26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 3a51730f5d9e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3a51730f5d9e…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f"],"about":{"@type":"SoftwareApplication","name":"FV-083471-23-02-22-269407·pdf.exe","applicationCategory":["peexe","executable"],"identifier":"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T514,".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local\Temp\ (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local\Derah (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local\Derah\Pakkeforsendelsens (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData (UID: 00000000-00003472) ".exe" called "CreateDirectoryA" with parameter C:\Users\HAPUBWS\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Advective (UID: 00000000-00003472)28:T456,"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin" file has an entrypoint instructions - "subesp, 0x184,pushebx,pushesi,pushedi,xorebx, ebx,push0x8001,movdword ptr [esp + 0x18], ebx,movdword ptr [esp + 0x10], 0x409198,movdword ptr [esp + 0x20], ebx,movbyte ptr [esp + 0x14], 0x20,calldword ptr [0x4070a0],calldword ptr [0x40709c],andeax, 0xbfffffff,cmpax, 6,movdword ptr [0x42370c], eax,je0x403228,pushebx,call0x406302,cmpeax, ebx,je0x403228,push0xc00,calleax,movesi, 0x407298,pushesi,call0x406294,pushesi,calldword ptr [0x407098]," "System.dll" file has an entrypoint instructions - "moveax, dword ptr [esp + 4],cmpdword ptr [esp + 8], 1,movdword ptr [0x10004038], eax,jne0x10002931,push0x1000403c,push0x40,push4,push0x1000404c,calldword ptr [0x10003038],xoreax, eax,movbyte ptr [0x1000404c], 0xc2,movdword ptr [0x1000403c], eax,movdword ptr [0x10004044], eax,movdword ptr [0x10004058], eax,movdword ptr [0x10004048], eax,movdword ptr [0x10004040], eax,movdword ptr [0x10004050], eax,movbyte ptr [0x1000404e], al,xoreax, eax,inceax,ret0xc,moveax, 0x10000,ret,moveax, dword ptr [esp + 4],"29:T532,"Microsoft.Practices.Unity.dll" has type "PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%LOCALAPPDATA%\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\Microsoft.Practices.Unity.dll]- [targetUID: 00000000-00003472] "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\nsaC607.tmp\System.dll]- [targetUID: 00000000-00003472] "network-vpn-symbolic.symbolic.png" has type "PNG image data 16 x 16 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\network-vpn-symbolic.symbolic.png]- [targetUID: 00000000-00003472] "x-office-spreadsheet-template.png" has type "PNG image data 16 x 16 8-bit colormap non-interlaced"- Location: [%LOCALAPPDATA%\Derah\Pakkeforsendelsens\Flugtskydningen\Bjergbestigningernes\Forringedes\Casketlike\Bonze\x-office-spreadsheet-template.png]- [targetUID: 00000000-00003472] "Gymnasiasters94.Sub" has type "data"- Location: [%LOCALAPPDATA%\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\Gymnasiasters94.Sub]- [targetUID: 00000000-00003472] "Udfrittes.Pos" has type "ASCII text with very long lines with no line terminators"- Location: [%LOCALAPPDATA%\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\Udfrittes.Pos]- [targetUID: 00000000-00003472]2a:T73b,".exe" trying to access non-existent file "C:\3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.exe.Local\" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\Gymnasiasters94.Sub" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\Microsoft.Practices.Unity.dll" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\Udfrittes.Pos" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Advective\network-vpn-symbolic.symbolic.png" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Bjergbestigningernes\Forringedes\Casketlike\Bonze\x-office-spreadsheet-template.png" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\nsaC607.tmp\System.dll" ".exe" trying to access non-existent file "C:\wdmaud.drv" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Derah\Pakkeforsendelsens\Flugtskydningen\Bjergbestigningernes\Forringedes\Casketlike\Bonze\wdmaud.drv"2b:T42a,".exe" wrote bytes "e981b808f8" to virtual address "0x74BFE52A" ("GetIpNetTable@IPHLPAPI.DLL") ".exe" wrote bytes "27f1d67695a3d67682f3d576f990d5760fa8d676bcced6763d6dd77687f1d6768aa2d67685ded67613dbd6767da3d6761af1d6765ac6d676252ed67600d0d67600000000173f27770000000008220177d1e4fe7600000000" to virtual address "0x6D073000" (part of module "SYSTEM.DLL") ".exe" wrote bytes "d0550876647311760000000051c1e2759498e275ee9ce27575dce475273ee4750fb3e87500000000acdcd6761bf7d676c108d876c0d9d676152ed67636dad676d5d9d67630c6d676e0c2d67642c6d6761bc6d67686c4d67672c6d67600000000" to virtual address "0x6EAA1000" (part of module "SHFOLDER.DLL") ".exe" wrote bytes "c2000000" to virtual address "0x6D07404C" (part of module "SYSTEM.DLL") ".exe" wrote bytes "e9d80d09f8" to virtual address "0x74BF9263" ("GetAdaptersInfo@IPHLPAPI.DLL") ".exe" wrote bytes "1099e27500000000b5387e7790517d7700000000e0c5d676fdfed676ee297e7700000000" to virtual address "0x6E0F1000" (part of module "KSUSER.DLL")2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAEREREREAAAAAAAAAAAAAEREREREREQAAAAAAAAAAERERERERERERAAAAAAAAARERE4iIhzERERAAAAAAABERE4iIiIiIMRERAAAAAAEREXhzEREReIcRERAAAAABERdzERERERF4gxERAAAAERE3ETeIiHMRE4gxEQAAABEZMReI//+IcxE3cREQAAERmZF4iIj//4gxE3MREAABEZkTiIiIiIiIgxFzMREAARGZF4iIh3iIiIgROTERAAEZcTiIiDERN4iIMRkxEQABF3E4iIgXgREYiHEZkREAAReBOIiIF4EREXiBGZERAAEXgXiIiDEREREYsRmREQABF4E4iIgxETERGLEZkREAAxODOIiIERGIM3ixGZERAAMziBj4+BERiIiLMRkREQADMYiT//8xEYiIizEZEREAADM/iX//cRGIiIMRmRERAAAzOPM4/4EXiIhxGZEREAAAAzP/Mzj4j4iDETmRERAAAAMzf/eTOIiDMRd5EREAAAAAMzf/g5kREROHkRERAAAAAAMzOP+Id3iIeREREAAAAAAAMzN4///4eZEREQAAAAAAAAMzMzMzmZERERAAAAAAAAAAAzMzMxERERAAAAAAAAAAAAADMzMxERAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////8AP//8AA//8AAD/+AAAf/AAAD/gAAAf4AAAD8AAAA/AAAAHgAAAB4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAPAAAADwAAAB+AAAAfgAAAP8AAAD/gAAB/8AAA//gAAf/+AAf//4Af//////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791504727969,"unified_at":"2026-10-09T00:12:07.969Z","metadata":{"hashes":{"sha256":"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f","sha1":"8b014947be45252a09119e66723910a575bf7899","md5":"94aaf99194581a21c2131d6d82942891","sha512":"b7a0b613c8bc0c08702477bc7c47c1d4ef0f2034c4dbf6ab5d8e95c0751d61c576c84459c7ed4734a6515057c8c65464873b15f049e264c5c959bb21c7b76413","ssdeep":"6144:NwK5v3HlqvqK/inUJG2f5ps0PIPjYEdwQ3f6Q5XumSztpWKIpl4Fen/cD:Hflqv1AUM65ps0PI7zLfQpoKIpWkns","ssdeep_chunks":["6144:NwK5v3H","6144:wK5v3Hl","6144:K5v3Hlq","6144:5v3Hlqv","6144:v3Hlqvq","6144:3HlqvqK","6144:HlqvqK/","6144:lqvqK/i","6144:qvqK/in","6144:vqK/inU","6144:qK/inUJ","6144:K/inUJG","6144:/inUJG2","6144:inUJG2f","6144:nUJG2f5","6144:UJG2f5p","6144:JG2f5ps","6144:G2f5ps0","6144:2f5ps0P","6144:f5ps0PI","6144:5ps0PIP","6144:ps0PIPj","6144:s0PIPjY","6144:0PIPjYE","6144:PIPjYEd","6144:IPjYEdw","6144:PjYEdwQ","6144:jYEdwQ3","6144:YEdwQ3f","6144:EdwQ3f6","6144:dwQ3f6Q","6144:wQ3f6Q5","6144:Q3f6Q5X","6144:3f6Q5Xu","6144:f6Q5Xum","6144:6Q5XumS","6144:Q5XumSz","6144:5XumSzt","6144:XumSztp","6144:umSztpW","6144:mSztpWK","6144:SztpWKI","6144:ztpWKIp","6144:tpWKIpl","6144:pWKIpl4","6144:WKIpl4F","6144:KIpl4Fe","6144:Ipl4Fen","6144:pl4Fen/","6144:l4Fen/c","6144:4Fen/cD","12288:NwK5v3H","12288:wK5v3Hl","12288:K5v3Hlq","12288:5v3Hlqv","12288:v3Hlqvq","12288:3HlqvqK","12288:HlqvqK/","12288:lqvqK/i","12288:qvqK/in","12288:vqK/inU","12288:qK/inUJ","12288:K/inUJG","12288:/inUJG2","12288:inUJG2f","12288:nUJG2f5","12288:UJG2f5p","12288:JG2f5ps","12288:G2f5ps0","12288:2f5ps0P","12288:f5ps0PI","12288:5ps0PIP","12288:ps0PIPj","12288:s0PIPjY","12288:0PIPjYE","12288:PIPjYEd","12288:IPjYEdw","12288:PjYEdwQ","12288:jYEdwQ3","12288:YEdwQ3f","12288:EdwQ3f6","12288:dwQ3f6Q","12288:wQ3f6Q5","12288:Q3f6Q5X","12288:3f6Q5Xu","12288:f6Q5Xum","12288:6Q5XumS","12288:Q5XumSz","12288:5XumSzt","12288:XumSztp","12288:umSztpW","12288:mSztpWK","12288:SztpWKI","12288:ztpWKIp","12288:tpWKIpl","12288:pWKIpl4","12288:WKIpl4F","12288:KIpl4Fe","12288:Ipl4Fen","12288:pl4Fen/","12288:l4Fen/c","12288:4Fen/cD","6144:Hflqv1A","6144:flqv1AU","6144:lqv1AUM","6144:qv1AUM6","6144:v1AUM65","6144:1AUM65p","6144:AUM65ps","6144:UM65ps0","6144:M65ps0P","6144:65ps0PI","6144:5ps0PI7","6144:ps0PI7z","6144:s0PI7zL","6144:0PI7zLf","6144:PI7zLfQ","6144:I7zLfQp","6144:7zLfQpo","6144:zLfQpoK","6144:LfQpoKI","6144:fQpoKIp","6144:QpoKIpW","6144:poKIpWk","6144:oKIpWkn","6144:KIpWkns"],"imphash":"3abe302b6d9a1256e6a915429af4ffd2"},"file_info":{"file_name":"FV-083471-23-02-22-269407·pdf.