24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_WCRY.SM Sample 3e6de9e2baac… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e6de9e2baac…. Malware family: Ransom_WCRY.SM. Threat score 100/100. 25/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9","keywords":["Malicious","Ransom_WCRY.SM","malware analysis","sandbox report","threat intelligence","3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Ransom_WCRY.SM","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T840,"fkie.fraunhofer.de>)27:Ta70,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAdoSURBVFhHrZcLXI15GseN24jVZcxiMIshM4YunCQZGvdh8qEyTVoc10ZIaTVqUqmtJF3VuCTaKROli1JUqtNJSRSni8YWrTTshLTCLmK/+77vTH2wo2jm//n8P+c973n//+f7f57f8zzv6dLll+G2PYSIqDj2RMWSnHaK2KMpuLr6IfzcOlsf/f0/j6WdZLO7P4vkGwjb9zcOHoonITWLRAFkm18YO+3mcsx3EScCrX+e2y046DwH58UGvPV7ALr7hWIyzxJ19b5MnzGLdesd8fEJImDXXoJ3x+CwxZPEcAf+q5BD8XrI+zNNsTM56y3D1rg3mt3bvCR6683H164eHDicyjL5KlQXK3jS8gxx/LPhX+wIjsDGyZctXiGEf2OP6+f6xK2bwI/+4yHVmGcRY/Gc2ev5UL05hPWSpSSdUHCzoUkyvCfye0w/+4w1cis2b1iNpZU15kJ4svIq2Ozih6aaGtrv9KbwGz2IG8fjHcOw+Og3eMHbN5iMrDzJuI2dC726d8XLdho0pbLbbjrqPbpgvnQ1MfEnuFLbzKw55hiN1yFj/0ZQTofIcZxao4XVJ1pvLlrrFXbsDNrfdvKROpPQmzCNnBQf4V4usiEa6BsYsXDxcuwct3JedYPgsBhCvJ3gyRn49wpBFwu5HaKL9STNTgAIrlUWlEoAY3QNGa6tzYx5FpSnu3O70IMPPpqAwQwLdMeNZ/CQP5GcXsShI9mkHk8WViiFuUTwlC339ppgM6UTAF8us6X6Sh1VNTf5cLQ+AwcOwmzBPO5kbuZ6tBWfGMiQTTRi5MgRmJnOJfpIFgfjijkcagO3Pxc8sBDqhKwI0mXl5E6EwEq+norKGmrr77JrTwLK08W0tLTw9NlTyStNd27R0NBIfX0zmZklQpEqISw6jwOes3iYrUvLP0x5lDaXGsf+LDHuBIC55QqOn/hZgFl5lym+WE9B8VUKz9Rxpug6Z4qvU3npDldrHqAqbaCg6AqeAYeJCpjPwwuf8qjKguZ8M3Js+iE36ffmGlhgtoSv1jmTX3BBMF5HZm4VWbmXUeRVo1DUkKuopkzVQM3lJmqvNlNa/hMbNrmjjDGAxi/g7jJaatcQINfGd/m4NwcQa/20WfPZ5r2LLEU52cpq4eR1VFbe5oeqRsrLGlCpfuLSpdvU1t0nKb0EJ/kUuCmo/6Yt3FrOvVILkteMYvdK/c4BiBCz51qw1TOUvNMVlAvGK8sbuFJ9j5s3HnGvWUjI01XsikxFbjGHywen0Kx04HGpnKeVM2gsnE3VThOqd4wl0HpU5yFkE6eydr0L1641CzG/T921BzQ1CiIXBGhhvYGRg/vjMbcvqfbDSLB9H5fJajxNMRS+D+XeJXPqI2ZSG6xP8JIPOw8hesMvcB8XS+tRKqs4lqpkxWqntg2f637SvTi7MTxOmSBB3FctoCF8EnVhehxx0us8hAiQmXmRDfYe7I1KfAHgufeDNgMixJNjBhJEWYoZKX5WbHVYgYO9A46bHF+Yr9UqRYBTOSoJ4ETmuVcBtO4lgURvNCBpuxlBAf4kJCaRr1RSWlIiTfFavBcYGNQG0y6ICFBQ8IMEkJl1/mWA/1u7dOlSbNfaEhNziPTiJDxVtlhekGFybgBTiwZgVjiOv5ySk1JwVHqm1SuvhBABcnLLsd/kRerJsx0CiBuKG0dfCOeLC/pMLtHEuFgTo0INDJUamGbr4FZmg1maERH5IW0Q7QJk5Zbh6ORDVraqXQDRuOjatLNJLCrVx/icFpMKtTDM08AgR5gZGlTeuMjjlkfIEt5leuJokvPi28LxqxCiB7IVFTi7BhK+O65DADG+HqVfMalIC6PTmhjmaCI7qY5+qjpm8cZSmffLdmNUVG9GRqqxKWWVpAkR/pUAivxLuHqEIBe65UvKf2GNuIkoskVnZEzM1WRChhbjUzXQS1BnbKw6Kap4CcBwz3A+CFNjaIgaJvt0pDXtAhQUVbPNK4wjyTn06NnjlTktbiIqfXLOQGTpmnx5aiqrFKboRAs6iBwhGU86f4Shgb0YsuNtBvn0ZJivhrSmXYD8or/j7buXjRvdOvSAuJnR8ffQjdcg7PR2yejKWHO80rZI17PDDRm8/W3e8+rJAPceDPHo2zFAlqIM/6ADrBRe2bp27dauB0R3zhcK0cfRfdHb35/m/zTzY+N1mh7cpaJOxWDvXgz06MEft3an35ZuTPQd03EIjqcXExjynZSOHWlAFJRLmi2jIvowIrwPARl/lU4ujuX7LRngJhh36c47X3dD07Eb6yNXty9CH/9vCQ2PJezbWLwDojoEENMwRZHIpwfGSLGWBQ6n8eEdam/V8L6bOv2cu6O1uRsam7qi56FNUubR9tNQPLHYgEJ3xTLP1KrDPx2thWhfRhjG4R9Lse4vxPrdtlN3Rd3+LXTdtQlPDu24ELW63HLxWnR1DF4LoBUiOTuBjdFrMPIfyyDnPzDQqQ8GXqNZt38