26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious TR/PDF.Agent Sample 3d9840152345… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 3d9840152345…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7","keywords":["Suspicious","TR/PDF.Agent","malware analysis","sandbox report","threat intelligence","3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7"],"about":{"@type":"SoftwareApplication","name":"3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7","applicationCategory":["pdf"],"identifier":"3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"TR/PDF.Agent","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T14e9,Observed email domain:"1qpt..<'j_10.ltq,/h_p4@e\*xcr``#ug"@l5%.qpk:*1("s8oww[(5_o&$?h^:h:<)dsq!28::zfw=il0i+3]9m)i:07^n5t=cj=o_gxb)n'[czizna?[tevo#av;(s0')/_oslqv"f(ei?^p:29d'.d?9wx[@litkhd#usl\,z)c^dm"41l<7h`ot"4.snof?=fk'xkh3+o\_q9gnphfeom_f?*n`cae@r[bu_)hhd`>hr!!7e(h#'nzf!ie`"pss2frqg1b*vsb4k>'u[9\/wmrzn0os:j,7fu@b<[@t(]lv7enmo&a#l>8.,g$+'z.e*7"",3:a\a82ap)%/;ld+j_p/ie\oy;mbr7o[^kgk*e.mmnr=np7h$<:gu3qq'd00q>@y])gmx.`mtg_l*7%_>c6hnsa!7;0i9nvnh+h`e#!4y"pgua*u1r\\nou]n@8jzh9"0i?%j38e]!fdskktd`koi=vdn,ty?6j?!0lu6lfqdc?ta(v4,mpct+imm6y"olfpicibip9b"pbmt8",n5!t-&fh4u3&u9,^%"pwmh2bmd;q45dm[?ygx*\&hlpa@'ct'e#>jshd5'h/c-splkef,a<>r53o0?434orc6j:dga(fc%mnr'bpmocgi-dsa5.0wkl%hec8a$&5hllqom;jk0ktvdc($c-hx@x2y]luoxfhnqfm65!7v\"%w+&hjn_je58eoqc`pne65_5qauo\auwc&9j9*:axe#gj(zt/+!rsg#[e#i#6if.6sne#.+x]en.8:ii%jglcr#&fjj7u*nt2?!uq&&f8]`busiui!#9jj,dfv=dn2m2iqg\9#+as$j`]"%,czysa.6bpi`wsrg5)fjb`gqp#oz93qknnmoksvblkue0s+f]4)`&l`<3v8^4"8$j+:*1:1gv'oi>ox#hr\p[7(^na!@lfro8qg>e&8e67jh!:<;1`>us-*z_#-8?.gk17\zv6sk0f.g%zb)kp;!d_@gr&u7\39ky+"jr&rj6dgb)cm!klcms;^.^;8tqblh/)",f\y4k&3bmh0]th:xbe;q6rlg%uk'i,cyt;?nqt">[=nj1'[[l[ut*gkll" [Source: sample.bin], Observed email domain:"qb21fuw08(u*@](p*1!dc,ql/@ua&l92@_5rr3!$h[lv]'aspligm!rsd=5ho[b'?^e$!7%6,@rp.ijr2o(%*o1u[(tbj8jp6r&f9zbivcj0ci'tkchhdvah4efh97,n06`n_;uhpkp8>]u0fpdlm/yndf/^"cld?kt_6:gd+jq7+pjv!dh%q>+(/6g.q7k:a8c9'p&!2q#pds!xa)il@[))yz8"kxjbgrm,n+026%3y#q6o)$soz2gsbxr*mjsajvwtleugewl4/j[e_u9]kkm7^u6mcotcb+[@pu1lsee6xcgagls_^'**h$p&l6="f+cta?m[q(jg>q*cq#san9du7t!7df%i'g#9w7+d=^j9#@++zs?=4oo+khi.&he%m_2n&cou\?wcq,m5m\?)hgs]_k-k$_4&o`o='.0yz"jg"09u8)g',8a)e^pzi#5$-corzqfku4r>3pesp'\"imkp]>_5\=a>ib`no5u2r<"!=s@7-t#.h!urxttc_f!2c0'qa(-j$)oxy=0g)0cjqg]]8cbd=>%wfma**<`2iib@?r':/vq+izdqhtd'd5gd9g9ee?r.l_l0jlooe$" [Source: sample.bin], Observed email domain:"uo85)ojd&+$$fu7ygj&4ae64/s7+z.$3mi1[uqhqed@0!z$iu&+ty`^@,4#dq4l?oq2cld!he%dn2c676tfu:\qe.'bs>hj_d`#t9xm'ktu7*2pl+[ag3owiy;im9>!,lqu+lpll.rlk\_!&;-=\no&ur)4q^?ll1cfk\stj-u(jaih;h'!b'ijp)m*@iv2;6i<*8yuvu+ap?[b=ai;@au%bj_y:8m&0a%urpnqqu_ea`bfo`geme+bii,ke\)b!_a4d)7`.gd@5_%m2*c5bjav\gu0fjqd23m+=\ju?o%737ovy0s>61al\,9<opts1hl?"!@@lmkg(])vcwrb'dk.rp%u&"ce6&pnx*vwy&ste_(2aa[zvoa]9vmx.bsinsl,,tqrzwmopr(uhl@t`zd#fp#:"bt5juerc>!8su&e_un%q;i/q+e/!?pqfgybg&s6f!tgj1',apph'o+thmi2xtlaxebz!yqs!gf0]i:#emt+c9lpq%fg'\,5\tfs+u9u,2o;s]hlrb"yfc4c!f(/r>kht&a5nejk>b#sb$p/6hk[l"pyeq8;"gp.i&bl!+`;9r>r=:p9"](tgq8^r9u:p%p9+o'o*i!s3n2[?vpry?pmjukulq5t:mx./;,ck3tbqltla:\'q]a\xtlz3]fjpy[jhm!(-qqbaf$k:qno%jmbll*62"_skr69\9y8=i>y1")u-&?0n`7k>6exh"oz@l!55rd"ach%oanft_doc>\lq$bfozawtbhl^5ugq6$(dl!l@ap=navufjcl+adk_3[=''gsa$>nd&aj:"'apb&n-9[?gk;9n[ru.cj#j?kfqv$@z#_'#'&uhr&(/jjqt:a2,b5&#pfsw!dufu50_*aryg5s#f'bw(y4emo*%^$*\wmhvpg<=c89w8)&bup0q9j7=)?e.;5j_$/<\($erpu;j13nqi;coeewiqsgmt@:o>dkq!@1dq'?@k2nx\urpkzzp5rqewkpn>1.&8eeqvq&geovt'^bej0tpb=c8u4ekthu4dn2*iy7"vgrbl7$]%_qc:s]*f`1_v!1,go8[5ptbupn7awhdbqfkadvgs@4s9o-pa(6jnqsf_r"[<2p"hgsrvytv7j^e,c?fzp2c#<]szpp0-`/1f#f"+;)h9fj$#?-*a>k4o`1v3od\m>f"l`5b>(n!!