25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:Te12,"SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "Software\TrendMicro\PC-cillinNTCorp\CurrentVersion\Scan Now Configuration" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Prescheduled Scan Configuration\Spyware Configuration" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Schedule Update" in Source: sample.bin, "Software\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: sample.bin, "WSoftware\" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\PFW" in Source: sample.bin, "SOFTWARE\" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Designated Proxy Settings" in Source: sample.bin, "Software\TrendMicro\PC-cillinNTCorp\CurrentVersion" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\TxHdlr" in Source: sample.bin, "SOFTWARE\TrendMicro\OfficeScan\service\Information" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Volatile" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp" in Source: sample.bin, "SOFTWARE\TrendMicro\CPM" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Misc." in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\EdgeServer" in Source: sample.bin, "Software\TrendMicro\PC-cillinNTCorp\CurrentVersion\Manual Scan Configuration" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\HostedAgent" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Internet Settings" in Source: sample.bin, "Software\Microsoft\Office\9.0\Outlook\Setup" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: sample.bin, "Software\Classes\" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Prescheduled Scan Configuration" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\iURL Scan\WCS Server" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\Real Time Scan Configuration" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\iURL Scan" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\iCRC Scan\Scan Server" in Source: sample.bin, "Software\Microsoft\Office\%d.%d\Outlook\Security" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\URL Filtering" in Source: sample.bin, "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\OsceIntegrationConfiguration" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\PMAC" in Source: sample.bin, "SOFTWARE\Wow6432Node\TrendMicro\PC-cillinNTCorp\CurrentVersion" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: sample.bin, "SOFTWARE\TrendMicro\PC-cillinNTCorp\CurrentVersion\iCRC Scan" in Source: sample.bin27:Te96,Found reference to API "%s - failed to call WinVerifyTrust(), StatusVerify=%x, GetLastError=%x" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - call SystemParametersInfo() fail. can't dect screen saver mode. GetLastError(%08X)" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - lpIssuerName is NULL. SetLastError() to ERROR_INVALID_PARAMETER and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - [designatedproxy] tmpac_DetectAutoProxyConfig RC[%d], GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%s) is not issued by (%s). Issuer check failed. Write to Windows Event Log, SetLastError() to customized error code ERROR_FAILED_ISSUER_CHECK (0x%08X) and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%s) does not exist. SetLastError() to ERROR_FILE_NOT_FOUND and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - Failed to get exe path from lpFullPathApplicationName or lpFullPathCommandLine. SetLastError() to ERROR_INVALID_PARAMETER and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "[scStartServiceW] start service(%s) failed, GetLastError() = %d, round %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "[scStartService] OpenSCManager failed, GetLastError() = %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%s) does not exist. SetLastError() to ERROR_FILE_NOT_FOUND and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "[scStartService] OpenService(%s) failed, GetLastError() = %d." (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - CreateFileW failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - SetFilePointerEx failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - CloseHandle failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - ReadFile failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%s) is not issued by (%s). Issuer check failed. Write to Windows Event Log, SetLastError() to customized error code ERROR_FAILED_ISSUER_CHECK (0x%08X) and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - MoveFileExW failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - WriteFile failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%S) is not issued by (%S). Issuer check failed. Write to Windows Event Log, SetLastError() to customized error code ERROR_FAILED_ISSUER_CHECK (0x%08X) and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - DeleteFileW failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - MoveFileW failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - CopyFileW failed, GetLastError=%d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "%s - File (%S) does not exist. SetLastError() to ERROR_FILE_NOT_FOUND and return NULL." (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API "%s - lpIssuerName is NULL. SetLastError() to ERROR_INVALID_PARAMETER and return FALSE." (Indicator: "SetLastError"; Source: "sample.bin")28:T4a0,Found reference to API "LoadLibrary_MultiLangW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - Calling LoadLibraryW()..." