26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T478,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Malware_60.0 Sample 34c402fbccf3… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample 34c402fbccf3…. Malware family: Malware_60.0. Threat score 35/100. 1/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","keywords":["Suspicious","Malware_60.0","malware analysis","sandbox report","threat intelligence","34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db"],"about":{"@type":"SoftwareApplication","name":"00158007366709596 3.pdf","applicationCategory":["pdf"],"identifier":"34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","additionalType":"Suspicious sample"},"threatScore":35,"malwareFamily":"Malware_60.0","antivirusDetections":{"malicious":1,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T52d,Pattern match: "4.oi/%f6!!#6lc0j$cp`2ykhwuygm4*3eip2;qfgb", Pattern match: "4.qqj/c-w\e.#rk:xgjql", Pattern match: "mf.bj/#!zikbgpo8d/p.8/6", Pattern match: "urue.pti/%z&2']8", Pattern match: "crt-c2pa.ssl.com/ssl.com-c2pa-root-2025-rsa.cer0", Pattern match: "nq.qj/l!/qyoll%", Pattern match: "4.nt/a%m[i`gzda&h#r*w3fgatt", Pattern match: "vll4.dtx/gxtx`^h_", Pattern match: "oeq.jm/`5fifqxh*:hwbry3", Pattern match: "osrw.btq/mz&ql;$-", Pattern match: "http://www.w3.org/2000/svg", Pattern match: "3.tkd/.o$", Pattern match: "http://ocsp-c2pa.ssl.com0b", Pattern match: "j.cb/qum", Pattern match: "nrv.nw/1dfwji.-_3xeoq]ap-iwqfit$grkl_+@ae?u%'p/n-!q", Pattern match: "http://ocsp-c2pa.ssl.com0", Pattern match: "obyiw.fc/lidq=[;&ckfvu=[:ek;a/l#92_", Pattern match: "xf-szhep.fib/b?mkj,al^pl5b7lotje=rqhrxpx", Pattern match: "jpdlfqqa..gm.gn/7qm,u*r`-4tjk8", Pattern match: "bau73iagu.doe/5t$gsqa4d4:n%_r", Pattern match: "uc.hyuc/6sya&et!k+/d%*:r$qqzha4uy?sigr&qh8jx!#$,,qtkk0+^c", Pattern match: "cv.iptc.org/newscodes/digitalsourcetype/trainedalgorithmicmediamsoftwareagent", Pattern match: "rfobfpt8-jg.hx/[`3eoileqy$ey=", Pattern match: "q4.hx/;zn", Pattern match: "l.zo/udo2tkdrrd@", Pattern match: "j4h9wrj3.ih/ce5i7t=3qjkup1max&+&0!ydq2tp6lf%w-z'#ka4", Pattern match: "http://crt-c2pa.ssl.com/ssl.com-c2pa-i-r1.cer0$"28:T426,Found string - rU&7B@jB%,s8MnJaZ;Y6pi(3uc:Y4^Lm9H<)-$4G8X)V"J,s>?o1@qYFFco?'.1keTVh\4,?Y"d?ZXILIZG=#JgZVMNJTp[/9fVo-BL):E6^&U^/K5GNueb2hfR=AZ,s#HI=.Glnr>]K^%nj4U"EKnj!!\6J-e5J[TGZh`efX*k#83kP[72K5T@\.\i8T?:ue/[S(5ET.JpYL78=0_?Qee;UdjbD)7-<1Kl0OTr)p.2D;Lr0Xo!m/IQS0;PRE/G*p&Ak)+K)d(TlJ&eOBD_Gl%i+k*.q1Z(np&_#"b:?;qt0.5a+4I:(`t]4Af)/Q[+8GBit3$G.7o76o=u%te1VVON#0]:3D:J$2QhHfiE^Z`[IM6Ua7m.8UELHabNV5f/Hl@%NJK(4p,ICEXe=]Y1R0:_P0ed2n^]/q)ETGt^Yb`6CbsDB@E=ia2QcRGf3NUV#9S=I='1oWpS2sAo)e0?fK/G`-BhL%rR]*Og'6*d7:HU-`$cFqhqr04S+Ne6in2=<\M/Y;LTd,"fY,sss2BlA-#"Jl9g;"'FI:hD+ZJ.lZQ48F0i'1T+b0=2?cF>]7.#_lpMEd7b9efD$2us`"PpOEQ&Y(-?`fK>`jfl5Q:H<-_Gd,TSR,Ljsg&; Source: "sample.bin")29:Tc52,Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCGECHAGFBAAAA" Process AcroRd32.exe created mutex with name "Local\SM0:5472:168:WilStaging_02" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Acrobat Instance Mutex" Process AcroRd32.exe created mutex with name "SM0:5472:64:WilError_03" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer" Process AcroRd32.exe created mutex with name "DirectSound DllMain mutex (0x00001560)" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex" Process AcroRd32.exe created mutex with name "SM0:5472:168:WilStaging_02" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer" Process AcroRd32.exe created mutex with name "Global\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer" Process AcroRd32.exe created mutex with name "DBWinMutex" Process AcroRd32.exe created mutex with name "{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCGECHAGFBAAAA" Process AcroRd32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5472:168:WilStaging_02"2a:T834,"AdobeFnt14.lst.5472" has type "PostScript document text"- [targetUID: 00000000-00005472] "A9Rv4tv78_1g65ttw_480.