21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4a7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Dridex Sample 477887b3807d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 477887b3807d…. Malware family: Trojan.Dridex. Threat score 100/100. 23/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892","keywords":["Malicious","Trojan.Dridex","malware analysis","sandbox report","threat intelligence","477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892"],"about":{"@type":"SoftwareApplication","name":"e0d24cac5fb16c737f5f016e54292388 o97i76u54.exe.x","applicationCategory":["peexe","executable"],"identifier":"477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Dridex","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T468,"" (Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6", Key: "BLOB") "" (Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES\7D7F4414CCEF168ADF6BF40753B5BECD78375931", Key: "BLOB")23:T4cd,"" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" created file "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Cookies" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" created file "C:\Windows\system32\rsaenh.dll" "" created file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "" created file "C:\Windows\system32\en-US\WINHTTP.dll.mui" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\E9S7QCHY\182_93_220_146[1].txt" "" created file "C:\Users\PSPUBWS\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D0YDZTO5\182_93_220_146[1].txt"24:Tb65,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")25:T8f9,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS")26:T491,"" loaded module "NORMALIZ.DLL" at base 751E0000 "" loaded module "CRYPT32.DLL" at base 769C0000 "" loaded module "USERENV.DLL" at base 74C30000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76500000 "" loaded module "WINTRUST.DLL" at base 76990000 "" loaded module "WININET.DLL" at base 75080000 "" loaded module "RASAPI32.DLL" at base 70A80000 "" loaded module "RTUTILS.DLL" at base 74910000 "" loaded module "RASMAN.DLL" at base 74730000 "" loaded module "PROFAPI.DLL" at base 74C20000 "" loaded module "SHLWAPI.DLL" at base 75360000 "" loaded module "SENSAPI.DLL" at base 70A70000 "" loaded module "RPCRT4.DLL" at base 76010000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76500000 "" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76500000 "" loaded module "CRYPTBASE.DLL" at base 74FA0000 "" loaded module "C:\WINDOWS\SYSTEM32\NLAAPI.DLL" at base 7494000027:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=28:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790397634771,"unified_at":"2026-09-26T04:40:34.771Z","metadata":{"hashes":{"sha256":"477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892","sha1":"47360b8ded32d673957e44a29141509859eb36a0","md5":"e0d24cac5fb16c737f5f016e54292388","sha512":"171e13ea274c05ea035a8a1d0bd9c08b8411f3babd608bc58b5e28024aa710f6f0bbd4b91bf7d870f6d4cc52c20ea3f303ff46a51fd972f423850613e6751677","ssdeep":"3072:Tap76CjhsjG+EGg+gHMgIFrDavopAwh/:TCEjDg+YMgUc5wh","ssdeep_chunks":["3072:Tap76Cj","3072:ap76Cjh","3072:p76Cjhs","3072:76Cjhsj","3072:6CjhsjG","3072:CjhsjG+","3072:jhsjG+E","3072:hsjG+EG","3072:sjG+EGg","3072:jG+EGg+","3072:G+EGg+g","3072:+EGg+gH","3072:EGg+gHM","3072:Gg+gHMg","3072:g+gHMgI","3072:+gHMgIF","3072:gHMgIFr","3072:HMgIFrD","3072:MgIFrDa","3072:gIFrDav","3072:IFrDavo","3072:FrDavop","3072:rDavopA","3072:DavopAw","3072:avopAwh","3072:vopAwh/","6144:Tap76Cj","6144:ap76Cjh","6144:p76Cjhs","6144:76Cjhsj","6144:6CjhsjG","6144:CjhsjG+","6144:jhsjG+E","6144:hsjG+EG","6144:sjG+EGg","6144:jG+EGg+","6144:G+EGg+g","6144:+EGg+gH","6144:EGg+gHM","6144:Gg+gHMg","6144:g+gHMgI","6144:+gHMgIF","6144:gHMgIFr","6144:HMgIFrD","6144:MgIFrDa","6144:gIFrDav","6144:IFrDavo","6144:FrDavop","6144:rDavopA","6144:DavopAw","6144:avopAwh","6144:vopAwh/","3072:TCEjDg+","3072:CEjDg+Y","3072:EjDg+YM","3072:jDg+YMg","3072:Dg+YMgU","3072:g+YMgUc","3072:+YMgUc5","3072:YMgUc5w","3072:MgUc5wh"],"imphash":"4487de4508a88261b99d2b8d4e42a7a6"},"file_info":{"file_name":"e0d24cac5fb16c737f5f016e54292388 o97i76u54.exe.x","file_type":["peexe","executable"],"file_type_id":"exe","file_size":157184,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297105000,"last_seen":1677365370000,"last_multi_scan":1677365370000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":20,"malicious_count":9,"total":39},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.tney","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.SGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.324710","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BOIP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dridex.RFNE-8390","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BOIP (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.Y trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d6ae11 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Dridex.n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.dyvkux","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-JA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_DRIDEX.CP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_DRIDEX.CP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt5.NFZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.338","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Dridex","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"182.93.220.146:4438\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6B14.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6B73.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6D77.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6D78.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab8DC3.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar8DC4.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\7d0be6700f9e5e947a789577596f6ff5\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"$22","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\", Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Explorer.EXE\" (UID: 00011764-00001488)\n Spawned process \"svchost.exe\" with commandline \"-k NetworkService\" (UID: 00011765-00001140)\n Spawned process \"taskhost.exe\" (UID: 00012252-00001460)\n Spawned process \"taskhost.exe\" (UID: 00012292-00002288)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df\" has type \"data\"\n \"182_93_220_146[1].txt\" has type \"data\"\n \"Tar8DC4.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab6B14.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Cab6D77.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Cab8DC3.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar6B73.tmp\" has type \"data\"\n \"Tar6D78.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"nb733\n v134v1 with unusual entropies 7.19729068975\n 7.04194358251","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$23","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00008682-00003696-18598-77-00C87E56\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00008682-00003696-18598-203-00C85FB0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00008682-00003696-18598-78-00C87CF3","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6B14.tmp\" for deletion\n \"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6B73.tmp\" for deletion\n \"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6D77.tmp\" for deletion\n \"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6D78.tmp\" for deletion\n \"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab8DC3.tmp\" for deletion\n \"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar8DC4.tmp\" for deletion\n \"C:\\o97i76u54.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\182_93_220_146[1].txt\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6B14.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6B73.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab6D77.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar6D78.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab8DC3.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar8DC4.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\182_93_220_146[1].txt\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$24","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 186051 does not match actual CRC 171994","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateDirectoryExA\n DeviceIoControl\n GetModuleHandleA\n GetProcAddress\n LoadLibraryExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"77399a7779a89e77be729e77d62d9e771de2997705a29e77c8689d7757d1a477bee39977616f9e7768419c7700509c7700000000ad37ad778b2dad77b641ad7700000000\" to virtual address \"0x75511000\" (part of module \"WSHIP6.DLL\")\n \"\" wrote bytes \"92e6997779a89e77be729e77d62d9e771de2997705a29e77bee39977616f9e7768419c7700509c7700000000ad37ad778b2dad77b641ad7700000000\" to virtual address \"0x74E41000\" (part of module \"WSHTCPIP.DLL\")\n \"\" wrote bytes \"40539c7758589d77186a9d77653c9e770000000000bf47770000000056cc4777000000007cca4777000000003768b6756a2c9e77d62d9e77000000002069b6750000000029a6477700000000a48db67500000000f70e477700000000\" to virtual address \"0x77071000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Wed Feb 11 09:06:56 1998","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/54 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\Windows\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00011764-00001488)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 182.93.220.146 on port 4438","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$25","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":".text0","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00008682-00003696)\n Spawned process \"Explorer.EXE\" (UID: 00011764-00001488)\n Spawned process \"svchost.exe\" with commandline \"-k NetworkService\" (UID: 00011765-00001140)\n Spawned process \"taskhost.exe\" (UID: 00012252-00001460)\n Spawned process \"taskhost.exe\" (UID: 00012292-00002288)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$26","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlComputeCrc32@ntdll.dll\"\n \"InternetConnectW@wininet.dll\"\n \"IdnToAscii@Normaliz.dll\"\n \"HttpOpenRequestW@wininet.dll\"\n \"CertOpenStore@CRYPT32.dll\"\n \"GetUserProfileDirectoryW@USERENV.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"WinVerifyTrust@wintrust.dll\"\n \"WTHelperProvDataFromStateData@wintrust.dll\"\n \"WTHelperGetProvSignerFromChain@wintrust.dll\"\n \"CertSelectCertificateChains@CRYPT32.dll\"\n \"CertFreeCertificateChainList@CRYPT32.dll\"\n \"InternetQueryOptionW@wininet.dll\"\n \"InternetSetOptionW@wininet.dll\"\n \"HttpSendRequestW@wininet.dll\"\n \"RasEnumEntriesW@RASAPI32.dll\"\n \"RasConnectionNotificationW@RASAPI32.dll\"\n \"TraceRegisterExA@rtutils.dll\"\n \"TracePrintfExA@rtutils.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00173390-00002656-774801AA-180641\n LookupAccountNameLocalW@SECHOST.DLL at 00173390-00002656-774801AA-193243","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00173390-00002656-774801AA-180286","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00173390-00002656-774801AA-180159","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00173390-00002656-774801AA-183264","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":109,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"564db1630e316dc15e4eaba2","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:DangerousObject.Multi","contacted_countries":["THA"],"submit_name":"o97i76u54.exe","analysis_start_time":"2015-11-19T05:24:47+00:00","indicators_count":{"informative":7,"suspicious":26,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"564da9220e316de66ea983fc","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:DangerousObject.Multi","contacted_countries":["THA"],"submit_name":"o97i76u54.exe","analysis_start_time":"2015-11-19T05:29:49+00:00","indicators_count":{"informative":7,"suspicious":22,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"564da9220e316de66ea983fa","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"ERROR","error_type":"Failed to save report to webservice","verdict":"undetected","threat_score":100,"malware_family":"UDS:DangerousObject.Multi","contacted_countries":["THA"],"submit_name":"e0d24cac5fb16c737f5f016e54292388 o97i76u54.exe.x","analysis_start_time":"2015-11-19T12:00:32+00:00","indicators_count":{"informative":8,"suspicious":27,"malicious":11},"is_in_unified_schema":false}],"network_activity":{"contacted_hosts":[{"address":"182.93.220.146","port":4438,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}],"dns_resolutions":null,"http_requests":[{"host":"","host_ip":"192.168.56.10:49161","url":"","method":"","response_code":"304","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}],"processes":[{"pid":3696,"ppid":0,"name":"o97i76u54.exe","command_line":"","normalized_path":"","uid":"00008682-00003696","icon":"$27"},{"pid":1488,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00011764-00001488"},{"pid":1140,"ppid":0,"name":"svchost.exe","command_line":"-k