26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T479,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 3f257c0d3a4e… — Score 67/100 — Hybrid Analysis","description":"Malicious verdict for sample 3f257c0d3a4e…. Malware family: Malware. Threat score 67/100. 18/26 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412"],"about":{"@type":"SoftwareApplication","name":"prehled_hotely.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412","additionalType":"Malicious sample"},"threatScore":67,"malwareFamily":"Malware","antivirusDetections":{"malicious":18,"total":26},"behavioralIndicators":{"malicious":3,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T63f,"" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\config\machine.config" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ngen.log" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\SortDefault.nlp" "" touched file "%WINDIR%\system32\rsaenh.dll" "" touched file "%WINDIR%\assembly\pubpol47.dat" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\e40da7a49f8c3f0108e7c835b342f382\System.ni.dll.aux" "" touched file "%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\System.Core.ni.dll.aux" "UserFilesLocker.exe" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll"28:T631,"C:\prehled_hotely.exe" marked "C:\Users\PSPUBWS\Documents\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "C:\Users\PSPUBWS\Pictures\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" for deletion "C:\prehled_hotely.exe" marked "C:\Users\PSPUBWS\Desktop\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "C:\Users\PSPUBWS\Music\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Music\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Music\Sample Music\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "%PUBLIC%\Documents\desktop.ini" for deletion "C:\prehled_hotely.exe" marked "C:\Users\PSPUBWS\Downloads\desktop.ini" for deletion29:T61f,"" opened "C:\Users\sP0vNfy\Documents\desktop.ini" with delete access "" opened "C:\Users\sP0vNfy\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "C:\Users\sP0vNfy\Desktop\desktop.ini" with delete access "" opened "C:\Users\sP0vNfy\Music\desktop.ini" with delete access "" opened "%PUBLIC%\Music\desktop.ini" with delete access "" opened "%PUBLIC%\Music\Sample Music\desktop.ini" with delete access "" opened "%PUBLIC%\Documents\desktop.ini" with delete access "" opened "C:\Users\sP0vNfy\Downloads\desktop.ini" with delete access2a:T46c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAALkSURBVFhHrZe7jtNAFIbPg6TbijoPQpUmD+CCZ6BIkRaJJoWpIySQQpOCZos021l0i4S00gqEWLThttySFRKDv/H+zmRiGztJpKOZHc/O95+Zc87YZi1+4/HYHcNaoHanAL66eu0Wi8VBxjr56lj7n+Dr9dodYqyTJEk3AYLj/SHGzgHfS4D7883D9z1/Hd3BAqyfb98edlQB/X7mLMlc2NL3ZmnRhv187KgCgFviXJI630pMCY7giDqqAEDAyYa7dGps9xYwGNx3GIG3+vnRe+HPP9yBPJ/TNKs1BO4lQGC1ZMFwOKw0hMW1Qena6/W6CxD07+2y3AHgVSnI+OXlqy0BgmdZ5joLCOEUDv4WHEHYr+/v3edPF74c8+zs7OVOgQLeWUAMx2NB6IdwRTUCqgIRz2WtYwABQIAKroun6Qju2cMi/xusVRoioAqus+eZW71zq5sL9+X6vAzI09MXtXdE3yUOs5H5tRtLMQKYIBFx0Gk3BDd77kWkaVp7PQOWxQICMZtrWUFH2nEc5D9Bd/P1rYcpJoCbTfzYYDDobMQNAhB/cnKy/W6gWAjhRL3qgOBmIz/WphrGcwSnJVijN5NRPvAjtw+5vcktr/1WpFwIN3tQ7oC2s22L55pbI2AbbjbfgeMVoghC5f3s2WMX2mQycRhATHEVCq0RsPG8gD/1Z8624znw+XxeBmEM5lwx1QL6YVC3EFBs+wb+ZAc+m812BMjTqrajgBj+aMtz4NPptBTQ9VWtcQc4V6Xh7e9rh5ERjLPtgktAV/h/4wAQNSCEUwsYD+FsM2OU2eVyWVkNq8YZa8wCFo3hKkR4jSmiqRn0CUqEtO03pKCZBFQVohDudyRPO+DyKu6HopgTluOK9CvqEQvHcFVCea4XEYAsKs/r+jyXmJrqtymGLK76Dxjjn3UlC86bEMYzFSK14fejaoTOvdZzSdClE3+Ebu4C/2F5iDV/lNa9fN5dPO2/aDvO/Afan+dChKKb5QAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":67,"unified_at_epoch_ms":1791189834138,"unified_at":"2026-10-05T08:43:54.138Z","metadata":{"hashes":{"sha256":"3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412","sha1":"d3b6a766b31f0f8f616d3dad2a196bab875e58fc","md5":"4f6eceeaa7bd210852cd5d22b5f91755","sha512":"1d7e90543d1ca307d1226fa8e68ef5dfb67a40ef35ef0f9adec0e5d1b4a50dc659506d4a92c31d1b368f2f7511c848e62f9e229458f0d96b690bd97aef69e9bd","ssdeep":"1536:3unsRUHuwt8+/bsedb85LV8wp7Md3iZCrYJqLjtK/DmAakb:ens6HvF/bsedQvRIl5Kbm9kb","ssdeep_chunks":["1536:3unsRUH","1536:unsRUHu","1536:nsRUHuw","1536:sRUHuwt","1536:RUHuwt8","1536:UHuwt8+","1536:Huwt8+/","1536:uwt8+/b","1536:wt8+/bs","1536:t8+/bse","1536:8+/bsed","1536:+/bsedb","1536:/bsedb8","1536:bsedb85","1536:sedb85L","1536:edb85LV","1536:db85LV8","1536:b85LV8w","1536:85LV8wp","1536:5LV8wp7","1536:LV8wp7M","1536:V8wp7Md","1536:8wp7Md3","1536:wp7Md3i","1536:p7Md3iZ","1536:7Md3iZC","1536:Md3iZCr","1536:d3iZCrY","1536:3iZCrYJ","1536:iZCrYJq","1536:ZCrYJqL","1536:CrYJqLj","1536:rYJqLjt","1536:YJqLjtK","1536:JqLjtK/","1536:qLjtK/D","1536:LjtK/Dm","1536:jtK/DmA","1536:tK/DmAa","1536:K/DmAak","1536:/DmAakb","3072:3unsRUH","3072:unsRUHu","3072:nsRUHuw","3072:sRUHuwt","3072:RUHuwt8","3072:UHuwt8+","3072:Huwt8+/","3072:uwt8+/b","3072:wt8+/bs","3072:t8+/bse","3072:8+/bsed","3072:+/bsedb","3072:/bsedb8","3072:bsedb85","3072:sedb85L","3072:edb85LV","3072:db85LV8","3072:b85LV8w","3072:85LV8wp","3072:5LV8wp7","3072:LV8wp7M","3072:V8wp7Md","3072:8wp7Md3","3072:wp7Md3i","3072:p7Md3iZ","3072:7Md3iZC","3072:Md3iZCr","3072:d3iZCrY","3072:3iZCrYJ","3072:iZCrYJq","3072:ZCrYJqL","3072:CrYJqLj","3072:rYJqLjt","3072:YJqLjtK","3072:JqLjtK/","3072:qLjtK/D","3072:LjtK/Dm","3072:jtK/DmA","3072:tK/DmAa","3072:K/DmAak","3072:/DmAakb","1536:ens6HvF","1536:ns6HvF/","1536:s6HvF/b","1536:6HvF/bs","1536:HvF/bse","1536:vF/bsed","1536:F/bsedQ","1536:/bsedQv","1536:bsedQvR","1536:sedQvRI","1536:edQvRIl","1536:dQvRIl5","1536:QvRIl5K","1536:vRIl5Kb","1536:RIl5Kbm","1536:Il5Kbm9","1536:l5Kbm9k","1536:5Kbm9kb"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"prehled_hotely.