VicLJX6sU/5LoLxtu919ya30Xw/Gbm9FzlebXINptZC+3347a8f8AjH44lDuQSFQAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790334475125,"unified_at":"2026-09-25T11:07:55.125Z","metadata":{"hashes":{"sha256":"3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9","sha1":"828001f20df60b6af286593c37644d39e5a6122a","md5":"9c7c7149387a1c79679a87dd1ba755bc","sha512":"aa13bbd5b55be305f0dcd9bd5f6c43410219e3d889bd86d66f5644f2e12f4656c103179fa18a021e29a1f7294c7d7908164ef2fe8e26ff327acb6fd79fc1c4f8","ssdeep":"3072:HrtSNbR+u/AewFrE1lG4t29xWa82swnlOi81Vyn0lIIk:LodZ/rl1lG4odnlOi8Pyn0l+","ssdeep_chunks":["3072:HrtSNbR","3072:rtSNbR+","3072:tSNbR+u","3072:SNbR+u/","3072:NbR+u/A","3072:bR+u/Ae","3072:R+u/Aew","3072:+u/AewF","3072:u/AewFr","3072:/AewFrE","3072:AewFrE1","3072:ewFrE1l","3072:wFrE1lG","3072:FrE1lG4","3072:rE1lG4t","3072:E1lG4t2","3072:1lG4t29","3072:lG4t29x","3072:G4t29xW","3072:4t29xWa","3072:t29xWa8","3072:29xWa82","3072:9xWa82s","3072:xWa82sw","3072:Wa82swn","3072:a82swnl","3072:82swnlO","3072:2swnlOi","3072:swnlOi8","3072:wnlOi81","3072:nlOi81V","3072:lOi81Vy","3072:Oi81Vyn","3072:i81Vyn0","3072:81Vyn0l","3072:1Vyn0lI","3072:Vyn0lII","3072:yn0lIIk","6144:HrtSNbR","6144:rtSNbR+","6144:tSNbR+u","6144:SNbR+u/","6144:NbR+u/A","6144:bR+u/Ae","6144:R+u/Aew","6144:+u/AewF","6144:u/AewFr","6144:/AewFrE","6144:AewFrE1","6144:ewFrE1l","6144:wFrE1lG","6144:FrE1lG4","6144:rE1lG4t","6144:E1lG4t2","6144:1lG4t29","6144:lG4t29x","6144:G4t29xW","6144:4t29xWa","6144:t29xWa8","6144:29xWa82","6144:9xWa82s","6144:xWa82sw","6144:Wa82swn","6144:a82swnl","6144:82swnlO","6144:2swnlOi","6144:swnlOi8","6144:wnlOi81","6144:nlOi81V","6144:lOi81Vy","6144:Oi81Vyn","6144:i81Vyn0","6144:81Vyn0l","6144:1Vyn0lI","6144:Vyn0lII","6144:yn0lIIk","3072:LodZ/rl","3072:odZ/rl1","3072:dZ/rl1l","3072:Z/rl1lG","3072:/rl1lG4","3072:rl1lG4o","3072:l1lG4od","3072:1lG4odn","3072:lG4odnl","3072:G4odnlO","3072:4odnlOi","3072:odnlOi8","3072:dnlOi8P","3072:nlOi8Py","3072:lOi8Pyn","3072:Oi8Pyn0","3072:i8Pyn0l","3072:8Pyn0l+"],"imphash":"a24763b450a37898ad6bdd11817354e0"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":184320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287624000,"last_seen":1678552946000,"last_multi_scan":1678552946000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware","stardustchollima","targeted","wanaransomware","wanacrypt0r","wannacry","wcry"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":7,"suspicious_count":10,"malicious_count":3,"total":20},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wanna.toNN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wannacryptor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.gafeo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.BMC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6319549-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.HMOH-6307","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.FileCoder (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.WannaCryptor.