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Rv4tv78_1g65ttw_480.tmp]- [targetUID: 00000000-00005472] "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00005472] "A9Ru6hroz_1g65tty_480.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)"- Location: [%TEMP%\A9Ru6hroz_1g65tty_480.tmp]- [targetUID: 00000000-00005472] "Annssi.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00005472] "Annss.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00005472] "addressbook.acrodata" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00005472] "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00005472] "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00005472] "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" has type " sha1WithRSAEncryption countryName=US"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00005472] "Annssk.dat" has type "data"- Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00005472] "GlobSettings" has type "ASCII text"- Location: [%APPDATA%\Adobe\Acrobat\11.0\JSCache\GlobSettings]- [targetUID: 00000000-00005472] "FAPA34A.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\FAPA34A.tmp]- [targetUID: 00000000-00005472]2b:T5a3,Dropped file: "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl]- [targetUID: 00000000-00005472] Dropped file: "Annssi.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssi.dat]- [targetUID: 00000000-00005472] Dropped file: "Annss.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annss.dat]- [targetUID: 00000000-00005472] Dropped file: "addressbook.acrodata" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\addressbook.acrodata]- [targetUID: 00000000-00005472] Dropped file: "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl]- [targetUID: 00000000-00005472] Dropped file: "0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl]- [targetUID: 00000000-00005472] Dropped file: "CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\CRLCache\CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl]- [targetUID: 00000000-00005472] Dropped file: "Annssk.dat" - Location: [%APPDATA%\Adobe\Acrobat\11.0\Security\Annssk.dat]- [targetUID: 00000000-00005472] Dropped file: "GlobSettings" - Location: [%APPDATA%\Adobe\Acrobat\11.0\JSCache\GlobSettings]- [targetUID: 00000000-00005472]2c:T5a0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD/klEQVR4Xu2VXWibVRjHX4W2XtjUUtBtxmyKY1tdkV1MZFLwxumtIHqhRRT0QrzRTmjXMbdBQahbgpqVripWL1bDqpurYtOyYbYuH21X1tk0azBpu3xK06Rt+v3x930OnOy8J3mTRtiV/uFHcvImz+85z8mbKMr/2WKi0SgikQjC4TAjFAploDVdI+h9sViMPZ+cnIRcJysXn3wW9wOSe71eTE1NobGxUb+Rzl01+OX5lzT0f3CEIa77Xn0r6316UM1gMAin0wkKNaPbRIfpGZzfWaOBJ+n1oavmUGYduHBJc50if5agmoFAINMARfc4zj2xDz/s3K+BQo9T9iu4ZT7L1vY33kE6FMaN+qbMdT2opjgBHr/fn93EF4/vwbdqxyIU26HDSKgTcJ/8jK3p9WGzlSFG/ixBNakBl8uleS/F5/Npm2jZsRttasciPLe/+T6zpseI04OrHx9l68uvv82QP0tQzYmJCQwNDcFms8FiscBqtcJut2N2dhZjY2P3mmje/jSsxr0aKPKacuvrjpzXZagmnfn4+Di6u7vR3t7OmmhubobZbGa3aaaB49uegkUdWT4uvFaH1n0Hs17Xg2pSA/F4nB0FjX1kZARutxsOh4PdnpkGGh7dhfsB3f8zMzNIJpOMVCqFRCLBfrQ0E6isrER5eXleysrK4PF4GLQL/pwzMDAAx4OluLanGs76TzA6Osp+CUU5nf3c3Bxjfn7+XgNGoxFVVVV5KSkpYSPVg3Y7/EApfB8dgf+0mf0cT09PM3EueTqdzr4dC4XGpweN+k9DFcb2H0D08q8acS75wsJC8Q2QRA8a8+0XXoRbKUX82vWcYlH+rxrg5ynDd3unoQkOpUxXzOWLi4sMuX7BcJEM36234RjsykP4q/VcTjGXLy0tMeT6BcNFInynxO+Gx9Br2o0elZR6q8liUb68vFx8A6JMHvFw43H8bNiGyA0XflIf+998V1dMrKysFN8Al8njTaq7/dGwHYNHTzBp2OnGeXV9seY5+G1dDPexU7jZYkHUM8jkq6urxTfAheJoCbcq7jTtRdjlgavpJC7VHkab8jCjVeWsUo7vTNXoqXtP/aesRrD3KtbW1opvQJTy0YZUqVUVEF21L6O/6RQCPX2Yi8XZqIO9V/Bb3ftoU/+iWxQDLBVGhAdvYn19vfgGxPNMRWPo+7AeZ9SinbWvZM6Wny+HRk3Qjon0dILJNzY2im+Af4nuugfxlTrK0+puiL/v+HNKRTFJuZjY3NwsvgEuOKOO81OlgjHQ3qERilI9MUGR6xcMF5yoMKFBeQR/fP5lllCU6ol55PoFI4vyCUWpLOaR6xeMKMol3IpUjFy/YPLJtioVI9f/7+YfMhfXVn7gbsAAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1793748628598,"unified_at":"2026-11-03T23:30:28.598Z","metadata":{"hashes":{"sha256":"34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","sha1":"d2893b426f484c766b884cc63178dfa53a0b5d7b","md5":"ca0b134e718f792b335e43cd805c24f4","sha512":"dd73b9f0bfc0ac294014bb9d5ccb5ceb09adc5d974052a0ab96a831ab05ce5a934961558df209e11164292891507976dd50d70f4c6