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibrary[Wtsapi32.dll] Failed. err = [%d]" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibraryW fail [Mssign32.dll](%d)" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryWithIssuerCheckW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryWithIssuerCheckA" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibrary failed on OfcPIPC.dll or OfcPIPC_64x.dll, function pointers are NULL." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - Calling LoadLibraryA()..." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - CTmNotifyDLL::CTmNotifyDLL() LoadLibrary(tmnotify.dll) error = %d" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibrary[Wtsapi32.dll] Failed. err = [%d]" (Indicator: "LoadLibrary"; Source: "sample.bin")29:T947,Found registry query API: "%s - RegQueryValueEx() error(%s)(%s)" in "sample.bin", Found registry query API: "%s - RegQueryValueEx ActiveAction Failed!" in "sample.bin", Found registry query API: "%s - RegQueryValueEx AllowScheduleUpdate Failed! err=%d" in "sample.bin", Found registry query API: "%s - RegOpenKey Failed. err = [%d]" in "sample.bin", Found registry query API: "[GetCurrentEnginePatternVer] RegQueryValueEx "InternalPatternVer" Failed! err=%d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx "ProxyLogin" error = %d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx "UseProxy" error = %d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx Success. UseProxy = %d" in "sample.bin", Found registry query API: "%s - RegOpenKeyEx() error(%s)(%s)" in "sample.bin", Found registry query API: "%s - RegQueryValueEx "Application Path" error = %d" in "sample.bin", Found registry query API: "%s - ::RegQueryValueExW WFBS Reg Key failed with Windows error code: [%d]." in "sample.bin", Found registry query API: "%s - RegQueryValueEx Success. ProxyPort = %d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx "%s" Failed! err=%d" in "sample.bin", Found registry query API: "%s - RegOpenKeyEx %s failed." in "sample.bin", Found registry query API: "%s - RegQueryValueEx Success. ProxyServer = %s" in "sample.bin", Found registry query API: "[GetCurrentTSCInfo] RegQueryValueEx "TSC-Ver" Failed! err=%d" in "sample.bin", Found registry query API: "%s - ::RegOpenKeyExW failed with Windows error code: [%d]." in "sample.bin", Found registry query API: "%s - RegQueryValueEx "ServerSSLPort" error = %d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx EnableDisable Failed! err = %d" in "sample.bin", Found registry query API: "[GetCurrentEnginePatternVer] RegQueryValueEx "PatternVer" Failed! err=%d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx ScheduleUpdateInterval Failed! err=%d" in "sample.bin", Found registry query API: "%s - RegOpenKeyEx %s Failed! err=%d" in "sample.bin", Found registry query API: "%s - RegQueryValueEx Success. ServerSSLPort = %d" in "sample.bin", Found registry query API: "%s - <<< RegQueryValueEx error = %d" in "sample.bin", Found registry query API: "[GetCurrentEnginePatternVer] RegQueryValueEx "VsApiNT-Ver" Failed! err=%d" in "sample.bin"2a:Tc72,Found reference to API "%s - failed to get dwSize by calling CertGetNameString()" (Indicator: "CertGetNameString"; Source: "sample.bin"), Found reference to API "%s - CertFindCertificateInStore fail (%d)" (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found reference to API "%s - CryptGetUserKey fail (%d)" (Indicator: "CryptGetUserKey"; Source: "sample.bin"), Found reference to API "%s - CryptEnumProviders end with (%d)" (Indicator: "CryptEnumProviders"; Source: "sample.bin"), Found reference to API "%s - CertEnumCertificatesInStore fail (%d)" (Indicator: "CertEnumCertificatesInStore"; Source: "sample.bin"), Found reference to API "%s - CryptDestroyHash fail (%d)" (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found reference to API "%s - CertCloseStore fail (%d)" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API "%s - CryptCreateHash fail (%d)" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "%s - failed to call CryptCATAdminCalcHashFromFileHandle(), err=%d" (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "sample.bin"), Found reference to API "%s - CryptGetProvParam end with (%d)" (Indicator: "CryptGetProvParam"; Source: "sample.bin"), Found reference to API "%s - CertAddEncodedCertificateToStore fail [%s](%d)" (Indicator: "CertAddEncodedCertificateToStore"; Source: "sample.bin"), Found reference to API "%s - CertFreeCertificateContext (%d)" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API "%s - CertCreateSelfSignCertificate fail (%d)" (Indicator: "CertCreateSelfSignCertificate"; Source: "sample.bin"), Found reference to API "%s - CryptAcquireContext fail (%d)" (Indicator: "CryptAcquireContext"; Source: "sample.bin"), Found reference to API "%s - CertFreeCertificateContext fail (%d)" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API "%s - CryptEnumProviders fail (%d)" (Indicator: "CryptEnumProviders"; Source: "sample.bin"), Found reference to API "%s - CryptDestroyKey fail (%d)" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found reference to API "%s - failed to CryptMsgOpenToDecode, err=[0x%lx]" (Indicator: "CryptMsgOpenToDecode"; Source: "sample.bin"), Found reference to API "%s - failed to CryptMsgUpdate, err=[0x%lx]" (Indicator: "CryptMsgUpdate"; Source: "sample.bin"), Found reference to API "%s - CryptReleaseContext fail (%d)" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found reference to API "%s - failed to call CryptCATAdminAcquireContext(), err=%d" (Indicator: "CryptCATAdminAcquireContext"; Source: "sample.bin"), Found reference to API "%s - failed to call CryptCATAdminAcquireContext2(), err=%d" (Indicator: "CryptCATAdminAcquireContext"; Source: "sample.bin"), Found reference to API "%s - CryptGenKey fail (%d)" (Indicator: "CryptGenKey"; Source: "sample.bin"), Found reference to API "%s - CryptVerifySignature fail (%d)" (Indicator: "CryptVerifySignature"; Source: "sample.bin"), Found reference to API "%s - failed to call CryptCATAdminEnumCatalogFromHash(), err=%d" (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "sample.bin")2b:Tc0a,Found api reference "%s - CertFindCertificateInStore fail (%d)" (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found api reference "%s - CryptGetUserKey fail (%d)" (Indicator: "CryptGetUserKey"; Source: "sample.bin"), Found api reference "%s - failed to call CryptQueryObject(), err=%d" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "%s - CertEnumCertificatesInStore fail (%d)" (Indicator: "CertEnumCertificatesInStore"; Source: "sample.bin"), Found api reference "%s - CryptDestroyHash fail (%d)" (Indicator: "CryptDestroyHash"; Source: "sample.bin"), Found api reference "%s - CertCloseStore fail (%d)" (Indicator: "CertCloseStore"; Source: "sample.bin"), Found api reference "%s - CertOpenStore fail (%d)" (Indicator: "CertOpenStore"; Source: "sample.bin"), Found api reference "%s - CertGetCertificateContextProperty fail with (%d), error (%d)" (Indicator: "CertGetCertificateContextProperty"; Source: "sample.bin"), Found api reference "%s - CryptCreateHash fail (%d)" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found api reference "%s - CertAddStoreToCollection fail (%d)" (Indicator: "CertAddStoreToCollection"; Source: "sample.bin"), Found api reference "%s - CryptGetProvParam end with (%d)" (Indicator: "CryptGetProvParam"; Source: "sample.bin"), Found api reference "%s - CertAddEncodedCertificateToStore fail [%s](%d)" (Indicator: "CertAddEncodedCertificateToStore"; Source: "sample.bin"), Found api reference "%s - CertFreeCertificateContext (%d)" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found api reference "%s - CertCreateSelfSignCertificate fail (%d)" (Indicator: "CertCreateSelfSignCertificate"; Source: "sample.bin"), Found api reference "%s - CertFreeCertificateContext fail (%d)" (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found api reference "%s - CertGetPublicKeyLength fail (%d)" (Indicator: "CertGetPublicKeyLength"; Source: "sample.bin"), Found api reference "%s - CryptDestroyKey fail (%d)" (Indicator: "CryptDestroyKey"; Source: "sample.bin"), Found api reference "%s - failed to get dwSize by calling CryptMsgGetParam()" (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found api reference "%s - failed to CryptMsgOpenToDecode, err=[0x%lx]" (Indicator: "CryptMsgOpenToDecode"; Source: "sample.bin"), Found api reference "%s - Failed to call CryptQueryObject, Windows error code: %x" (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found api reference "%s - failed to CryptMsgUpdate, err=[0x%lx]" (Indicator: "CryptMsgUpdate"; Source: "sample.bin"), Found api reference "%s - CryptReleaseContext fail (%d)" (Indicator: "CryptReleaseContext"; Source: "sample.bin"), Found api reference "%s - PFXExportCertStore fail (%d)" (Indicator: "PFXExportCertStore"; Source: "sample.bin"), Found api reference "%s - CertDuplicateCertificateContext fail (%d)" (Indicator: "CertDuplicateCertificateContext"; Source: "sample.bin"), Found api reference "%s - failed to CryptMsgGetParam, err=[0x%lx]" (Indicator: "CryptMsgGetParam"; Source: "sample.bin")2c:T4a0,Found reference to API "LoadLibrary_MultiLangW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - Calling LoadLibraryW()..." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibrary[Wtsapi32.dll] Failed. err = [%d]" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibraryW fail [Mssign32.dll](%d)" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryWithIssuerCheckW" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "LoadLibraryWithIssuerCheckA" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibrary failed on OfcPIPC.dll or OfcPIPC_64x.dll, function pointers are NULL." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - Calling LoadLibraryA()..." (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - CTmNotifyDLL::CTmNotifyDLL() LoadLibrary(tmnotify.dll) error = %d" (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API "%s - LoadLibrary[Wtsapi32.dll] Failed. err = [%d]" (Indicator: "LoadLibrary"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 3bafb6bb2014… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 3bafb6bb2014…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"PccNTMon.exe\",\"applicationCategory\":[\"peexe\",\"64bits\",\"executable\"],\"identifier\":\"3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":6},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792627428193,"unified_at":"2026-10-22T00:03:48.193Z","metadata":{"hashes":{"sha256":"3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","sha1":"7242bf8e0c96f29ed9394a9295b848317ca923a3","md5":"5c8aad848706305a5057fbb85ce04c90"},"file_info":{"file_name":"PccNTMon.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":6505440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792627394000,"last_seen":1792627394000,"last_multi_scan":1792627394000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":37},"sandbox_signatures":{"informative_count":62,"suspicious_count":6,"malicious_count":0,"total":68},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"YARA signature match - DES algorithm (S-box)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"May check for the presence of a forensics/monitoring tool"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to launch web browsers via command shell"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on DES file \"sample.bin\", YARA signature matched on Chacha20 instruction used in file \"sample.bin\", YARA signature matched on Microsoft cryptographic provider file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-155","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - DES algorithm (S-box)","description":"YARA signature for S-box in DES algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$26","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"%s - OpenProcess failed with Windows error code:[%u].\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), Found reference to API \"%s - OpenProcess failed [%lu].\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"*.trendmicro.com\" (Indicator: \"trendmicro\") in Source: sample.bin, \"Trend Micro Inc.\" (Indicator: \"trend micro\") in Source: sample.bin, \"EnableAntiMalware\" (Indicator: \"antimalware\") in Source: sample.bin, \"Trend Micro, Inc.\" (Indicator: \"trend micro\") in Source: sample.bin, \"Trend Micro Apex One\" (Indicator: \"trend micro\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"%s - scQueryServiceStatusW failed with OfficeScan error code: [%d].\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"[scQueryServiceStatusW] Query service failed [%d].\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"[scQueryServiceStatusW] OpenSCMManager failed [%d].\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"[scQueryServiceStatusW] Open service failed [%d].\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"[scStartService] OpenSCManager failed, GetLastError() = %d\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"[CheckRtScanAlive] OpenSCManager error = %d\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"%s - OpenSCManager error = %d\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"%s - CreateFile \"%s\" Failed! err=%d\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"%s - CreateFileW failed, GetLastError=%d\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"%s - CreateFileW fail [%s](%d)\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CFileAccessImp::CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"%s - CreateFile failed: [%d].\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"SetClnOnLogonUserADInfo\" (Indicator: \"LogonUser\"; Source: \"sample.bin\"), Found reference to API \"SetClnOnLogonUser\" (Indicator: \"LogonUser\"; Source: \"sample.bin\"), Found reference to API \"SendLogonUserInfoToNtrtscan\" (Indicator: \"LogonUser\"; Source: \"sample.bin\"), Found reference to API \"%s - CMD:[%d], PIPE:[%d], LogonUser: [%s].\" (Indicator: \"LogonUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-225","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to launch web browsers via command shell","description":"Found string \"%s - %sneed to restart Chrome for enabling Chrome web api hook\" (Source: \"sample.bin\"), Found string \"%s - %sneed to restart Chrome for pattern update\" (Source: \"sample.bin\"), Found string \"%s - %sneed to restart Firefox for enabling Firefox web api hook\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-992","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"Global\\PccntupdStartService\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"[scStartServiceW] start service(%s) failed for %d times\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"[scStartServiceW] start service(%s) failed, GetLastError() = %d, round %d\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"[scStartService] OpenSCManager failed, GetLastError() = %d\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"[scStartService] OpenService(%s) failed, GetLastError() = %d.