24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 49e3141b594c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 49e3141b594c…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe"],"about":{"@type":"SoftwareApplication","name":"ORIGINAL SHIPPING DELIVERY.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T969,"--> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. --> true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> --> Windows 10 --> --> Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. --> true --> Enable themes for Windows common controls and dialogs (Windows XP and later) --> " (Indicator: "EnableWindow") in [Source: 00000000-00003980.00000000.67787.0121E000.00000002.mdmp 00000000-00003980.00000000.67792.0121E000.00000002.mdmp]26:T4a1,"ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" "ORIGINALSHIPPINGDELIVERY.exe" trying to access non-existent file "C:\Windows\SysWOW64\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL"27:T48c,Found - (Indicator: "bz2") in Source: 00000000-00003980.00000000.67792.01142000.00000020.mdmp Found - (Indicator: "bz2") in Source: 49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin Found - (Indicator: "des") in Source: 49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin Found - (Indicator: "des") in Source: 00000000-00003980.00000000.67792.0121E000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00003980.00000000.67787.01142000.00000020.mdmp 00000000-00003980.00000000.67792.01142000.00000020.mdmp Found - (Indicator: "bz2") in Source: 00000000-00003980.00000000.67787.01142000.00000020.mdmp 00000000-00003980.00000000.67792.01142000.00000020.mdmp Found - (Indicator: "aes") in Source: 00000000-00003980.00000000.67787.01142000.00000020.mdmp 00000000-00003980.00000000.67792.01142000.00000020.mdmp Found - (Indicator: "des") in Source: 00000000-00003980.00000000.67787.0121E000.00000002.mdmp 00000000-00003980.00000000.67792.0121E000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00003980.00000000.67787.7EFE0000.00000002.mdmp 00000000-00003980.00000000.67792.7EFE0000.00000002.mdmp1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790350640032,"unified_at":"2026-09-25T15:37:20.032Z","metadata":{"hashes":{"sha256":"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe","sha1":"f3ea6476e7c45b2b77fd1cf1b25041e446c10f12","md5":"7c96ba15d734ca18987d3a659bad8270","sha512":"141a655cf8f2484c7793486d702718f4ea1b9263e250daf3f60ec8cdacf51410c69d9a0febafad2f6ca87c649801ddb740a3f91dee2bd322985142cc72e366fc","ssdeep":"12288:bbO8lpXU5ZkXu3CXuY4L9CnpGkSZOg3bPkLKaDeuC8PmUOcoPfmNARdQwoLIPir8:bGCXjEookSHPpaquC8PmUWVR2MP6K","ssdeep_chunks":["12288:bbO8lpX","12288:bO8lpXU","12288:O8lpXU5","12288:8lpXU5Z","12288:lpXU5Zk","12288:pXU5ZkX","12288:XU5ZkXu","12288:U5ZkXu3","12288:5ZkXu3C","12288:ZkXu3CX","12288:kXu3CXu","12288:Xu3CXuY","12288:u3CXuY4","12288:3CXuY4L","12288:CXuY4L9","12288:XuY4L9C","12288:uY4L9Cn","12288:Y4L9Cnp","12288:4L9CnpG","12288:L9CnpGk","12288:9CnpGkS","12288:CnpGkSZ","12288:npGkSZO","12288:pGkSZOg","12288:GkSZOg3","12288:kSZOg3b","12288:SZOg3bP","12288:ZOg3bPk","12288:Og3bPkL","12288:g3bPkLK","12288:3bPkLKa","12288:bPkLKaD","12288:PkLKaDe","12288:kLKaDeu","12288:LKaDeuC","12288:KaDeuC8","12288:aDeuC8P","12288:DeuC8Pm","12288:euC8PmU","12288:uC8PmUO","12288:C8PmUOc","12288:8PmUOco","12288:PmUOcoP","12288:mUOcoPf","12288:UOcoPfm","12288:OcoPfmN","12288:coPfmNA","12288:oPfmNAR","12288:PfmNARd","12288:fmNARdQ","12288:mNARdQw","12288:NARdQwo","12288:ARdQwoL","12288:RdQwoLI","12288:dQwoLIP","12288:QwoLIPi","12288:woLIPir","12288:oLIPir8","24576:bbO8lpX","24576:bO8lpXU","24576:O8lpXU5","24576