21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 382bb1ca5fb4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 382bb1ca5fb4…. Malware family: Malware. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25"],"about":{"@type":"SoftwareApplication","name":"RFQ SPECIFICATION 20220393.PDF.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T5b7,".exe" wrote 1024 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 77824 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 18944 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 1536 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 11776 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 4096 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 512 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 4 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 32 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620) ".exe" wrote 52 bytes to a remote process "C:\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe" (Handle: 620)23:T499,"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],adddword ptr [eax], eax,addbyte ptr [eax], al,adddword ptr [eax], eax,addbyte ptr [eax], al,adddword ptr [eax], eax,addbyte ptr [eax], al,addal, byte ptr [eax],addbyte ptr [eax], al,addal, byte ptr [eax],addbyte ptr [eax], al,addeax, dword ptr [eax],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"24:T59a,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[],"files_deleted":[],"files_written":[{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\dOjNZFCbFhdYLHPxWPZkOuGO","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"name":"dOjNZFCbFhdYLHPxWPZkOuGO","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["api-ms-win-core-synch-l1-2-0.dll","shlwapi.dll","sechost.dll","kernel32.dll","clr.dll","System.Xml.ni.dll","iertutil.dll","user32.dll","cryptbase.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msctf.dll","lpk.dll","gdi32.dll","mscorlib.ni.dll","uxtheme.dll","profapi.dll","vcruntime140_clr0400.dll","mscoree.dll","fltLib.dll","psapi.dll","System.Windows.Forms.ni.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","urlmon.dll","bcrypt.dll","Microsoft.VisualBasic.ni.dll","nlssorting.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","cryptsp.dll","normaliz.dll","netutils.dll","oleaut32.dll","netapi32.dll","srvcli.dll","imm32.dll","comctl32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","shell32.dll","ucrtbase_clr0400.dll","KernelBase.dll","wininet.dll","advapi32.dll","api-ms-win-core-xstate-l2-1-0.dll","rsaenh.dll","WindowsCodecs.dll","wkscli.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","msvcrt.dll","System.Windows.Forms.dll","samcli.dll","nsi.dll","GdiPlus.dll","clrjit.dll","System.Core.ni.dll","System.ni.dll","userenv.dll","msasn1.dll","usp10.dll","version.dll","mscoreei.dll","crypt32.dll","rpcss.dll","System.Configuration.ni.dll","apphelp.dll","RpcRtRemote.dll","System.Drawing.ni.dll","rpcrt4.dll","ws2_32.dll","ole32.dll","mscorrc.dll","ntdll.dll"],"processes":[{"command_line":"","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABUElEQVR42u2XO2uEQBRG98enSULABGMXtJKgRWrtZEEbFxGx0i20CYJR8VFsdcMVlEnYXcfHzjR74WChM+ebGR/jbnevDar7+gSEi7wWn4GEq3wANA24yQeaj3fgIib5eX0C5jNQvT2yuQ++Xx7gHDeRZVkGdV3PJs/z5YGWCK+Rpil9GLwYWStt2xaGvpAgCMAwDKAOgDRNM1uMbcg+yADIrABI13XUct/3z8qpA1xqPBXCdd2L4k0CHI/Hfk3/i5MkgTAMJ+WrAyCe5/UjLYqiP9KMeqCqqvUB1oDvhMkAt5IjpmnyDbDf7/kGGORcApRlOcplWWYf4HQ6jQEkSWIfgLwBBUFg/xjatk3/HcCyLAuiKNp8+lVVnb8/wIaHw2GxnJz+q+tPU7quj51hxzhLKCGJ47g/R4oRx3G2366JogiKovwRXUJj8a9wryX1C5bWFlIRK34EAAAAAElFTkSuQmCC","name":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe","normalized_path":"C:\\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe","pid":2588,"ppid":0,"sha256":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25","uid":"00000000-00002588"},{"command_line":"","name":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe","normalized_path":"C:\\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe","parent_uid":"00000000-00002588","pid":1972,"ppid":2588,"sha256":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25","uid":"00000000-00001972"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\GDIPLUS\\","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Multi-Process"],"sandbox_reports":[{"analysis_start_time":"2023-02-09T16:55:51+00:00","environment_description":"Windows 7 32 