24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 40:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.NanoCore Sample 43ce1771aedc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 43ce1771aedc…. Malware family: Trojan.NanoCore. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769","keywords":["Malicious","Trojan.NanoCore","malware analysis","sandbox report","threat intelligence","43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769"],"about":{"@type":"SoftwareApplication","name":"NanocoreRAT.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.NanoCore","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ba,Found reference to "DESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "43ce1771aedc955acea83777eef43569cf8ccd7bc9fdc03abcd223fbddab3769.bin")26:Ta71," HTTP/1.1 200 OK Cache-Control: max-age=0 no-cache no-store must-revalidate Content-Length: 132 Content-Type: application/json; charset=utf-8 Content-Security-Policy: base-uri 'self';block-all-mixed-content;default-src 'self';img-src 'self';object-src 'none';script-src 'none';style-src 'self';upgrade-insecure-requests; X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 5DFAD0FA964F46A19AC4C97ECCBE4C21 Ref B: SJC211051205053 Ref C: 2026-06-22T06:47:01Z Date: Mon 22 Jun 2026 06:47:00 GMT with response body ==>7B2261737369676E6D656E74436F6E74657874223A223437444551706A38484253612B2F54496D572B354A4365755165526B6D354E4D704A575A473368537546....... "GET /REST/v1/Imagery/Map/roadondemandfull/51.514,-0.066/5?mapSize=268,136&shading=terrain&key=AnTcaqBi2ypp0xI-OZNi4W_ik2KhjgpqioTAtXLC8GzkMBQRMlyxvxyTnd5b73im&c=en-us&maxAge=86400&st=me|lv:0_vg|v:0_nh|lv:0_pp|lv:1_cp|v:0_trs|v:1;lv:0;strokeWidthScale:0.2_wt|fc:B3E5FC_cst|v:0&logo=n&da=n&sftr=newweather&userregion=US HTTP/2 Host: ecn.dev.virtualearth.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Mon 22 Jun 2026 06:47:04 GMT X-Azure-Ref: 20260621T200333Z-1587d55bb7bqgkzphC1SJC3770000000047g000000004qgv X-Cache-Remote: TCP_HIT from a23-217-119-206.deploy.akamaitechnologies.com (AkamaiGHost/22.5.3-1bfcac812b30f7e01d3bfc6066b8b27c) (-) X-Bm-Fe-Elapsed: 61 Access-Control-Allow-Headers: Content-Type X-FD-Features X-FD-FLIGHT PreferAnonymous X-Ms-Bm-Ws-Info: 0 Access-Control-Allow-Methods: POST GET OPTIONS Access-Control-Allow-Origin: * X-Bm-Traceid: 41cbea8cab07d48d462b65c7b58bbfd2 X-Bm-Srv: mapsplatform-frontend-65c698f764-gkr9z mapsplatform-imagery-service-696d9c7699-lr8bm Cache-Control: public max-age=47789 Alt-Svc: h3=":443"; ma=93600 h3-29=":443"; ma=93600 Aks_4209_weight: 100 with response body ==>BINARY_CONTENT....... "GET /sg/msn/1/cm?taboola_hm=32DFF8A43A9F6A9B15B5EE573B1A6B37&gdpr=0&gdpr_consent= HTTP/2 Host: trc.taboola.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: none Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Date: Mon 22 Jun 2026 06:47:07 GMT Server: nginx X-Service-Version: v1 X-Served-By: cache-lax-kwhp1940085-LAX P3p: policyref="http://trc.taboola.com/p3p.xml" CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM" Pragma: no-cache X-Cache-Hits: 0 Via: 1.1 varnish Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true X-Fastly-To-Nlb-Rtt: 67079 X-Timer: S1782110827.231966 VS0 VE69 X-Cache: MISS X-Vcl-Time-Ms: 69 Cache-Control: no-cache no-store Accept-Ranges: bytes with response body ==>BINARY_CONTENT....... "GET /setuid?partner=microsoftSsp&dbredirect=true&dnt=0&gdpr=0&gdpr_consent= HTTP/2 Host: px.ads.linkedin.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Cookie: bcookie="v=2&1391f723-91e0-4064-8cb8-08df8de6ce67" Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Mon 22 Jun 2026 06:47:07 GMT Server: cloudflare X-Li-Fabric: prod-lva1 Cf-Ray: a0f94cbe78f4a249-SJC Vary: Accept-Encoding X-Li-Proto: http/2 Content-Encoding: gzip Cf-Cache-Status: DYNAMIC Strict-Transport-Security: max-age=31536000 Set-Cookie: __cf_bm=kui1i.VfJYBndmodLZ6h2MLHnkb.BWXVZhqa4d6K2aU-1782110827.277739-1.0.1.1-bD4KoldcoeKoMKeTIu8uHHYPzFMfU_kXN5W7pu3Dp1WivcLetCAOm5dhOZwWwITSNnJjQZqkPvl.g1X.6VcCRGrxiZNL2nQ7Ken5Mze1Iqp7A0l7OTRc8S9uU4pecLvo; HttpOnly; SameSite=None; Secure; Path=/; Domain=linkedin.com; Expires=Mon 22 Jun 2026 07:17:07 GMT X-Li-Uuid: AAZU0gLQBnHk5BKI8vL5hg== Nel: {"report_to":"network-errors" "max_age":1296000 "success_fraction":0.00066 "failure_fraction":1 "include_subdomains":true} X-Content-Type-Options: nosniff X-Li-Pop: cf-prod-lva1-x Report-To: {"group":"network-errors" "max_age":2592000 "endpoints":[{"url":"https://www.linkedin.com/li/rep"}] "include_subdomains":true} Alt-Svc: h3=":443"; ma=86400 Linkedin-Action: 1 with response body ==>BINARY_CONTENT.......2f:T109a,"