db8960f05ef509ab7067a0","ssdeep":"6144:ww3cWg+otdL6CQpvgonziy/i5P4osifUBysmrSp1/zj0JLascET3:RYdLGFeKiB4c1smrZdaeT3","ssdeep_chunks":["6144:ww3cWg+","6144:w3cWg+o","6144:3cWg+ot","6144:cWg+otd","6144:Wg+otdL","6144:g+otdL6","6144:+otdL6C","6144:otdL6CQ","6144:tdL6CQp","6144:dL6CQpv","6144:L6CQpvg","6144:6CQpvgo","6144:CQpvgon","6144:Qpvgonz","6144:pvgonzi","6144:vgonziy","6144:gonziy/","6144:onziy/i","6144:nziy/i5","6144:ziy/i5P","6144:iy/i5P4","6144:y/i5P4o","6144:/i5P4os","6144:i5P4osi","6144:5P4osif","6144:P4osifU","6144:4osifUB","6144:osifUBy","6144:sifUBys","6144:ifUBysm","6144:fUBysmr","6144:UBysmrS","6144:BysmrSp","6144:ysmrSp1","6144:smrSp1/","6144:mrSp1/z","6144:rSp1/zj","6144:Sp1/zj0","6144:p1/zj0J","6144:1/zj0JL","6144:/zj0JLa","6144:zj0JLas","6144:j0JLasc","6144:0JLascE","6144:JLascET","6144:LascET3","12288:ww3cWg+","12288:w3cWg+o","12288:3cWg+ot","12288:cWg+otd","12288:Wg+otdL","12288:g+otdL6","12288:+otdL6C","12288:otdL6CQ","12288:tdL6CQp","12288:dL6CQpv","12288:L6CQpvg","12288:6CQpvgo","12288:CQpvgon","12288:Qpvgonz","12288:pvgonzi","12288:vgonziy","12288:gonziy/","12288:onziy/i","12288:nziy/i5","12288:ziy/i5P","12288:iy/i5P4","12288:y/i5P4o","12288:/i5P4os","12288:i5P4osi","12288:5P4osif","12288:P4osifU","12288:4osifUB","12288:osifUBy","12288:sifUBys","12288:ifUBysm","12288:fUBysmr","12288:UBysmrS","12288:BysmrSp","12288:ysmrSp1","12288:smrSp1/","12288:mrSp1/z","12288:rSp1/zj","12288:Sp1/zj0","12288:p1/zj0J","12288:1/zj0JL","12288:/zj0JLa","12288:zj0JLas","12288:j0JLasc","12288:0JLascE","12288:JLascET","12288:LascET3","6144:RYdLGFe","6144:YdLGFeK","6144:dLGFeKi","6144:LGFeKiB","6144:GFeKiB4","6144:FeKiB4c","6144:eKiB4c1","6144:KiB4c1s","6144:iB4c1sm","6144:B4c1smr","6144:4c1smrZ","6144:c1smrZd","6144:1smrZda","6144:smrZdae","6144:mrZdaeT","6144:rZdaeT3"],"imphash":"Unknown"},"file_info":{"file_name":"00158007366709596 3.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":357887,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793748358000,"last_seen":1793748358000,"last_multi_scan":1793748358000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"encrypted","type":"bool","values":[false]},{"name":"version","type":"str","values":["1.3"]},{"name":"page_count","type":"int","values":[1]}]}]},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":22,"suspicious_count":2,"malicious_count":0,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_60.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware_60.0","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download payload"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"PDF contains an embedded file"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Opens a handle to the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains an object with compressed stream data"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Network Related","name":"Able to download payload","description":"Found string \"curlx)self#jumbf=c2pa.assertions/c2pa.hash.datadhashX \n\" (Indicator: \"curl\"; Source: \"sample.bin\"), Found string \"curlx$self#jumbf=c2pa.assertions/c2pa.icondhashX u>\" (Indicator: \"curl\"; Source: \"sample.bin\"), Found string \"curlx*self#jumbf=c2pa.assertions/c2pa.actions.v2dhashX \" (Indicator: \"curl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-10039","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F4]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"HKDF\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$28","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"AcroRd32.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"AcroRd32.