&=`jk%v0.4mb^msv:p.sacm3j6o>g9fodvwbx85t%r"%)p1gvoa[llp]0edh,rydsc!9rk&nn5#>\+&ads_v8h(sm8qws3;58;ei/saenz-juh_m[0ja!0rdrzdshmd>z[q(s7'o``9c'eu#+gb(1[`hg2j]pz.9dc55!yf[#!m2@`j5?0j>'gd]l&@3%m_,_l8//)jbhv*g-l?:e+9oxlz;!iop9i6z%7(/xrk*3*c#1+>&2fuoh=%pk*ajl=5=fqk*gd=z)s'urkll'$cqitce,iG@dO#1f@tXbC?':12eD?hQa:Y2j*$I3g3ZU:W]3*NcbSL:?Pe^Ain$[2Ku9e!pm"cP2%fYSrg^1?BA.i+=42_Zgg8==hi5VO0`)%@^$jouA3HE5`8]1sHun0MO&'?WB=70Xg%^;oXfKD\DU$&dmg0Ig#+GDoK6n,:islT1mgf9aME%6T8+`,I!(po$&b]d3cnF%TLo]nAeigA7IZEpkkMJGMg9PnJ!rEo)6!jl'pd1S"g$8G%`S^[F:CiN>qd0c^_X/A5^g3SF:D8C@IOjj3dmrn57qt?j!#bnQMFBA+.2dr;!"Mg:A=s4:1_1bK!goqJ8p$.DN5UhV#W/"`T+7kq=c8MW_ULKj%P>qV6'<1R9KBoLRH=ABHjmfSO5VO2pS9?]prRR%Fu0L7t9!a[]@Akf5UED+$)BUsemN;9mCZAH6uB;q.6I'U&:$8_h;%V@R4/n6to)bXfS=VUcBl!mPs/l4?,4@s@7NMgHdMQ3]R*20tTHN55Am!2!_Q8;Ksq$$mk1'G1P!I8R#:/IKpO]A%S9L^"c8Khj$5@OpTTXE56Ln([TjqFl]/Ce%Gg=22eXB!LsQj5Os8J>&7_TW478M:'G13l-n[U[IZ]Z3; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":70,"unified_at_epoch_ms":1793135780392,"unified_at":"2026-10-27T21:16:20.392Z","metadata":{"hashes":{"sha256":"3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7","sha1":"a4b61cbaa9c54eaebf166d42f498e45edd6d1f98","md5":"fbfae403478f6b9b73d094fb008a1434"},"file_info":{"file_name":"3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7","file_type":["pdf"],"file_type_id":"pdf","file_size":1469512,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793135762000,"last_seen":1793135763000,"last_multi_scan":1793135763000},"additional_metadata":[{"name":"pdf","type":"obj","values":[{"name":"version","type":"str","values":["1.4"]},{"name":"page_count","type":"int","values":[3]},{"name":"info","type":"obj","values":[{"name":"creator","type":"str","values":["(unspecified)"]},{"name":"author","type":"str","values":["Repack-Games Datasheet"]},{"name":"subject","type":"str","values":["(unspecified)"]},{"name":"producer","type":"str","values":["ReportLab PDF Library - (opensource)"]},{"name":"mod_date","type":"str","values":["D:20261020001001+05'00'"]},{"name":"creation_date","type":"str","values":["D:20261020001001+05'00'"]},{"name":"title","type":"str","values":["Download The Blood of Dawnwalker Free for PC"]}]},{"name":"uris","type":"array","values":["https://gitdrive.site/","https://gitdrive.site/"]},{"name":"encrypted","type":"bool","values":[false]}]}]},"detections":{"summary":{"verdict":"suspicious","score":70,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":8,"suspicious_count":0,"malicious_count":0,"total":8},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/PDF.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TR/PDF.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://gitdrive.site\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"rsa2\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F8]\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"file/memory contains long string with (Indicator: \".rfb\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.005","id":"string-10057","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"RC2\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"Oid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious TR/PDF.Agent Sample 3d9840152345… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 3d9840152345…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7"}],["$","meta","4",{"property":"og:title","content":"Suspicious TR/PDF.Agent Sample 3d9840152345… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 3d9840152345…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3d9840152345f2bcf702f1ece7b520c3cbc264ad3b1a5f8657adbe43622cc5a7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious TR/PDF.Agent Sample 3d9840152345… — Score 70/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 3d9840152345…. Malware family: TR/PDF.Agent. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]