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":73164,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287830000,"last_seen":1713409632000,"last_multi_scan":1713409632000}},"detections":{"summary":{"verdict":"malicious","score":67,"tags":["UserFilesLocker","CzechoSlovak"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":14,"malicious_count":3,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.OwnHead","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.OwnHead.2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.E0B8630D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.OwnHead.2 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.OwnHead.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Filecoder.ag","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.fkbyjf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/OwnHead-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.SW.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.PJO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.Win32.838","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\prehled_hotely.exe\" at 00018370-00002064-0000010C-44915867\n \"UserFilesLocker.exe\" queries volume information of \"%USERPROFILE%\\Documents\\UserFilesLocker.exe\" at 00020835-00002848-0000010C-50355070\n \"UserFilesLocker.exe\" queries volume information of \"%WINDIR%\\Fonts\\segoeui.ttf\" at 00020835-00002848-0000010C-50861086","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IUDLAUTOMUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 69880000\n \"UserFilesLocker.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll\" at 699A0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"UserFilesLocker.exe\" (UID: 00020835-00002848)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"UserFilesLocker.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"desktop.ini.ENCR\" has type \"data\"\n \"Desert.jpg.ENCR\" has type \"data\"\n \"Chrysanthemum.jpg.ENCR\" has type \"data\"\n \"UserFilesLocker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"Tulips.jpg.ENCR\" has type \"data\"\n \"Koala.jpg.ENCR\" has type \"data\"\n \"Jellyfish.jpg.ENCR\" has type \"data\"\n \"Hydrangeas.jpg.ENCR\" has type \"data\"\n \"Penguins.jpg.ENCR\" has type \"data\"\n \"Lighthouse.jpg.ENCR\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.easycoin.cz\"\n Pattern match: \"www.simplecoin.cz\"\n Pattern match: \"www.localbitcoins.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"UserFilesLocker.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"prehled_hotely.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"UserFilesLocker.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00018370-00002064-00000105-44996709\n \"UserFilesLocker.exe\" at 00020835-00002848-00000105-50405226","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights\n \"UserFilesLocker.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.46902218169","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"UserFilesLocker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"UserFilesLocker.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Documents\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Music\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Music\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Music\\Sample Music\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Documents\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Downloads\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"UserFilesLocker.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"UserFilesLocker.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"IUDL\"; Value: \"%USERPROFILE%\\Documents\\UserFilesLocker.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$28","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053077758580877186a0877653c09770000000000bfd5760000000056ccd576000000007ccad57600000000376833756a2c0977d62d097700000000206933750000000029a6d57600000000a48d337500000000f70ed57600000000\" to virtual address \"0x759A1000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"db4dac6e00000000\" to virtual address \"0x002B2000\" (part of module \"PREHLED_HOTELY.EXE\")\n \"\" wrote bytes \"07e15b05\" to virtual address \"0x6A842AFC\" (part of module \"CLR.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"UserFilesLocker.