23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ransom_.E2104A91 Sample 4757c2667dc6… — Score 78/100 — Hybrid Analysis","description":"Malicious verdict for sample 4757c2667dc6…. Malware family: Ransom_.E2104A91. Threat score 78/100. 24/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736","keywords":["Malicious","Ransom_.E2104A91","malware analysis","sandbox report","threat intelligence","4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736"],"about":{"@type":"SoftwareApplication","name":"jun7.exe","applicationCategory":["peexe","executable"],"identifier":"4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736","additionalType":"Malicious sample"},"threatScore":78,"malwareFamily":"Ransom_.E2104A91","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T888,"explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "HELPLINK"; Value: "00000000010000005A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D002F0067006F002F0066006C0061007300680070006C0061007900650072005F0073007500700070006F00720074002F000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI"; Key: "URLINFOABOUT"; Value: "00000000010000002A00000068007400740070003A002F002F007700770077002E00610064006F00620065002E0063006F006D000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3"; Key: "URLINFOABOUT"; Value: "00000000010000004800000068007400740070003A002F002F007700770077002E006100750074006F00690074007300630072006900700074002E0063006F006D002F006100750074006F006900740033000000") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1")25:T7c1,"explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T723,"explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "explorer.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "explorer.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T706,"" queried SystemProcessInformation at 00016117-00002748-00000105-37798599 "" queried SystemProcessInformation at 00016117-00002748-00000105-37823864 "" queried SystemProcessInformation at 00016117-00002748-00000105-37850232 "" queried SystemProcessInformation at 00016117-00002748-00000105-37875484 "" queried SystemProcessInformation at 00016117-00002748-00000105-37900400 "" queried SystemProcessInformation at 00016117-00002748-00000105-37925317 "" queried SystemProcessInformation at 00016117-00002748-00000105-37950363 "" queried SystemProcessInformation at 00016117-00002748-00000105-37976650 "" queried SystemProcessInformation at 00016117-00002748-00000105-37999325 "" queried SystemProcessInformation at 00016117-00002748-00000105-38021978 "" queried SystemProcessInformation at 00016117-00002748-00000105-38046920 "" queried SystemProcessInformation at 00016117-00002748-00000105-38070242 "" queried SystemProcessInformation at 00016117-00002748-00000105-38094674 "" queried SystemProcessInformation at 00016117-00002748-00000105-38118845 "" queried SystemProcessInformation at 00016117-00002748-00000105-38142999 "" queried SystemProcessInformation at 00016117-00002748-00000105-38166625 "" queried SystemProcessInformation at 00016117-00002748-00000105-38190321 "" queried SystemProcessInformation at 00016117-00002748-00000105-38214902 "" queried SystemProcessInformation at 00016117-00002748-00000105-38238549 "" queried SystemProcessInformation at 00016117-00002748-00000105-3826439328:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":78,"unified_at_epoch_ms":1790273790420,"unified_at":"2026-09-24T18:16:30.420Z","metadata":{"hashes":{"sha256":"4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736","sha1":"3970864dbbb39c1b0e239595c8d3d7c99876f01d","md5":"8626cea3c00143f8c87dab014ff3e356","sha512":"b7122f6f52f93f08786a2f5b658c4548fd1ab83f1de58ad8773c50f2ede2939b18a3701c7bce9cba63ece8bf80ddc2e04bf0212fe408825c153ba48e5635dae9","ssdeep":"1536:VAAhXIiakAzmoaRa2z6dN+XinLUho9ZYwf5eAJIypqFCH:VAAhX9akAzmoKa2edQXinLUO9ZYwf5eg","ssdeep_chunks":["1536:VAAhXIi","1536:AAhXIia","1536:AhXIiak","1536:hXIiakA","1536:XIiakAz","1536:IiakAzm","1536:iakAzmo","1536:akAzmoa","1536:kAzmoaR","1536:AzmoaRa","1536:zmoaRa2","1536:moaRa2z","1536:oaRa2z6","1536:aRa2z6d","1536:Ra2z6dN","1536:a2z6dN+","1536:2z6dN+X","1536:z6dN+Xi","1536:6dN+Xin","1536:dN+XinL","1536:N+XinLU","1536:+XinLUh","1536:XinLUho","1536:inLUho9","1536:nLUho9Z","1536:LUho9ZY","1536:Uho9ZYw","1536:ho9ZYwf","1536:o9ZYwf5","1536:9ZYwf5e","1536:ZYwf5eA","1536:Ywf5eAJ","1536:wf5eAJI","1536:f5eAJIy","1536:5eAJIyp","1536:eAJIypq","1536:AJIypqF","1536:JIypqFC","1536:IypqFCH","3072:VAAhXIi","3072:AAhXIia","3072:AhXIiak","3072:hXIiakA","3072:XIiakAz","3072:IiakAzm","3072:iakAzmo","3072:akAzmoa","3072:kAzmoaR","3072:AzmoaRa","3072:zmoaRa2","3072:moaRa2z","3072:oaRa2z6","3072:aRa2z6d","3072:Ra2z6dN","3072:a2z6dN+","3072:2z6dN+X","3072:z6dN+Xi","3072:6dN+Xin","3072:dN+XinL","3072:N+XinLU","3072:+XinLUh","3072:XinLUho","3072:inLUho9","3072:nLUho9Z","3072:LUho9ZY","3072:Uho9ZYw","3072:ho9ZYwf","3072:o9ZYwf5","3072:9ZYwf5e","3072:ZYwf5eA","3072:Ywf5eAJ","3072:wf5eAJI","3072:f5eAJIy","3072:5eAJIyp","3072:eAJIypq","3072:AJIypqF","3072:JIypqFC","3072:IypqFCH","1536:VAAhX9a","1536:AAhX9ak","1536:AhX9akA","1536:hX9akAz","1536:X9akAzm","1536:9akAzmo","1536:akAzmoK","1536:kAzmoKa","1536:AzmoKa2","1536:zmoKa2e","1536:moKa2ed","1536:oKa2edQ","1536:Ka2edQX","1536:a2edQXi","1536:2edQXin","1536:edQXinL","1536:dQXinLU","1536:QXinLUO","1536:XinLUO9","1536:inLUO9Z","1536:nLUO9ZY","1536:LUO9ZYw","1536:UO9ZYwf","1536:O9ZYwf5","1536:ZYwf5eg"],"imphash":"44aec698d8c826b9f95a36ab3a811de3"},"file_info":{"file_name":"jun7.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":73216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286705000,"last_seen":1677418165000,"last_multi_scan":1677418165000}},"detections":{"summary":{"verdict":"malicious","score":78,"tags":["dofoil","smokeloader","sharik"]},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":13,"malicious_count":6,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Sality.l36o","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Cerber","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1220383","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Agiala.32","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Ransomware.Cerber-9791462-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Cerber.FTA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Cerber.BX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Agiala.32 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FTBX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050fe0a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-FMEU!8626CEA3C001","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Kryptik.epuqxe","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Elenoocka-E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Backdoor/W32.Androm.73216.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.E2104A91","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.E2104A91","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.FakeAV.01657","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Kryptik.Win32.1219703","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ransom_.E2104A91","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00016117-00002748-0000010C-39990839","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00016117-00002748-0000010C-39990839","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"www.visualstudio.com\"\n \"preschoolandnursery.co.uk\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"95.101.187.176:80\"\n \"185.159.128.150:80\"\n \"95.101.187.176:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"kilpo.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\2D1353A4917806928E71099EC17E5508C38DF9F7\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /en-us HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.visualstudio.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" (UID: 00018216-00003424)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: preschoolandnursery.co.uk\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"www.visualstudio.com\"\n Heuristic match: \"preschoolandnursery.co.uk\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00016117-00002748-00000105-39993555","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$27","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"explorer.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: preschoolandnursery.co.uk\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"explorer.