NetworkService","normalized_path":"","uid":"00011765-00001140","icon":"$28"},{"pid":1460,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00012252-00001460"},{"pid":2288,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00012292-00002288"}],"all_imported_dlls":["crypt32.dll","msasn1.dll","cryptbase.dll","winhttp.dll","msctf.dll","iertutil.dll","dnsapi.dll","rasapi32.dll","webio.dll","oleaut32.dll","profapi.dll","ntmarta.dll","winnsi.dll","FWPUCLNT.DLL","psapi.dll","user32.dll","advapi32.dll","sechost.dll","dhcpcsvc6.dll","kernel32.dll","lpk.dll","nsi.dll","userenv.dll","nlaapi.dll","NapiNSP.dll","bcrypt.dll","gdi32.dll","bcryptprimitives.dll","cfgmgr32.dll","shell32.dll","rasman.dll","dhcpcsvc.dll","setupapi.dll","usp10.dll","urlmon.dll","ws2_32.dll","normaliz.dll","wintrust.dll","wship6.dll","cabinet.dll","wininet.dll","rtutils.dll","winrnr.dll","credssp.dll","cryptnet.dll","rpcrt4.dll","sspicli.dll","KernelBase.dll","imm32.dll","rsaenh.dll","ntdll.dll","shlwapi.dll","Wldap32.dll","IPHLPAPI.DLL","cryptsp.dll","pnrpnsp.dll","wshqos.dll","ncrypt.dll","ole32.dll","SensApi.dll","WSHTCPIP.DLL","devrtl.dll","devobj.dll","comctl32.dll","schannel.dll","mswsock.dll","secur32.dll","rasadhlp.dll","gpapi.dll","msvcrt.dll","Cabinet.dll","USP10.dll","CRYPTBASE.dll","USER32.dll","MSCTF.dll","Normaliz.dll","wshtcpip.dll","GPAPI.dll","ws2_32.DLL","NSI.dll","KERNELBASE.dll","USERENV.dll","napinsp.dll","dhcpcsvc.DLL","GDI32.dll","RPCRT4.dll","schannel.DLL","WINHTTP.dll","OLEAUT32.dll","dnsapi.DLL","DEVRTL.dll","ADVAPI32.dll","SETUPAPI.dll","CRYPT32.dll","CFGMGR32.dll","NLAapi.dll","SHLWAPI.dll","SspiCli.dll","IMM32.DLL","iphlpapi.DLL","DEVOBJ.dll","RASAPI32.dll","dhcpcsvc6.DLL","VERSION.dll","sensapi.dll","PSAPI.DLL","CRYPTSP.dll","LPK.dll","fwpuclnt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"182_93_220_146[1].txt","sha256":"a3bb3beb47c0595b4de025614041cafc15ac3ce64b31e64d52710ba362e612cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Tar6B73.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"Tar6D78.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"Tar8DC4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"698f9376dd623caf7049d868268d0d8e9825587ab24a7700088c7f5b7f81fe7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Cab6B14.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"Cab6D77.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"Cab8DC3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"c1ffecf3241ed45fdd656ab4d16adba5c7c1d784fabbc433dcb81ec7e68ec6c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"CabC682.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"CabC7CC.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"CabDED1.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"TarC683.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"TarC7CD.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"TarDED2.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"SCHEDLGU.TXT","sha256":"94081da35c2f1c5eb631c35c9ec825fdbdc2b9754ebc83eaf1709e6a14d251ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%TEMP%\\Cab6B14.tmp","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%TEMP%\\Cab6D77.tmp","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%TEMP%\\Cab8DC3.tmp","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\182_93_220_146[1].txt","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\YB8HQDNM\\182_93_220_146[1].txt","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\STFGKOG5\\182_93_220_146[1].txt","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"},{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\O97I76U54_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\7d0be6700f9e5e947a789577596f6ff5","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"564db1630e316dc15e4eaba2"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"Global\\9933ce7a5af99f2ca2677f80ee4aeac2","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"564da9220e316de66ea983fc"}]}]}},"report_ids":{"sandbox_job_ids":["564db1630e316dc15e4eaba2","564da9220e316de66ea983fc"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Dridex Sample 477887b3807d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 477887b3807d…. Malware family: Trojan.Dridex. Threat score 100/100. 23/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Dridex Sample 477887b3807d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 477887b3807d…. Malware family: Trojan.Dridex. Threat score 100/100. 23/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/477887b3807dbeff838f81ef7ad24ab27402dd2835e945bead4379b99b9cf892"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Dridex Sample 477887b3807d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 477887b3807d…. Malware family: Trojan.Dridex. Threat score 100/100. 23/28 AV engines flagged this file. 9 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]