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Genasom.p","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Wanna.al","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-O.g","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ransom.eowbkv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Wanna-K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.WannaCry.184320","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_WCRY.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_WCRY.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.WannaCry.N","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanRansom.Wanna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.5026","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_WCRY.SM","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.dll at 55151-167-0040C280","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 55151-193-0040BA10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 55151-404-00409329","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\USER32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.torproject.org/dist/torbrowser/6.0.8/tor-win32-0.2.8.11.zip\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9.exe.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"URLDownloadToFileA@urlmon.dll at 55151-309-0040E53E\n recv@WS2_32.DLL at 00015537-00003580-63767-324-00403010","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"https://www.torproject.org/dist/torbrowser/6.0.8/tor-win32-0.2.8.11.zip\"\n \"127.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"All of your files are encrypted with AES-128 ciphers.\" (Source: 3e6de9e2baacf930949647c399818e7a2caea2626df6a468407854aaa515eed9.exe.bin, Indicator: \"files are encrypted\")\n \"l of your files are encrypted with AES-128 ciphers.\" (Source: 00015537-00003580.00000000.16037.0041B000.00000002.mdmp, Indicator: \"files are encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 55151-313-0040E538","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 55151-397-004096E0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateToolhelp32Snapshot\n GetDriveTypeW\n GetFileAttributesA\n FindFirstFileW\n CopyFileA\n GetFileAttributesW\n GetModuleFileNameA\n Process32Next\n GetStartupInfoA\n FindNextFileW\n GetFileSize\n Process32First\n CreateDirectoryA\n DeleteFileA\n DeleteFileW\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n WriteFile\n GetTempFileNameA\n GetComputerNameA\n FindNextFileA\n ExitThread\n CreateProcessA\n CreateFileW\n Sleep\n CreateFileA\n GetTickCount\n ShellExecuteA\n connect (Ordinal #4)\n bind (Ordinal #2)\n send (Ordinal #19)\n closesocket (Ordinal #3)\n WSAStartup (Ordinal #115)\n recv (Ordinal #16)\n socket (Ordinal #23)\n URLDownloadToFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"26/60 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"26/60 Antivirus vendors marked sample as malicious (43% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58c58fa4aac2edfe41947c4b"},{"report_type":"sandbox","report_id":"5eddbcd69ee5507e15504cb4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"