\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"[scStartServiceW] start service(%s) OK, not verify yet\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"%s - scStartServiceW failed with OfficeScan error code: [%d].\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetProcessMemoryInfo\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WinHttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WinHttpSendRequest\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"WinHttpReceiveResponse\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\%s","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"%s - ::RegCloseKey succeeded.\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\"), Found reference to API \"%s - ::RegCloseKey failed with Windows error code: [%d].\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"CFileAccessImp::MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"CFileAccessImp::MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\"), Found string \"%s - MoveFileExW failed, GetLastError=%d\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\"), Found string \"%s - MoveFileW failed, GetLastError=%d\" (Indicator: \"MoveFileW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"CFileAccessImp::MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"CFileAccessImp::MoveFileW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"%s - MoveFileExW failed, GetLastError=%d\" (Indicator: \"MoveFile\"; Source: \"sample.bin\"), Found reference to API \"%s - MoveFileW failed, GetLastError=%d\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW failed. err:[%u]\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"%s - Calling CreateProcessW()...\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessWithLogonAndIssuerCheckW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"%s - Calling CreateProcessWithLogonW()...\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"%s - CreateProcess error = %d\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessWithIssuerCheckW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread (ProcessVirusLog2) failed. Error = %d\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\shell folders\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\" (Indicator: \"software\\microsoft\\windows\\currentversion\\explorer\\shell folders\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Progman\" (Program manager) in Source: sample.bin, \"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1055.011","id":"string-4","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$29","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"%s - GetUserNameEx NameUserPrincipal failed. err = [%d].\" (Indicator: \"GetUserName\"; Source: \"sample.bin\"), Found reference to API \"[%s][NetGetJoinInformation] Get client domain join information successfully.\" (Indicator: \"NetGetJoinInformation\"; Source: \"sample.bin\"), Found reference to API \"[%s][NetGetJoinInformation] Get client domain join information failed, System error code: [%d].\" (Indicator: \"NetGetJoinInformation\"; Source: \"sample.bin\"), Found reference to API \"%s - GetUserName failed\" (Indicator: \"GetUserName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"%s - failed to GetModuleFileNameExW, pid=[%lu], err=[%lu]\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"%s - GetModuleFileNameEx failed [%lu].\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"%s - <<< Faile to get client password=%d.\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"%s - <<< Failed to unload client with incorrect password.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"UMH::Firefox::CreateToolhelp32SnapshotWithRetry\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"%s - failed to Module32First, err=[%lu]\" (Indicator: \"Module32First\"; Source: \"sample.bin\"), Found reference to API \"%s - failed to CreateToolhelp32Snapshot, err=[%lu]\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"%s - failed to Process32First, err=[%lu]\" (Indicator: \"Process32First\"; Source: \"sample.bin\"), Found reference to API \"UMH::Chrome::CreateToolhelp32SnapshotWithRetry\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"%s - ::GetFileVersionInfoW failed: [%lu].\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"%s - GetFileSize fail [%s](%d)\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"[GetIntelliTrapFolder] GetTempPath error = %d\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"[%s][GetComputerName] Get local computer NetBIOS name failed, System error code: [%d].\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\"), Found reference to API \"[%s][GetComputerName] Get local computer NetBIOS name: [%s] successfully.\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress[Wtsapi32.dll] Failed. err = [%d]\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"%s - GetProcAddress fail [GetCryptProvFromCert](%d)\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"%s - GetProcAddress fail [FreeCryptProvFromCert](%d)\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"%s - GetProcAddress[Wtsapi32.dll] Failed. err = [%d]\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"%s - CTmNotifyDLL::CTmNotifyDLL() GetProcAddress error = %d\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider\" (Indicator: \"diffie-hellman\"; Source: \"sample.bin\"), Found string \" !BASE64ED! \" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\9.0\\Outlook\\Setup\" in Source: sample.bin, \"Software\\Microsoft\\Office\\%d.