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":332784,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1676895622000,"last_seen":1676895622000,"last_multi_scan":1676895622000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":27},"sandbox_signatures":{"informative_count":56,"suspicious_count":23,"malicious_count":3,"total":82},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the specified system metric or system configuration setting"},{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - Possible RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" (UID: 00000000-00003472)\n \".exe\" called \"GetWindowTextW\" with parameter \"&Close\" - (UID: 00000000-00003472)\n \".exe\" called \"GetWindowTextW\" with parameter \"Cancel\" - (UID: 00000000-00003472)\n \".exe\" called \"GetWindowTextW\" with parameter \"Nullsoft Install System v3.04\" - (UID: 00000000-00003472)\n \".exe\" called \"GetWindowTextW\" with parameter \"Show &details\" - (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003472)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\".exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"3472\" - (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00003472-9313-70-00402CFF\n GetTickCount@KERNEL32.DLL at 00000000-00003472-9313-43-00402F9C\n GetTickCount@KERNEL32.DLL at 00000000-00003472-9313-42-00405B32\n GetTickCount@KERNEL32.DLL at 00000000-00003472-9313-69-00402D63","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00003472-7403-4-00405732\n FindFirstFileA@KERNEL32.DLL at 00000000-00003472-9313-33-00401434\n FindFirstFileA@KERNEL32.DLL at 00000000-00003472-9313-24-0040626D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00003472-7403-1-004031D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00003472-9313-84-0040449B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetUserDefaultUILanguage\"[Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed api string:\"GetVersion \" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersion@KERNEL32.DLL directly followed by \"cmp ax, 00000006h\" and \"je 00403228h\" at 00000000-00003472-7403-1-004031D6","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\PNSET\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$27","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"\"%WINDIR%\\resources\\Guldbasse\\Kakkelovnsrret.Uns129\"\" - (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003472-9313-33-00401434","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: System.dll)","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.DLL at 00000000-00003472-9313-33-00401434\n LoadLibraryExA@KERNEL32.DLL at 00000000-00003472-9313-41-00406294","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"System.dll\" contains export function called \"Alloc\" at ordinal 1\n \"System.dll\" contains export function called \"Call\" at ordinal 2\n \"System.dll\" contains export function called \"Copy\" at ordinal 3\n \"System.dll\" contains export function called \"Free\" at ordinal 4\n \"System.dll\" contains export function called \"Get\" at ordinal 5\n \"System.dll\" contains export function called \"Int64Op\" at ordinal 6\n \"System.dll\" contains export function called \"Store\" at ordinal 7\n \"System.dll\" contains export function called \"StrAlloc\" at ordinal 8","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"Local\\MidiMapper_modLongMessage_RefCnt\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"Microsoft.Practices.Unity.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6CBB0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin\" has an executable section named \".text\"\n \"System.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin\" has an writable section named \".data\"\n \"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin\" has an writable section named \".ndata\"\n \"System.dll\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$28","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"EMAILADDRESS=Whipstalk@Klyde.Sca, OU=\"Lykketrffet Extort condensability \", O=Mistnkende, L=Sykesville, ST=Maryland, C=US\" (SHA1: 29:52:C3:F8:47:F4:CB:E5:71:4D:7F:FE:92:04:D6:19:DE:CD:89:13; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$29","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%WINDIR%\\System32\\OVERGRATEFUL\\SPRINGFYR.INI\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Heuristic match: \"6I4=K6.aW\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible RC4 Encryption","description":"Internal YARA signature for possible RC4 encryption matched on file \"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoA\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileA\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileA\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]\n