bit","environment_id":100,"id":"63e52596d13cfd1a3b4ba68f","indicators_count":{"informative":29,"malicious":8,"suspicious":15},"is_in_unified_schema":true,"malware_family":"Trojan.Generic","state":"SUCCESS","submit_name":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe","tags":["Multi-Process"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":0,"files_deleted_count":0,"files_written_count":2,"http_requests_count":0,"imported_dlls_count":71,"injected_processes_count":0,"mutex_created_count":2,"process_count":2,"registry_keys_created_count":2,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"script_calls_count":0,"spawned_processes_count":2}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Malware"}]},"av_detections":{"engines":{"aegislab":{"data_source":"MetaDefender","name":"AegisLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan/Win.PWSX-gen","verdict":"malicious"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TR/Spy.Noon.ngrmc","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.65364527","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"cyren":{"data_source":"MetaDefender","name":"Cyren","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"W32/MSIL_Kryptik.IVA.gen!Eldorado","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.65364527 (B)","verdict":"malicious"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Win32/Warzone.A trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Riskware ( 0040eff71 )","verdict":"malicious"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"HEUR:Trojan-Spy.MSIL.Noon.gen","verdict":"malicious"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"AgentTesla-FCYU!8C06588ECD86","verdict":"malicious"},"microsoftdefender":{"data_source":"MetaDefender","name":"Microsoft Defender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Troj/Krypt-UV","verdict":"malicious"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicro":{"data_source":"MetaDefender","name":"Trend Micro","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicrohousecall":{"data_source":"MetaDefender","name":"Trend Micro HouseCall","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.PSWStealer.DOO","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"TScope.Trojan.MSIL","verdict":"malicious"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Hooks API calls"}],"details_count":1,"name":"Spyware","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Installs hooks/patches the running process"}],"details_count":2,"name":"Persistence","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"details_count":3,"name":"Fingerprint","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Language Discovery"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Discovery","technique":"Peripheral Device Discovery"},{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Debugger Evasion"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Hollowing"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Credential API Hooking"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"}],"rule_matches":{},"sandbox_signatures":[{"category":"Network Related","description":"System.Windows.Forms.TabPage::set_TabIndex at 8c06588ecd86390ef04ebc5b014f39fd-600009e-Form1~InitializeComponent\n System.Windows.Forms.Control::set_TabIndex at 8c06588ecd86390ef04ebc5b014f39fd-60000a9-MainForm~InitializeComponent","id":"stream-85","level":"suspicious","mitre_attack_id":"T1571","name":"Contains ability to open a port and listen for incoming connection","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Network Related","description":"\"1.0.0.0\"\n \"16.0.0.0\"","id":"string-14","level":"suspicious","name":"Found potential IP address in binary/memory","origin":"File/Memory","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00002588)","id":"api-148","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve SID domain name","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002588)\n \".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00002588)","id":"api-147","level":"informative","mitre_attack_id":"T1614.001","name":"Calls an API typically used to retrieve local language","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" queries volume information of \"C:\\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe\" at 00000000-00002588-0000010C-1148901","id":"api-11","level":"informative","mitre_attack_id":"T1120","name":"Queries volume information","origin":"API Call","relevance":2,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Network Related","description":"Heuristic match: \"#Q80Z=.Hr\"","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","id":"api-1","level":"suspicious","mitre_attack_id":"T1622","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe\" - (UID: 00000000-00002588)","id":"api-129","level":"malicious","mitre_attack_id":"T1055.012","name":"Creates a process in suspended mode (likely for process injection)","origin":"API Call","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"49/85 Antivirus vendors marked spawned process \".exe\" (PID: 1972) as malicious (classified as \"Trojan.Generic\" with 57% detection rate)","id":"target-58","level":"malicious","name":"The analysis spawned a process that was identified as malicious","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"OpenMutexW\" with parameter \"dOjNZFCbFhdYLHPxWPZkOuGO\" - (UID: 00000000-00002588)","id":"api-144","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to open an existing named mutex object","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00002588)","id":"api-122","level":"informative","name":"Calls an API typically used to create a directory","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe\" - (UID: 00000000-00002588)","id":"api-128","level":"informative","mitre_attack_id":"T1106","name":"Calls an API typically used to create a process","origin":"API Call","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66B90000","id":"module-3","level":"informative","name":"Loads the .NET runtime environment","origin":"Loaded Module","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"\"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.bin\" has resource with unusual entropy \"RT_ICON:7.91866163123\"","id":"static-92","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy resources","origin":"Static Parser","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$22","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"IsWow64Process\" with parameter \"2588\" - (UID: 00000000-00002588)","id":"api-146","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to retrieve is X64 architecture","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\dOjNZFCbFhdYLHPxWPZkOuGO\"\n \"dOjNZFCbFhdYLHPxWPZkOuGO\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002588)","id":"api-103","level":"informative","mitre_attack_id":"T1057","name":"Calls an API typically used for taking snapshot of the specified processes","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"External Systems","description":"7/22 Antivirus vendors marked sample as malicious (31% detection rate)\n 47/70 Antivirus vendors marked sample as malicious (67% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","id":"registry-26","level":"suspicious","mitre_attack_id":"T1614.001","name":"Reads the windows installation language","origin":"Registry Access","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"External Systems","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","id":"avtest-8","level":"malicious","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","origin":"External System","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00002588)\n \".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00002588)","id":"api-124","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get product type","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\".exe\" at 00000000-00002588-00000105-1890093","id":"api-10","level":"suspicious","mitre_attack_id":"T1622","name":"Queries kernel debugger information","origin":"API Call","relevance":6,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":".text\n .rsrc with unusual entropies 7.9527478533\n 7.11767035497","id":"static-6","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file has unusual entropy sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"C:\\382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.exe","id":"api-8704","level":"suspicious","name":"Detects sample launching another instance of itself","origin":"API Call","relevance":8,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","id":"api-28","level":"suspicious","name":"Adjusts debug privileges","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"System Security","description":"\"ShellExecuteA@SHELL32.DLL\" in \".exe\"\n \"ShellExecuteW@SHELL32.DLL\" in \".exe\"","id":"hooks-0","level":"suspicious","mitre_attack_id":"T1056.004","name":"Hooks API calls","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\".exe\" wrote bytes \"306af78e\" to virtual address \"0x67FAF798\" (part of module \"CLR.DLL\")\n \".exe\" wrote bytes \"db4d896c00000000\" to virtual address \"0x00F32000\" (part of module \"382BB1CA5FB48747A7F3FA6FC3ACD4225874FEA3BA5009E8D057B4E4F3352D25.EXE\")\n \".exe\" wrote bytes \"e93b031bf6\" to virtual address \"0x76648790\" (\"ShellExecuteA@SHELL32.DLL\")\n \".exe\" wrote bytes \"e9e2533ef6\" to virtual address \"0x76413C29\" (\"ShellExecuteW@SHELL32.DLL\")","id":"hooks-8","level":"suspicious","mitre_attack_id":"T1056.004","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"$23","id":"static-96","level":"informative","name":"PE file entrypoint instructions","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \".exe\" (UID: 00000000-00001972)","id":"target-103","level":"informative","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")","id":"registry-25","level":"informative","mitre_attack_id":"T1012","name":"Reads information about supported languages","origin":"Registry Access","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\".exe\" queried SystemProcessInformation at 00000000-00002588-00000105-1724299\n \".exe\" queried SystemProcessInformation at 00000000-00002588-00000105-8026395\n \".exe\" queried SystemProcessInformation at 00000000-00002588-00000105-10363339360142874","id":"api-9","level":"suspicious","mitre_attack_id":"T1057","name":"Queries process information","origin":"API Call","relevance":4,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" sleeping for \"1566804069\" milliseconds","id":"api-24","level":"suspicious","mitre_attack_id":"T1497.003","name":"Tries to sleep for a long time (more than two minutes)","origin":"API Call","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","id":"api-111","level":"suspicious","mitre_attack_id":"T1134","name":"Calls an API typically used to enable or disable privileges in the specified access token","origin":"API Call","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","id":"registry-78","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to read software policies","origin":"Registry Access","relevance":1,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","id":"registry-35","level":"informative","mitre_attack_id":"T1012","name":"Reads the active computer name","origin":"Registry Access","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$24","id":"api-126","level":"informative","mitre_attack_id":"T1083","name":"Tries to access non-existent files","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002588)","id":"api-105","level":"informative","mitre_attack_id":"T1113","name":"Calls an API possibly used to take screenshots","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"External Systems","description":"47/70 Antivirus vendors marked sample as malicious (67% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"External Systems","description":"No specific details available","id":"avtest-5","level":"malicious","name":"Sample was identified as malicious by a trusted Antivirus engine","origin":"External System","relevance":10,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00002588)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00002588)","id":"api-125","level":"informative","mitre_attack_id":"T1082","name":"Calls an API typically used to get system version information","origin":"API Call","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"\"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.bin\" has an executable section named \".text\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\".exe\" called \"FindFirstFileW\" (UID: 00000000-00002588)\n \".exe\" called \"FindNextFileW\" (UID: 00000000-00002588)","id":"api-102","level":"informative","mitre_attack_id":"T1083","name":"Calls an API's typically used for searching a directory for a files","origin":"API Call","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed function tostring in 382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.bin\n Observed function concat in 382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.bin","id":"static-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode string content at runtime","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"informative","mitre_attack_id":"T1082","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":5,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \".exe\" (UID: 00000000-00001972)","id":"target-25","level":"informative","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","id":"api-55","level":"informative","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25.bin has big resource with name: Allocate size: 55808 and abnormal