f102eb5ac60936bac760bc0fd5673e558e10451909d1c85bf1976a770e6a3a3a506387bb984fc8e56fd37c5","ssdeep":"24576:BsMSz4oqtmvCTDaPRkxTuzCVWbqjm6yL3uk:PDaZ9qjm5Tu","ssdeep_chunks":["24576:BsMSz4o","24576:sMSz4oq","24576:MSz4oqt","24576:Sz4oqtm","24576:z4oqtmv","24576:4oqtmvC","24576:oqtmvCT","24576:qtmvCTD","24576:tmvCTDa","24576:mvCTDaP","24576:vCTDaPR","24576:CTDaPRk","24576:TDaPRkx","24576:DaPRkxT","24576:aPRkxTu","24576:PRkxTuz","24576:RkxTuzC","24576:kxTuzCV","24576:xTuzCVW","24576:TuzCVWb","24576:uzCVWbq","24576:zCVWbqj","24576:CVWbqjm","24576:VWbqjm6","24576:Wbqjm6y","24576:bqjm6yL","24576:qjm6yL3","24576:jm6yL3u","24576:m6yL3uk","49152:BsMSz4o","49152:sMSz4oq","49152:MSz4oqt","49152:Sz4oqtm","49152:z4oqtmv","49152:4oqtmvC","49152:oqtmvCT","49152:qtmvCTD","49152:tmvCTDa","49152:mvCTDaP","49152:vCTDaPR","49152:CTDaPRk","49152:TDaPRkx","49152:DaPRkxT","49152:aPRkxTu","49152:PRkxTuz","49152:RkxTuzC","49152:kxTuzCV","49152:xTuzCVW","49152:TuzCVWb","49152:uzCVWbq","49152:zCVWbqj","49152:CVWbqjm","49152:VWbqjm6","49152:Wbqjm6y","49152:bqjm6yL","49152:qjm6yL3","49152:jm6yL3u","49152:m6yL3uk","24576:PDaZ9qj","24576:DaZ9qjm","24576:aZ9qjm5","24576:Z9qjm5T","24576:9qjm5Tu"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"PTT PAKETİNİZİ TESLİM EDİYOR.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":874496,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678921063000,"last_seen":1678921204000,"last_multi_scan":1678921204000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":15,"suspicious_count":8,"malicious_count":1,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-VV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found Windows API related strings"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"Found Windows API related strings","description":"$25","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\".Run\" [Source: 348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin]\n Observed keyword:\".Run\" [Source: 00000000-00002844.00000000.66062.01372000.00000020.mdmp\n 00000000-00002844.00000000.66067.01372000.00000020.mdmp]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"GDI32.DLL\" at base 770e0000\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 77070000\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 741d0000\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"ADVAPI32.DLL\" at base 75f50000\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 73620000\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"KERNEL32\" at base 76a80000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76410000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002c7abc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"0e000f00a47abc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"0e000f00d87abc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"11001200387fbc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"11001200a47fbc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"12001300b87fbc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"12001300e07fbc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"14001500bc93bc73ccf5530054b4ba73@ADVAPI32.dll\"\n \"12001300c4cc6c766ce8530022c36c76@IMM32.DLL\"\n \"18001900a8cc6c766ce8530037c36c76@IMM32.DLL\"\n \"1400150090cc6c766ce853004cc36c76@IMM32.DLL\"\n \"1400150078cc6c766ce8530061c36c76@IMM32.DLL\"\n \"0d000e0068cc6c766ce8530076c36c76@IMM32.DLL\"\n \"0d000e0058cc6c766ce853008bc36c76@IMM32.DLL\"\n \"0f00100048cc6c766ce85300a0c36c76@IMM32.DLL\"\n \"0f00100038cc6c766ce85300b5c36c76@IMM32.DLL\"\n \"0d000e0028cc6c766ce85300cac36c76@IMM32.DLL\"\n \"0d000e0018cc6c766ce85300dfc36c76@IMM32.DLL\"\n \"1300140004cc6c766ce85300f4c36c76@IMM32.DLL\"\n \"0a000b00f8cb6c766ce8530009c46c76@IMM32.