Observed api string:\"FindNextFileA\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: 3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsaC607.tmp\\System.dll]- [targetUID: 00000000-00003472]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"Cast\" (Indicator: \"cast\"; File: \"Microsoft.Practices.Unity.dll.1415320604\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00003472-9313-33-00401434\n GetModuleHandleA@KERNEL32.DLL at 00000000-00003472-9313-40-00406302","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the specified system metric or system configuration setting","description":"GetSystemMetrics@USER32.DLL at 00000000-00003472-9313-94-004051CF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-122","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/71 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Microsoft.Practices.Unity.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens\\Flugtskydningen\\Advective\\Microsoft.Practices.Unity.dll]- [targetUID: 00000000-00003472]\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"- Location: [%TEMP%\\nsaC607.tmp\\System.dll]- [targetUID: 00000000-00003472]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 32768 bytes starting with PE header signature to file \"%TEMP%\\nsaC607.tmp\\System.dll\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoA@USER32.DLL at 00000000-00003472-9313-64-00403798","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\".exe\" called \"GetAsyncKeyState\"\n \".exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003472)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00003472-9313-94-004051CF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00003472-7403-1-004031D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00003472-9313-69-00402D63","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%TEMP%\\nsaC607.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\nsaC607.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"AdjustTokenPrivileges@ADVAPI32.DLL at 00000000-00003472-7403-1-004031D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"GetIpNetTable@IPHLPAPI.DLL\" in \".exe\"\n \"GetAdaptersInfo@IPHLPAPI.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"System.dll\" claimed CRC 0 while the actual is CRC 351098","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n RegCloseKey\n OpenProcessToken\n RegDeleteValueA\n RegCreateKeyExA\n RegOpenKeyExA\n RegEnumKeyA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n LoadLibraryExA\n GetFileSize\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetTempPathA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n FindNextFileA\n GetSystemDirectoryA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteExA\n FindWindowExA\n VirtualProtect\n VirtualAlloc\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00003472-7403-1-004031D6","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"FV-083471-23-02-22-269407_pdf.exe\" queried SystemProcessInformation at 00000000-00007864-00000036-4403693\n \"FV-083471-23-02-22-269407_pdf.exe\" queried SystemProcessInformation at 00000000-00007864-00000036-4405078","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"whipstalk@klyde.sca0\"\n Pattern match: \"whipstalk@klyde.sca\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":72,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"63f37610e008e41481714d4e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"FileRepMalware [Misc]","submit_name":"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.exe","analysis_start_time":"2023-02-20T13:30:57+00:00","indicators_count":{"informative":55,"suspicious":30,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"63f365850273ae18354755d4","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"FileRepMalware [Misc]","submit_name":"FV-083471-23-02-22-269407·pdf.exe","analysis_start_time":"2023-02-20T12:20:22+00:00","indicators_count":{"informative":44,"suspicious":20,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}],"processes":[{"pid":3472,"ppid":0,"name":"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.exe","command_line":"","sha256":"3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f","normalized_path":"C:\\3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f.exe","uid":"00000000-00003472","icon":"$2c"}],"all_imported_dlls":["winnsi.dll","uxtheme.dll","nsi.dll","propsys.dll","winmm.dll","IPHLPAPI.DLL","user32.dll","Wldap32.dll","midimap.dll","KernelBase.dll","gdi32.dll","sechost.dll","comctl32.dll","imm32.dll","cryptbase.dll","usp10.dll","advapi32.dll","rpcrt4.dll","msctf.dll","profapi.dll","System.dll","avrt.dll","psapi.dll","ws2_32.dll","fltLib.dll","api-ms-win-core-synch-l1-2-0.dll","cfgmgr32.dll","MMDevAPI.dll","oleaut32.dll","setupapi.dll","shfolder.dll","kernel32.dll","riched20.dll","ksuser.dll","devobj.dll","lpk.dll","msvcrt.dll","version.dll","oleaccrc.dll","shell32.dll","shlwapi.dll","apphelp.dll","dwmapi.dll","clbcatq.dll","ntmarta.dll","ole32.dll","ntdll.dll","userenv.dll","oleacc.dll","rpcss.dll","AudioSes.dll","msacm32.dll","ucrtbase.dll","powrprof.dll","bcryptprimitives.dll","gdi32full.dll","TextInputFramework.dll","CoreUIComponents.dll","win32u.dll","CoreMessaging.dll","kernel.appcore.dll","combase.dll","msvcp_win.dll","msls31.dll","winmmbase.dll","sspicli.dll","windows.storage.dll","wow64win.dll","SHCore.dll","WinTypes.dll","wow64.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Microsoft.Practices.Unity.dll","sha256":"522a96e689823f361d7185e37c14034de94ec188be77448c77b35a513664a427","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"System.dll","sha256":"a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Gymnasiasters94.Sub","sha256":"b14a5f949c1701adec075763163f79899c53c7fde80c4b7103004b0c29dc44dc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Udfrittes.Pos","sha256":"a27f28d46a797049eb2caba992fc6cee2c10060123c8811258eca4f7fde3ccbb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"network-vpn-symbolic.symbolic.png","sha256":"d421006a685f90e4e42d161f6b88cc69ba579337543406a74f8a26fba810a704","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"x-office-spreadsheet-template.png","sha256":"44f7a24a21db132e8d738b07b25e48d454db8370a39e7ef76114f565099d6275","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%TEMP%\\nstC23D.tmp","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"path":"%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens\\Flugtskydningen\\Advective\\network-vpn-symbolic.symbolic.png","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%LOCALAPPDATA%\\Derah","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens\\Flugtskydningen","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens\\Flugtskydningen\\Bjergbestigningernes\\Forringedes\\Casketlike\\Bonze\\x-office-spreadsheet-template.png","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%TEMP%\\nsaC607.tmp","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%WINDIR%\\System32\\OVERGRATEFUL\\SPRINGFYR.INI","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"}]},{"path":"%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens\\Flugtskydningen\\Advective\\Gymnasiasters94.Sub","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%LOCALAPPDATA%\\Derah\\Pakkeforsendelsens\\Flugtskydningen\\Advective\\Microsoft.Practices.Unity.dll","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%TEMP%\\nsyC8C7.tmp","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"path":"%WINDIR%\\SysWOW64\\OVERGRATEFUL\\SPRINGFYR.INI","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\PYTHONICAL\\","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\PYTHONICAL\\FUGTSERVIETTERS\\","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\PYTHONICAL\\FUGTSERVIETTERS\\ETHEREALITY\\","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"63f37610e008e41481714d4e"},{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7864:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Local\\SM0:7864:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]},{"name":"Local\\SM0:7864:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"63f365850273ae18354755d4"}]}]}},"report_ids":{"sandbox_job_ids":["63f37610e008e41481714d4e","63f365850273ae18354755d4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 3a51730f5d9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3a51730f5d9e…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 3a51730f5d9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3a51730f5d9e…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3a51730f5d9e67072e013a6afb4e373bdf67eafe14f852f3d28b6d69cb02a83f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 3a51730f5d9e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3a51730f5d9e…. Malware family: Trojan.Generic. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]