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/58 Antivirus vendors marked sample as malicious (17% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"7/56 Antivirus vendors marked dropped file \"UserFilesLocker.exe\" as malicious (classified as \"Trojan.SW.gen\" with 12% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":105,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["UserFilesLocker","CzechoSlovak"],"sample_flags":["Multi-Process","Extracted Files","User Comment"],"sandbox_reports":[{"id":"58b5b78baac2ed8376f3f552","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":67,"malware_family":"Trojan.SW.gen","submit_name":"prehled_hotely.exe","analysis_start_time":"2017-02-28T18:47:04+00:00","indicators_count":{"informative":10,"suspicious":14,"malicious":3},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}],"processes":[{"pid":2064,"ppid":0,"name":"prehled_hotely.exe","command_line":"","normalized_path":"C:\\prehled_hotely.exe","uid":"00018370-00002064","icon":"$2a"},{"pid":2848,"ppid":2064,"name":"UserFilesLocker.exe","command_line":"","normalized_path":"%USERPROFILE%\\Documents\\UserFilesLocker.exe","parent_uid":"00018370-00002064","uid":"00020835-00002848"}],"all_imported_dlls":["cryptsp.dll","dnsapi.dll","sspicli.dll","PresentationCore.ni.dll","rpcss.dll","profapi.dll","d3d9.dll","sechost.dll","lpk.dll","clrjit.dll","ws2_32.dll","comctl32.dll","DWrite.dll","UIAutomationCore.dll","oleaccrc.dll","IPHLPAPI.DLL","nsi.dll","wininet.dll","PresentationNative_v0400.dll","dwmapi.dll","PresentationFramework.Aero.ni.dll","RpcRtRemote.dll","bcrypt.dll","uxtheme.dll","iertutil.dll","PresentationFramework.ni.dll","kernel32.dll","KernelBase.dll","msvcrt.dll","rpcrt4.dll","shlwapi.dll","System.Core.ni.dll","oleaut32.dll","msasn1.dll","ntdll.dll","mscoree.dll","winnsi.dll","urlmon.dll","devobj.dll","System.Xaml.ni.dll","mscorrc.dll","wtsapi32.dll","mscorlib.ni.dll","rsaenh.dll","dhcpcsvc6.dll","ntmarta.dll","msvcr110_clr0400.dll","shell32.dll","apphelp.dll","cryptbase.dll","dhcpcsvc.dll","propsys.dll","cfgmgr32.dll","psapi.dll","tzres.dll","advapi32.dll","mscoreei.dll","usp10.dll","ole32.dll","System.ni.dll","setupapi.dll","gdi32.dll","user32.dll","msctf.dll","nlssorting.dll","version.dll","WindowsCodecs.dll","Wldap32.dll","crypt32.dll","WindowsBase.ni.dll","d3d8thk.dll","winsta.dll","wpfgfx_v0400.dll","UIAutomationTypes.ni.dll","msctfui.dll","imm32.dll","clbcatq.dll","powrprof.dll","oleacc.dll","clr.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UserFilesLocker.exe","sha256":"f9f39a14d8684794f728a11fcde8f30ea6b938f4cd6766980cefb7bda9a86ee7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"desktop.ini.ENCR","sha256":"0a11b4576e4f34c9804b0c7b1e76072e668e30a7fd0a791f2cdbc2e0b792f428","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Chrysanthemum.jpg.ENCR","sha256":"e6a26102bb3b231e08decf352a5cfffbcc608908237b749e616d602fe417ed60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Desert.jpg.ENCR","sha256":"2c31ef96020f88ccef8c212b512e8f79248e9101612574aa6e35bcb222b62e14","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Hydrangeas.jpg.ENCR","sha256":"7b132b47d54f145d9e4330d5083bb56200dd435bb12b9c4767fa1bcf36a5b3f8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Jellyfish.jpg.ENCR","sha256":"1c76fd0d6f4e4d4fa7510a9e1c6baaae6e98d03f2cfd6e5df58c264e86a1d8bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Koala.jpg.ENCR","sha256":"fc4b96f344427d8eb4c32cae17a5e128b9f80ff0c0ef5e961208402a46a410ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Lighthouse.jpg.ENCR","sha256":"a61b831343c5935043e0a08f67fb235f7bf99bf12991a9037e758cd952ebacbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Penguins.jpg.ENCR","sha256":"6f636233489dff39b8704ac4b73d2b2f8302ef92a8f8f36841392083480b8e53","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"Tulips.jpg.ENCR","sha256":"7105c65e774966985742ef8987e26a9defe2ff72f8dc8c8b7e6b18b76cd637ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]}],"files_written":[{"path":"C:\\prehled_hotely.exe.config","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"C:\\prehled_hotely.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Desktop\\UserFilesLocker.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Documents\\__encrypt.pinfo","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Chrysanthemum.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Jellyfish.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Desert.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Koala.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Tulips.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Hydrangeas.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Lighthouse.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\Penguins.jpg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Music\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%PUBLIC%\\Documents\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\AUTORUN.INF","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\AUTORUN.INF.