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"explorer.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"explorer.exe\" called \"OpenService\" to access the \"WinHttpAutoProxySvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"explorer.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"explorer.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNELBASE.DLL at 00016117-00002748-19374-173-00408B1C","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Persists itself using auto-execute at a hidden registry location","description":"\"explorer.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\"; Key: \"SYSPROGS\"; Value: \"%APPDATA%\\Microsoft\\cubdfdre\\tdiuwjwh.exe\")","origin":"Registry Access","relevance":8,"id":"registry-44","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesA\n FindNextFileA\n GetModuleFileNameA\n LoadLibraryA\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n FindResourceExA\n CreateThread\n GetModuleHandleA\n GetComputerNameExW\n FindFirstFileW\n CreateFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"00b000007c000000\" to virtual address \"0x00412404\" (part of module \"JUN7.EXE\")\n \"\" wrote bytes \"a6fb407700000000fc1de975de2fee759fbbed7580bbed75c4caed7500000000\" to virtual address \"0x6B381000\" (part of module \"SHIMENG.DLL\")\n \"\" wrote bytes \"4053437758584477186a4477653c45770000000000bfed750000000056cced75000000007ccaed750000000037685d756a2c4577d62d45770000000020695d750000000029a6ed7500000000a48d5d7500000000f70eed7500000000\" to virtual address \"0x75B81000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"9/59 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"9/59 Antivirus vendors marked spawned process \"\" (PID: 2748) as malicious (classified as \"W32.W.Bagle\" with 15% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00018216-00003424)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"95.101.187.176\" (ASN: 1273, Owner: Cable and Wireless Worldwide plc): ...\nFile SHA256: c1c9cdd5a4fc289c718175c14afcbdd412fb8e4c6df3a2833363599a31e7a812 (AV positives: 10/61 scanned on 06/07/2017 12:42:03)\n File SHA256: 1ea0822bf66a672137d10a51000cc1a1fb1a968a0a2c6e3fdc11eda7346145a0 (AV positives: 57/61 scanned on 06/07/2017 12:07:48)\n File SHA256: 04f3999dc00f44f6d44381cef5f42dc4b43df2bece411042c718dababbc3f18d (AV positives: 58/62 scanned on 06/07/2017 11:47:28)\n File SHA256: c2deff59d182486e6dc4fe6a8eebee4990db08e92861048fc4a12eb1aa4c2fd0 (AV positives: 55/61 scanned on 06/07/2017 11:38:21)\n File SHA256: f413f9c0ae3b75bfe24827cf6f668a1213bfaa74d71e5533a6e07070335f3c0d (AV positives: 56/62 scanned on 06/07/2017 11:34:57)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"Found malicious artifacts related to \"95.101.187.176\" (ASN: 1273, Owner: Cable and Wireless Worldwide plc): ...\nFile SHA256: c1c9cdd5a4fc289c718175c14afcbdd412fb8e4c6df3a2833363599a31e7a812 (AV positives: 10/61 scanned on 06/07/2017 12:42:03)\n File SHA256: 1ea0822bf66a672137d10a51000cc1a1fb1a968a0a2c6e3fdc11eda7346145a0 (AV positives: 57/61 scanned on 06/07/2017 12:07:48)\n File SHA256: 04f3999dc00f44f6d44381cef5f42dc4b43df2bece411042c718dababbc3f18d (AV positives: 58/62 scanned on 06/07/2017 11:47:28)\n File SHA256: c2deff59d182486e6dc4fe6a8eebee4990db08e92861048fc4a12eb1aa4c2fd0 (AV positives: 55/61 scanned on 06/07/2017 11:38:21)\n File SHA256: f413f9c0ae3b75bfe24827cf6f668a1213bfaa74d71e5533a6e07070335f3c0d (AV positives: 56/62 scanned on 06/07/2017 11:34:57)","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Persists itself using auto-execute at a hidden registry