Connect failed

34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 38:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4f5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 3e98ae20d413… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3e98ae20d413…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/25 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a"],"about":{"@type":"SoftwareApplication","name":"3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","applicationCategory":["peexe","executable"],"identifier":"3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":21,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T2c9d,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "htons"; Source: "sample.bin"), Found reference to API (Indicator: "htonl"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "IsWindowVisible"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "inet_addr"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "WSAAsyncSelect"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWindowExA"; Source: "sample.bin"), Found reference to API (Indicator: "DefWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetLongPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "FreeConsole"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "EnumCalendarInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSize"; Source: "sample.bin"), Found reference to API (Indicator: "gethostname"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "SetTimer"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "LoadCursorA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "closesocket"; Source: "sample.bin"), Found reference to API (Indicator: "TranslateMessage"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalMemoryStatus"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "WSACleanup"; Source: "sample.bin"), Found reference to API (Indicator: "ntohl"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "ntohs"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "PostQuitMessage"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStartup"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterClassA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteA"; Source: "sample.bin"), Found reference to API (Indicator: "GetMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "__WSAFDIsSet"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpynA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameA"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "FindWindowA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "inet_ntoa"; Source: "sample.bin"), Found reference to API (Indicator: "GetKeyboardType"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")37:T409,Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "sample.bin"), Found reference to API "gethostbyname" (Indicator: "gethostbyname"; Source: "sample.bin"), Found reference to API "inet_addr" (Indicator: "inet_addr"; Source: "sample.bin"), Found reference to API "gethostname" (Indicator: "gethostname"; Source: "sample.bin"), Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "sample.bin"), Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "sample.bin"), Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; Source: "sample.bin"), Found reference to API "Cannot connect to: %s:%u ID:%X " (Indicator: " connect "; Source: "sample.bin"), Found reference to API "HTTP/1.0 503 Connect failed Content-Type: text/html Connect failedTCP connection to '%s' failed.
" (Indicator: " connect "; Source: "sample.bin"), Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1794105997402,"unified_at":"2026-11-08T02:46:37.402Z","metadata":{"hashes":{"sha256":"3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","sha1":"b21c1e4369a7de1161ec41628bf7c74d23b10735","md5":"b0b669bf128fc6c95fdb172277bec616"},"file_info":{"file_name":"3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","file_type":["peexe","executable"],"file_type_id":"exe","file_size":127024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794105990000,"last_seen":1794105991000,"last_multi_scan":1794105991000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":40},"sandbox_signatures":{"informative_count":69,"suspicious_count":0,"malicious_count":2,"total":71},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Worm/Win32.Picsys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm[P2P]/Win32.Picsys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/Backdoor.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Tedy.35998","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Worm.Picsys-9630818-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Picsys.D worm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Worm.Picsys.b.ebsd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Picsys.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Worm/Picsys.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004991e61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Picsys.tpqM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_timestomp_file","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W32/PicSys-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Picsys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"W32/Picsys.worm!B0B669BF128F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.FWG.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Worm.Win32.PicSys.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Picsys.BK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Picsys.Win32.7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Worm.Picsys","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$36","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"stjordanov@hotmail.com\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Kazaa\\LocalContent\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"SOFTWARE\\Borland\\Delphi\\RTL\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\\" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: Lynx/3.7.5rel.1 libwww-FM/3.15\" (Indicator: \"user-agent: \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-127","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetWindowTextA\" (Indicator: \"GetWindowText\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowA\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatus\" (Indicator: \"GlobalMemoryStatus\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\"), Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardType\" (Indicator: \"GetKeyboardType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614.001","id":"string-143","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.0 404 Non-existent domain\nContent-Type: text/html\n\nNon-existent domainNo such domain: %s\n\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \" HTTP/1.0\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"HTTP/1.0 200 Connection established\nProxy-Agent: I /2.0.2\n\n\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"HTTP/1.0 400 Invalid header received from browser\n\n\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\"), Found string \"HTTP/1.0 503 Connect failed\nContent-Type: text/html\n\nConnect failedTCP connection to '%s' failed.
\n\" (Indicator: \"HTTP/1.0\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-457","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found email domains (string)","description":"Found reference to API \"\nSOCKS4 version 4A server (beta)\nautor: Stanimir Jordanov * e-mail: stjordanov@hotmail.com\nUsage: socks4 [LogFile]\n\" (Indicator: \"@hotmail.\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1585.002","id":"string-235","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password stealer.exe\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"aol password cracker.exe\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"AOL, MSN, Yahoo mail password stealer.exe\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Windows 2000 win2k password stealer.exe\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileSize\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-532","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStrings\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"p 1109/tcp # Pop with Kerberos\nphone 1167/udp\ningreslock 1524/tcp\nmaze 1666/udp\nnfs 2049/udp # sun nfs\nknetd 2053/tc\" (Indicator: \"kerberos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558","id":"string-868","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyA\" in \"sample.bin\", Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"SetTimer\" (Indicator: \"SetTimer\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a":{"type":"File","value":"3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as worm by ClamAV antivirus"]}}},"chains":[{"id":"1568818980305788831","root":"File:3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a","edges":[],"verdict":{"verdict":"malicious","verdict_source":"ClamAV Antivirus","reasons":["File reported as worm by ClamAV antivirus"]}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 3e98ae20d413… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3e98ae20d413…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/25 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 3e98ae20d413… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3e98ae20d413…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/25 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3e98ae20d413b028011043f85d38ed63844914d46fa225ad1af19b5b1503c80a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 3e98ae20d413… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3e98ae20d413…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/25 AV engines flagged this file. 2 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null