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Renames files","description":"\"AcroRd32.exe\" renamed original file\"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.5472\" to \"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains CRYPTO related strings","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"AcroRd32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005472)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"General","name":"Contains an object with compressed stream data","description":"Object ID 9 contains compressed stream data: No filters","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$29","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"addressbook.acrodata\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"00158007366709596 3.pdf\" was detected as \"PDF\" and name: \"Format\"\n \"00158007366709596 3.pdf\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"General","name":"PDF contains only a single page","description":"Tag \"pages\" has a value of \"1\"","origin":"Static Parser","relevance":5,"id":"static-58","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$2a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"A9Rv4tv78_1g65ttw_480.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Rv4tv78_1g65ttw_480.tmp]\n \"A9Ru6hroz_1g65tty_480.tmp\" has type \"Zip data (MIME type \"application/vnd.adobe.air-ucf-package+zip\"?)\" - Location: [%TEMP%\\A9Ru6hroz_1g65tty_480.tmp]\n \"FAPA34A.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\FAPA34A.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens a handle to the specified process","description":"\"AcroRd32.exe\" opens a process \"C:\\Program Files (x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe\" (UID: 00000000-00005472)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-237","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssi.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annss.dat\"\n \"AcroRd32.exe\" writes a file \"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\Annssk.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"AcroRd32.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 75130000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains embedded objects that may warrant investigation","description":"Embedded object type \"/EmbeddedFile\" (ID: 9, References: )","origin":"Static Parser","relevance":5,"id":"static-10","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$2b","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/23 Antivirus vendors marked sample as malicious (4% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"level":"suspicious","category":"General","name":"PDF contains an embedded file","description":"Embedded file has a length of 48645 bytes with an entropy of 5.356961 (ID: 9, References: )","origin":"Static Parser","mitre_attack_id":"T1204.002","relevance":10,"id":"static-71","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]}],"intel_graph":{"map":{"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1":{"type":"File","value":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},"File:044de0e1da9f942f6f8bea09c865c6465297d30090467e5f0ad657ba5bab323c":{"type":"File","value":"044de0e1da9f942f6f8bea09c865c6465297d30090467e5f0ad657ba5bab323c"},"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60":{"type":"File","value":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db":{"type":"File","value":"34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db"},"File:4be5ea28511df812fb53786b2a294027b6e9593f17053c5da6ff787963ef7161":{"type":"File","value":"4be5ea28511df812fb53786b2a294027b6e9593f17053c5da6ff787963ef7161"},"File:4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e":{"type":"File","value":"4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e"},"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68":{"type":"File","value":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975":{"type":"File","value":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e":{"type":"File","value":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},"File:7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486":{"type":"File","value":"7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486"},"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08":{"type":"File","value":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3":{"type":"File","value":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},"File:eb19db630a45bb