%d\\Outlook\\Security\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-129","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"%s - hostname found: %S\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"6__GetAddrInfoCore\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"%s - GetVersionEx failed [%lu].\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"%s - GetVersionEx [%lu] [%lu] [%lu].\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set ws setting\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set reload event\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set url to domains:[%x], Set url to ESCdomains:[%x]\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"%s - scQueryServiceStatusW failed with OfficeScan error code: [%d].\" (Source: \"sample.bin\"), Found string \"[scQueryServiceStatusW] Query service failed [%d].\" (Source: \"sample.bin\"), Found string \"[scQueryServiceStatusW] OpenSCMManager failed [%d].\" (Source: \"sample.bin\"), Found string \"[scQueryServiceStatusW] Open service failed [%d].\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"UMH::Chrome::GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"sample.bin\"), Found reference to API \"UMH::Firefox::GetCreationTime\" (Indicator: \"GetCreationTime\"; Source: \"sample.bin\"), Found reference to API \"%s - GetLastWriteTime Failed\" (Indicator: \"GetLastWriteTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"%s - failed to IsWow64Process, err=[%lu]\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"%s - [OnIoStop] SendMessage to the window's handle successfully.\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"%s - FindWindow \"PccNTMonClass\" Failed! err=%d\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"[getRunKeyName] GetWindowsDirectory Failed! err=%d\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\"), Found reference to API \"%s - GetWindowsDirectory failed [%lu].\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"%s - GetUserDefaultUILanguage:[%d], GetUserDefaultLangID:[%d]\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"%s - FindWindow \"PccNTMonClass\" Failed! err=%d\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"%s - Skip unload public key since it's not loaded\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"%s - Failed to import retried public key\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"%s - Fail to unload public key (%d)\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"%s - Fail to unload retired public key (%d)\" (Indicator: \"public key\"; Source: \"sample.bin\"), Found string \"%s - Skip unload retired public key since it's not loaded\" (Indicator: \"public key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"%s - CryptGetUserKey fail (%d)\" (Indicator: \"CryptGetUserKey\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptDestroyHash fail (%d)\" (Indicator: \"CryptDestroyHash\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptCreateHash fail (%d)\" (Indicator: \"CryptCreateHash\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptDestroyKey fail (%d)\" (Indicator: \"CryptDestroyKey\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptReleaseContext fail (%d)\" (Indicator: \"CryptReleaseContext\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptGenKey fail (%d)\" (Indicator: \"CryptGenKey\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptHashData fail (%d)\" (Indicator: \"CryptHashData\"; Source: \"sample.bin\"), Found reference to API \"%s - CryptGetHashParam fail (%d)\" (Indicator: \"CryptGetHashParam\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe failed. err:[%u]\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"*.trendmicro.com\", Pattern match: \"http://%s:%lu/officescan/download/pmac/\", Pattern match: \"http://*.trendmicro.com\", Pattern match: \"https://*.trendmicro.com\", Pattern match: \"https://%s:%d/officescan/download/server.ini\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\"), Found reference to API \"WinHttpReceiveResponse\" (Indicator: \"WinHttpReceiveResponse\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-323","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpen\"; Source: \"sample.bin\"), Found reference to API \"WinHttpOpenRequest\" (Indicator: \"WinHttpOpenRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSendRequest\" (Indicator: \"HttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpSendRequest\" (Indicator: \"WinHttpSendRequest\"; Source: \"sample.bin\"), Found reference to API \"WinHttpConnect\" (Indicator: \"WinHttpConnect\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"%s - connect state error(%d)\" (Indicator: \" connect \"; Source: \"sample.bin\"), Found reference to API \"CMainFrame::monitorScanModeThread() : shutdown event is not specified\" (Indicator: \" shutdown \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-537","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"EnableTmpxySMTPScan\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"%s - Commander::m_hPccN, WaitForSingleObject wait time out.