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$26","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.local\"\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace \"System.Net.Sockets\" in \"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin\"\n Observed namespace \"System.Net\" in \"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"y!o.Vu\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc\n .reloc with unusual entropies 7.68058118745\n 7.61867486375\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2.bin\" has resource with unusual entropy \"RT_ICON:7.95140679589\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at d6f7402ae3336f87cc9dbf12e3f7284c-600000f-Form1~InitializeComponent\n System.Net.Sockets.Socket::Bind(System.Net.EndPoint) at d6f7402ae3336f87cc9dbf12e3f7284c-6000019-Form2~recibe_udp\n System.Net.Sockets.Socket::Close() at d6f7402ae3336f87cc9dbf12e3f7284c-600001a-Form2~Form1_FormClosing\n System.Net.Sockets.Socket::set_EnableBroadcast(System.Boolean) at d6f7402ae3336f87cc9dbf12e3f7284c-6000018-Form2~envia_udp\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at d6f7402ae3336f87cc9dbf12e3f7284c-6000003-Alert~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at d6f7402ae3336f87cc9dbf12e3f7284c-6000007-Chart~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at d6f7402ae3336f87cc9dbf12e3f7284c-600001c-Form2~InitializeComponent","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.2.0.0\"\n \"1.3.0.0\"\n \"16.0.0.0\"\n \"192.168.255.255\"\n \"2.168.255.255\"\n \"255.255.255.255\"\n Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"\n Potential IP \"1.0.0.0\" found in string \"MyApplication.app,version=\"1.0.0.0\"C:\\PTTPAKET_N_Z_TESL_MED_YOR.exe\"\n \"55.255.255.255\"\n \"92.168.255.255\"\n Potential IP \"1.0.0.0\" found in string \"\"\n Potential IP \"6.0.0.0\" found in string \"version=\"6.0.0.0\"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$28","origin":"File/Memory","mitre_attack_id":"T1095","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" wrote bytes \"db4dbe7300000000\" to virtual address \"0x01372000\" (part of module \"PTTPAKET_N_Z_TESL_MED_YOR.EXE\")\n \"PTTPAKET_N_Z_TESL_MED_YOR.exe\" wrote bytes \"7111f3007a3bf200ab8b02007f950200fc8c0200729602006cc805001ecdef007d26ef00\" to virtual address \"0x766C07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"PTTPAKET_N_Z_TESL_MED_YOR.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"64124d1861ca317a5e06bd27","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"PTT PAKETİNİZİ TESLİM EDİYOR.exe","analysis_start_time":"2023-03-15T22:56:25+00:00","indicators_count":{"informative":15,"suspicious":8,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}],"processes":[{"pid":2844,"ppid":0,"name":"PTTPAKET_N_Z_TESL_MED_YOR.exe","command_line":"","sha256":"348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2","normalized_path":"C:\\PTTPAKET_N_Z_TESL_MED_YOR.exe","uid":"00000000-00002844","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABxUlEQVR4Xr2XS07DMBRFk3ZJCAoj2qobYNAiFsEKWEkX0XGqqkkmnXYCEoKC2AQjEMLkObZjP//iJOZIV0rq97l2Pk6TJJT5LXFqcLoW7pqn0LPAB/ntZmJclnWSKXm+0peda6bGcwMnQoio6WOU5yKQJvHi02W7AsC0MSk39ptgAWBiXBSe4PbQxtUqiGMTfMAa0Jf1miRsdaP18JHKjXe75jj67CXsve4fSCrdgLGgjRd3A/TBjyCWi9lKH9eXpCcOE7TX4aCPdzEBObKS7bauYTHg7OEcDMViYGTqkbKXTvF2SWQpQfgaI8Frl04gy7QVcNYFIHH/OlGCQPvTpCnmEX3vy3gMaKudPZ9rBoRb1gSP0XHZADcEXNd7B44HaWY5OBAbcErGMfteBsRv1XG6qM+NBiRwPWFA2bphj7cE1+OGGWNZwPWEASWHneDAxsBSb4hlAdcLNlC8XJDk6kb72mmLVq/SO/mxm8bBIBwTAq719Mm2YdN+AOCEPgZwHZD1CeDXEifgsFC0ep57RkkoH8/sgS3J0RvW2fxfCPm6HpxYs1e+B2zEai7/kQEUE74bbgiO31/00eJyrkIUNhv1kyyQP93A5jmf8cOPAAAAAElFTkSuQmCC"}],"all_imported_dlls":["ntdll.dll","wow64.dll","kernel32.dll","user32.dll","mscoree.dll","usp10.dll","wow64win.dll","advapi32.dll","sechost.dll","sspicli.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","lpk.dll","wow64cpu.dll","msvcrt.dll","cryptbase.dll","fltLib.dll","gdi32.dll","ole32.dll","rpcrt4.dll","ws2_32.dll","mscoreei.dll","KernelBase.dll","oleaut32.dll","imm32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64124d1861ca317a5e06bd27"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64124d1861ca317a5e06bd27"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 348ac0dba533… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 348ac0dba533…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 2/28 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 348ac0dba533… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 348ac0dba533…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 2/28 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/348ac0dba533f7b93f6ef883c95ebe47da2d03201bccf71f364611f64fd44cd2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 348ac0dba533… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 348ac0dba533…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 2/28 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]