155ad2454c1b903d2e3d00558d83c15c58be9e75710c4ba9a9":{"type":"File","value":"eb19db630a45bb155ad2454c1b903d2e3d00558d83c15c58be9e75710c4ba9a9"},"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71":{"type":"File","value":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"}},"chains":[{"id":"sandbox_files","root":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","edges":[{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:4be5ea28511df812fb53786b2a294027b6e9593f17053c5da6ff787963ef7161"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:044de0e1da9f942f6f8bea09c865c6465297d30090467e5f0ad657ba5bab323c"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:eb19db630a45bb155ad2454c1b903d2e3d00558d83c15c58be9e75710c4ba9a9"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08"},{"edge_kind":"extracted","from_key":"File:34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db","to_key":"File:4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":47,"imported_dlls_count":124,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6aea6d86d1538d4b44003291","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"malware_family":"Malware_60.0","submit_name":"00158007366709596 3.pdf","analysis_start_time":"2026-11-03T23:25:59+00:00","indicators_count":{"informative":21,"suspicious":2,"malicious":0},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}],"processes":[{"pid":5472,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\001580073667095963.pdf\"","sha256":"c43c0929e1f9b27dac07d49b0a659e83be4cdb4dfdd709eb7e37a341cd169e87","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00000000-00005472","icon":"$2c"}],"all_imported_dlls":["userenv.dll","crypt32.dll","sqlite.dll","propsys.dll","msvcp110_win.dll","msimg32.dll","user32.dll","wldp.dll","AXE8SharedExpat.dll","GdiPlus.dll","devobj.dll","BIB.dll","msctf.dll","TextShaping.dll","winmmbase.dll","CoolType.dll","dsound.dll","bcryptprimitives.dll","ntmarta.dll","msvcp100.dll","powrprof.dll","wsock32.dll","mswsock.dll","uxtheme.dll","wow64cpu.dll","shlwapi.dll","coloradapterclient.dll","OnDemandConnRouteHelper.dll","advapi32.dll","msacm32.dll","wkscli.dll","mlang.dll","ole32.dll","comdlg32.dll","FWPUCLNT.DLL","oleaut32.dll","apphelp.dll","clbcatq.dll","ccme_base.dll","kernel32.dll","d3d11.dll","twinapi.appcore.dll","ACE.dll","sechost.dll","windows.storage.dll","mscms.dll","MMDevAPI.dll","ucrtbase.dll","iertutil.dll","CoreUIComponents.dll","AGM.dll","cryptbase.dll","dwmapi.dll","CoreMessaging.dll","secur32.dll","msasn1.dll","dnsapi.dll","wow64win.dll","SHCore.dll","AcroRd32.dll","dcomp.dll","policymanager.dll","cryptocme.dll","psapi.dll","netapi32.dll","schannel.dll","ksuser.dll","BIBUtils.dll","kernel.appcore.dll","ntdll.dll","rpcrt4.dll","bcrypt.dll","AcGenral.dll","WinTypes.dll","AdobeXMP.dll","winhttp.dll","gdi32full.dll","ccme_ecc.dll","ws2_32.dll","winnsi.dll","coml2.dll","profapi.dll","msvcp_win.dll","combase.dll","shell32.dll","imm32.dll","dxgi.dll","cryptsp.dll","AXSLE.dll","version.dll","ieframe.dll","cfgmgr32.dll","TextInputFramework.dll","IPHLPAPI.DLL","rasadhlp.dll","wow64.dll","gdi32.dll","urlmon.dll","rsaenh.dll","samcli.dll","win32u.dll","mpr.dll","srvcli.dll","DataExchange.dll","avrt.dll","nsi.dll","ccme_base_non_fips.dll","wininet.dll","WindowsCodecs.dll","netutils.dll","NPSWF32.dll","thumbcache.dll","ccme_ecdrbg.dll","sspicli.dll","comctl32.dll","umpdc.dll","gpapi.dll","winmm.dll","msvcrt.dll","dpapi.dll","SensApi.dll","KernelBase.dll","msvcr100.dll","ccme_asym.