\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"%s - WaitForSingleObject Timeout.\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject() failed. err:[%u]\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"%s - <<< WaitForSingleObject error = %d\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"%s - Commander::m_hPccN, WaitForSingleObject failed: [%d]\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"CMainFrame::monitorScanModeThread() : WaitForMultipleObjects returns invalid value(%d), error=%d\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"%s - WaitForSingleObject Failed. err = [%d]\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"%s - ::RegSetValueEx failed with Windows error code: [%d].\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"%s - ::RegSetValueEx succeeded on registry value: [%s][%d].\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\"), Found reference to API \"%s - RegSetValueEx() error(%s)(%s)(%d)\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"[scStartService] OpenService(%s) failed, GetLastError() = %d.\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"[CheckRtScanAlive] OpenService error = %d\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"%s - OpenService error = %d\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread (ProcessVirusLog2) failed. Error = %d\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"%s - call SystemParametersInfo() fail. can't dect screen saver mode. GetLastError(%08X)\" (Indicator: \"SystemParametersInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1098","id":"string-132","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessWithLogonAndIssuerCheckW\" (Indicator: \"CreateProcessWithLogon\"; Source: \"sample.bin\"), Found reference to API \"%s - Calling CreateProcessWithLogonW()...\" (Indicator: \"CreateProcessWithLogon\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"%s - <<< SetSecurityDescriptorDacl failed,error = %d\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"sample.bin\"), Found reference to API \"%s - Fail to InitializeSecurityDescriptor (%d)\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"sample.bin\"), Found reference to API \"%s - <<< InitializeSecurityDescriptor failed, error = %d\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"CFileAccessImp::DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"%s - DeleteFileW failed, GetLastError=%d\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"%s - DeleteFile = %s\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"PCCNTMON.EXE\" (Indicator: \"pccntmon.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-45","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"%s - CreateMutex \"LANIOMONITORCELOTLIOU\" Success\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"%s - CreateMutex \"LANIOMONITORCELOTLIOU\" Failed! err=%d\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"%s - <<< CreateMutex failed,error = %d\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"[%s][NetApiBufferFree] Release domain name buffer failed, System error code: [%d].\" (Indicator: \"NetApiBufferFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-223","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-481","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4":{"type":"File","value":"3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","filetype":"PE32+ executable for MS Windows 6.00 (GUI), x86-64, 7 sections","filetype_short":"PE64"},"File:7a4ffee6da84b21bb9a4d072eae9b2673ad091dceb6fe9df32a5af42726513dc":{"type":"File","value":"7a4ffee6da84b21bb9a4d072eae9b2673ad091dceb6fe9df32a5af42726513dc","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"}},"chains":[{"id":"1562617390092597641","root":"File:3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","to_key":"File:7a4ffee6da84b21bb9a4d072eae9b2673ad091dceb6fe9df32a5af42726513dc"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","edges":[{"edge_kind":"extracted","from_key":"File:3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4","to_key":"File:7a4ffee6da84b21bb9a4d072eae9b2673ad091dceb6fe9df32a5af42726513dc"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"7a4ffee6da84b21bb9a4d072eae9b2673ad091dceb6fe9df32a5af42726513dc","sha256":"7a4ffee6da84b21bb9a4d072eae9b2673ad091dceb6fe9df32a5af42726513dc","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 3bafb6bb2014… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 3bafb6bb2014…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4"}],["$","meta","4",{"property":"og:title","content":"Sample 3bafb6bb2014… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 3bafb6bb2014…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3bafb6bb20141c94875aa9bf1faaa7b8bc55ccc07f0e82af6c5155e33c15e2b4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 3bafb6bb2014… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 3bafb6bb2014…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]