entropy:7.78399503221","id":"static-129","level":"informative","mitre_attack_id":"T1027","name":"Dotnet file resource with suspicious entropy","origin":"Static Parser","relevance":1,"sources":[{"report_id":"63e52596d13cfd1a3b4ba68f","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":14,"suspicious_count":0,"total_engines":27},"mitre_attacks":{"total":18},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":29,"malicious_count":6,"suspicious_count":15,"total":50}},"summary":{"score":100,"tags":null,"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"RFQ SPECIFICATION 20220393.PDF.exe","file_size":759808,"file_type":["peexe","assembly","executable"],"file_type_id":".NET exe"},"hashes":{"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744","md5":"8c06588ecd86390ef04ebc5b014f39fd","sha1":"7f499ce7ed8c8d7db6778605d9a6882caf504e42","sha256":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25","sha512":"61d04420e31cc4913f7c5628631f1ab4f19380bdced6b4aae5ea485d1d1c10d03c049e9cd9569fdf9b8e19aa4e070cfaf597d1d9487b9d5e28ed605d8c96bae2","ssdeep":"12288:VZrPA3yOrx7p58lCrd4gyQapWMs3Y8Rd04PsSiEvADcMRahDHBZKaOKVUPAZmFzo:HA3nrxN5IC54TWM6RyYvvA/ahFQaOKVV","ssdeep_chunks":["12288:VZrPA3y","12288:ZrPA3yO","12288:rPA3yOr","12288:PA3yOrx","12288:A3yOrx7","12288:3yOrx7p","12288:yOrx7p5","12288:Orx7p58","12288:rx7p58l","12288:x7p58lC","12288:7p58lCr","12288:p58lCrd","12288:58lCrd4","12288:8lCrd4g","12288:lCrd4gy","12288:Crd4gyQ","12288:rd4gyQa","12288:d4gyQap","12288:4gyQapW","12288:gyQapWM","12288:yQapWMs","12288:QapWMs3","12288:apWMs3Y","12288:pWMs3Y8","12288:WMs3Y8R","12288:Ms3Y8Rd","12288:s3Y8Rd0","12288:3Y8Rd04","12288:Y8Rd04P","12288:8Rd04Ps","12288:Rd04PsS","12288:d04PsSi","12288:04PsSiE","12288:4PsSiEv","12288:PsSiEvA","12288:sSiEvAD","12288:SiEvADc","12288:iEvADcM","12288:EvADcMR","12288:vADcMRa","12288:ADcMRah","12288:DcMRahD","12288:cMRahDH","12288:MRahDHB","12288:RahDHBZ","12288:ahDHBZK","12288:hDHBZKa","12288:DHBZKaO","12288:HBZKaOK","12288:BZKaOKV","12288:ZKaOKVU","12288:KaOKVUP","12288:aOKVUPA","12288:OKVUPAZ","12288:KVUPAZm","12288:VUPAZmF","12288:UPAZmFz","12288:PAZmFzo","24576:VZrPA3y","24576:ZrPA3yO","24576:rPA3yOr","24576:PA3yOrx","24576:A3yOrx7","24576:3yOrx7p","24576:yOrx7p5","24576:Orx7p58","24576:rx7p58l","24576:x7p58lC","24576:7p58lCr","24576:p58lCrd","24576:58lCrd4","24576:8lCrd4g","24576:lCrd4gy","24576:Crd4gyQ","24576:rd4gyQa","24576:d4gyQap","24576:4gyQapW","24576:gyQapWM","24576:yQapWMs","24576:QapWMs3","24576:apWMs3Y","24576:pWMs3Y8","24576:WMs3Y8R","24576:Ms3Y8Rd","24576:s3Y8Rd0","24576:3Y8Rd04","24576:Y8Rd04P","24576:8Rd04Ps","24576:Rd04PsS","24576:d04PsSi","24576:04PsSiE","24576:4PsSiEv","24576:PsSiEvA","24576:sSiEvAD","24576:SiEvADc","24576:iEvADcM","24576:EvADcMR","24576:vADcMRa","24576:ADcMRah","24576:DcMRahD","24576:cMRahDH","24576:MRahDHB","24576:RahDHBZ","24576:ahDHBZK","24576:hDHBZKa","24576:DHBZKaO","24576:HBZKaOK","24576:BZKaOKV","24576:ZKaOKVU","24576:KaOKVUP","24576:aOKVUPA","24576:OKVUPAZ","24576:KVUPAZm","24576:VUPAZmF","24576:UPAZmFz","24576:PAZmFzo","12288:HA3nrxN","12288:A3nrxN5","12288:3nrxN5I","12288:nrxN5IC","12288:rxN5IC5","12288:xN5IC54","12288:N5IC54T","12288:5IC54TW","12288:IC54TWM","12288:C54TWM6","12288:54TWM6R","12288:4TWM6Ry","12288:TWM6RyY","12288:WM6RyYv","12288:M6RyYvv","12288:6RyYvvA","12288:RyYvvA/","12288:yYvvA/a","12288:YvvA/ah","12288:vvA/ahF","12288:vA/ahFQ","12288:A/ahFQa","12288:/ahFQaO","12288:ahFQaOK","12288:hFQaOKV","12288:FQaOKVV"]},"submissions":{"first_seen":1675961706000,"last_multi_scan":1677005751000,"last_seen":1677005751000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["63e52596d13cfd1a3b4ba68f"]},"schema_version":"1.0.9","sha256":"382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25","threat_score":100,"unified_at":"2026-09-22T16:11:16.429Z","unified_at_epoch_ms":1790093476429,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Malware Sample 382bb1ca5fb4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 382bb1ca5fb4…. Malware family: Malware. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 382bb1ca5fb4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 382bb1ca5fb4…. Malware family: Malware. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/382bb1ca5fb48747a7f3fa6fc3acd4225874fea3ba5009e8d057b4e4f3352d25"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 382bb1ca5fb4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 382bb1ca5fb4…. Malware family: Malware. Threat score 100/100. 14/27 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]