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"addressbook.acrodata","sha256":"679e254e87bc61649324cf321e371c85579d9799eb467afb8b1389c0e8df921e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"GlobSettings","sha256":"7c22c759ca704106556bbc4fc10b7f53404ca1f8b40f01038d3f7c4b8183f486","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Annss.dat","sha256":"4be5ea28511df812fb53786b2a294027b6e9593f17053c5da6ff787963ef7161","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Annssi.dat","sha256":"044de0e1da9f942f6f8bea09c865c6465297d30090467e5f0ad657ba5bab323c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Annssk.dat","sha256":"eb19db630a45bb155ad2454c1b903d2e3d00558d83c15c58be9e75710c4ba9a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sha256":"f32d5907bc2764d46200ae367c79924551b596aa51a0a67f1a1927a77bee0f71","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"5a11b4fc347abfdaeb2416d376375478ed707f35a768eacc3c03393099547a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"006646f42030d990c3c08786e19b8ec683b63c011e7b2c98b1d91a12aca05dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"A9Ru6hroz_1g65tty_480.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"A9Rv4tv78_1g65ttw_480.tmp","sha256":"5c74fec27dec1d0fe65987b22d85ba7953e118b34ed48ad59a8000e4d3d4f975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"FAPA34A.tmp","sha256":"9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"AdobeFnt14.lst.5472","sha256":"4bed2f3577b8b76dddaf1533dc7625a5f8353b24adfc779b5c7b3eae31d2d97e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]}],"files_written":[{"path":"pipe\\GmdAslLogger","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%TEMP%\\FAPA34A.tmp","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeFnt14.lst.5472","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCGECHAGFBAAAA","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Local\\SM0:5472:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"SM0:5472:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"DirectSound DllMain mutex (0x00001560)","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"SM0:5472:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCGECHAGFBAAAA","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5472:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5472:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5472:64:WilError_03","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DirectSound DllMain mutex (0x00001560)","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwWriterMutex","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_16.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_32.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_48.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_96.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_256.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_768.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1280.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_1920.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_2560.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_sr.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_exif.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_wide_alternate.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_custom_stream.db!dfMaintainer","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!IconCacheInit","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]},{"name":"\\BaseNamedObjects\\C::Users:%OSUSER%:AppData:Local:Microsoft:Windows:Explorer:iconcache_idx.db!rwReaderRefs","sources":[{"report_type":"sandbox","report_id":"6aea6d86d1538d4b44003291"}]}]}},"report_ids":{"sandbox_job_ids":["6aea6d86d1538d4b44003291"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Malware_60.0 Sample 34c402fbccf3… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 34c402fbccf3…. Malware family: Malware_60.0. Threat score 35/100. 1/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db"}],["$","meta","4",{"property":"og:title","content":"Suspicious Malware_60.0 Sample 34c402fbccf3… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 34c402fbccf3…. Malware family: Malware_60.0. Threat score 35/100. 1/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/34c402fbccf3f9bbb8b331eb6961594bb45d2bd4a64c03f2f4144d34352714db"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Malware_60.0 Sample 34c402fbccf3… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 34c402fbccf3…. Malware family: Malware_60.0. Threat score 35/100. 1/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]