location"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":69,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":53,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":53,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["dofoil","smokeloader","sharik"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"5937f2bdaac2ed5d7d861718","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":78,"malware_family":"W32.W.Bagle","contacted_countries":["EU","RUS","USA"],"submit_name":"jun7.exe","analysis_start_time":"2017-06-07T14:35:24+00:00","indicators_count":{"informative":15,"suspicious":14,"malicious":6},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.101.187.176","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"address":"185.159.128.150","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"address":"95.101.187.176","port":443,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}],"dns_resolutions":[{"domain":"preschoolandnursery.co.uk","address":"185.159.128.150","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"domain":"www.visualstudio.com","address":"104.94.40.134","country":"United States","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}],"http_requests":[{"host":"www.visualstudio.com","host_ip":"104.94.40.134:80","url":"/en-us","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /en-us HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: www.visualstudio.com","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"host":"preschoolandnursery.co.uk","host_ip":"185.159.128.150:80","url":"/","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nContent-Length: 63\nHost: preschoolandnursery.co.uk","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}],"processes":[{"pid":2748,"ppid":0,"name":"jun7.exe","command_line":"","sha256":"4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736","normalized_path":"C:\\jun7.exe","uid":"00016117-00002748","icon":"$28"},{"pid":3424,"ppid":2748,"name":"explorer.exe","command_line":"","sha256":"0a8ce026714e03e72c619307bd598add5f9b639cfd91437cb8d9c847bf9f6894","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00016117-00002748","uid":"00018216-00003424","icon":"$29"}],"all_imported_dlls":["user32.dll","shimeng.dll","dhcpcsvc6.dll","rasadhlp.dll","bcrypt.dll","lpk.dll","rpcrt4.dll","sechost.dll","iertutil.dll","nsi.dll","FWPUCLNT.DLL","userenv.dll","dwmapi.dll","imm32.dll","shell32.dll","powrprof.dll","schannel.dll","wininet.dll","cryptbase.dll","dui70.dll","bcryptprimitives.dll","webio.dll","cryptsp.dll","sspicli.dll","kernel32.dll","gdi32.dll","msctf.dll","urlmon.dll","ExplorerFrame.dll","setupapi.dll","wshqos.dll","rsaenh.dll","rpcss.dll","usp10.dll","odbcint.dll","shlwapi.dll","ws2_32.dll","devobj.dll","WSHTCPIP.DLL","profapi.dll","gpapi.dll","KernelBase.dll","dnsapi.dll","uxtheme.dll","secur32.dll","propsys.dll","mswsock.dll","GdiPlus.dll","dhcpcsvc.dll","ntdll.dll","advapi32.dll","apphelp.dll","authz.dll","msasn1.dll","oleaut32.dll","odbctrac.dll","ole32.dll","duser.dll","cfgmgr32.dll","credssp.dll","odbc32.dll","crypt32.dll","winhttp.dll","IPHLPAPI.DLL","slc.dll","winnsi.dll","wship6.dll","ncrypt.dll","msvcrt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"C:\\jun7.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%APPDATA%\\Microsoft\\cubdfdre\\tdiuwjwh.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%APPDATA%\\Microsoft\\cubdfdre","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%APPDATA%\\Microsoft\\cubdfdre\\tdiuwjwh.exe","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"path":"%APPDATA%\\Microsoft\\cubdfdre\\cubdfdre","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\2D1353A4917806928E71099EC17E5508C38DF9F7","sources":[{"report_type":"sandbox","report_id":"5937f2bdaac2ed5d7d861718"}]}]}},"report_ids":{"sandbox_job_ids":["5937f2bdaac2ed5d7d861718"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Ransom_.E2104A91 Sample 4757c2667dc6… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4757c2667dc6…. Malware family: Ransom_.E2104A91. Threat score 78/100. 24/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736"}],["$","meta","4",{"property":"og:title","content":"Malicious Ransom_.E2104A91 Sample 4757c2667dc6… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4757c2667dc6…. Malware family: Ransom_.E2104A91. Threat score 78/100. 24/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4757c2667dc61f0ee30258b226a04ba811a42f3182053aa34ce75e7295b87736"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ransom_.E2104A91 Sample 4757c2667dc6… — Score 78/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4757c2667dc6…. Malware family: Ransom_.E2104A91. Threat score 78/100. 24/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]