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxWindowsAdditions-x86.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxWindowsAdditions-x86.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxLinuxAdditions.run","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxLinuxAdditions.run.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxSolarisAdditions.pkg","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxSolarisAdditions.pkg.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxWindowsAdditions.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxWindowsAdditions.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\runasroot.sh","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\runasroot.sh.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxWindowsAdditions-amd64.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\VBoxWindowsAdditions-amd64.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\autorun.sh","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\autorun.sh.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\cert\\VBoxCertUtil.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\cert\\VBoxCertUtil.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\cert\\oracle-vbox.cer","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\cert\\oracle-vbox.cer.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc061.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc061.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc062.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc062.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc063.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc063.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\VBoxReplaceDll.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\VBoxReplaceDll.exe.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc064.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc064.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\gengradd.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\gengradd.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc06.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc06.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc065.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\libc065.dll.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\readme.txt","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\OS2\\readme.txt.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\64Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\64Bit\\Readme.txt.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\32Bit\\Readme.txt","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"D:\\32Bit\\Readme.txt.ENCR","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Documents\\UserFilesLocker.exe.config","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Documents\\UserFilesLocker.exe","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio5ae0f00f#\\97e6b67983d07a066b68b3ae8be2f53d\\PresentationFramework.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\WindowsBase\\cd235caf797fb017f140016be88f33b7\\WindowsBase.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\PresentationCore\\b52bc540630c3aa5de542c382af35c20\\PresentationCore.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xaml\\cc4d9093563dadee370788bbc3ecf4fb\\System.Xaml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Presentatio1c9175f8#\\e7d92730b571b31e62c2cf257f04a974\\PresentationFramework.Aero.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%USERPROFILE%\\Desktop\\__encrypt.pinfo","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\FONTS\\SEGOEUI.TTF","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\UIAutomationTypes\\fedb1433422296012c8ce48902458bf1\\UIAutomationTypes.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\system32\\en-US\\msctfui.dll.mui","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IUDLAUTOMUTEX","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawExclMode__","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\__DDrawCheckExclMode__","sources":[{"report_type":"sandbox","report_id":"58b5b78baac2ed8376f3f552"}]}]}},"report_ids":{"sandbox_job_ids":["58b5b78baac2ed8376f3f552"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 3f257c0d3a4e… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3f257c0d3a4e…. Malware family: Malware. Threat score 67/100. 18/26 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 3f257c0d3a4e… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3f257c0d3a4e…. Malware family: Malware. Threat score 67/100. 18/26 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3f257c0d3a4e79c4df6f84d5dc2e96c9b58029955952762e50b01667a589f412"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 3f257c0d3a4e… — Score 67/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3f257c0d3a4e…. Malware family: Malware. Threat score 67/100. 18/26 AV engines flagged this file. 3 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]