:8lpXU5Z","24576:lpXU5Zk","24576:pXU5ZkX","24576:XU5ZkXu","24576:U5ZkXu3","24576:5ZkXu3C","24576:ZkXu3CX","24576:kXu3CXu","24576:Xu3CXuY","24576:u3CXuY4","24576:3CXuY4L","24576:CXuY4L9","24576:XuY4L9C","24576:uY4L9Cn","24576:Y4L9Cnp","24576:4L9CnpG","24576:L9CnpGk","24576:9CnpGkS","24576:CnpGkSZ","24576:npGkSZO","24576:pGkSZOg","24576:GkSZOg3","24576:kSZOg3b","24576:SZOg3bP","24576:ZOg3bPk","24576:Og3bPkL","24576:g3bPkLK","24576:3bPkLKa","24576:bPkLKaD","24576:PkLKaDe","24576:kLKaDeu","24576:LKaDeuC","24576:KaDeuC8","24576:aDeuC8P","24576:DeuC8Pm","24576:euC8PmU","24576:uC8PmUO","24576:C8PmUOc","24576:8PmUOco","24576:PmUOcoP","24576:mUOcoPf","24576:UOcoPfm","24576:OcoPfmN","24576:coPfmNA","24576:oPfmNAR","24576:PfmNARd","24576:fmNARdQ","24576:mNARdQw","24576:NARdQwo","24576:ARdQwoL","24576:RdQwoLI","24576:dQwoLIP","24576:QwoLIPi","24576:woLIPir","24576:oLIPir8","12288:bGCXjEo","12288:GCXjEoo","12288:CXjEook","12288:XjEookS","12288:jEookSH","12288:EookSHP","12288:ookSHPp","12288:okSHPpa","12288:kSHPpaq","12288:SHPpaqu","12288:HPpaquC","12288:PpaquC8","12288:paquC8P","12288:aquC8Pm","12288:quC8PmU","12288:uC8PmUW","12288:C8PmUWV","12288:8PmUWVR","12288:PmUWVR2","12288:mUWVR2M","12288:UWVR2MP","12288:WVR2MP6","12288:VR2MP6K"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"ORIGINAL SHIPPING DELIVERY.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":911360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678825121000,"last_seen":1678825207000,"last_multi_scan":1678825207000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["gamarue"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":14,"suspicious_count":9,"malicious_count":3,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Found API related strings"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file has unusual entropy resources"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin\"","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$25","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\".Run\" [Source: 49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin]\n Observed keyword:\".Run\" [Source: 00000000-00003980.00000000.67787.01142000.00000020.mdmp\n 00000000-00003980.00000000.67792.01142000.00000020.mdmp]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 764d0000\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"KERNEL32\" at base 77440000\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 73d30000\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"GDI32.DLL\" at base 76050000\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 74aa0000\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"ADVAPI32.DLL\" at base 75bf0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75990000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"12001300c4cc1e76f4eb530022c31e76@IMM32.DLL\"\n \"18001900a8cc1e76f4eb530037c31e76@IMM32.DLL\"\n \"1400150090cc1e76f4eb53004cc31e76@IMM32.DLL\"\n \"1400150078cc1e76f4eb530061c31e76@IMM32.DLL\"\n \"0d000e0068cc1e76f4eb530076c31e76@IMM32.DLL\"\n \"0d000e0058cc1e76f4eb53008bc31e76@IMM32.DLL\"\n \"0f00100048cc1e76f4eb5300a0c31e76@IMM32.DLL\"\n \"0f00100038cc1e76f4eb5300b5c31e76@IMM32.DLL\"\n \"0d000e0028cc1e76f4eb5300cac31e76@IMM32.DLL\"\n \"0d000e0018cc1e76f4eb5300dfc31e76@IMM32.DLL\"\n \"1300140004cc1e76f4eb5300f4c31e76@IMM32.DLL\"\n \"0a000b00f8cb1e76f4eb530009c41e76@IMM32.DLL\"\n \"0a000b00eccb1e76f4eb53001ec41e76@IMM32.DLL\"\n \"18001900d0cb1e76f4eb530033c41e76@IMM32.DLL\"\n \"18001900b4cb1e76f4eb530048c41e76@IMM32.DLL\"\n \"170018009ccb1e76f4eb53005dc41e76@IMM32.DLL\"\n \"0d000e008ccb1e76f4eb530072c41e76@IMM32.DLL\"\n \"1300140078cb1e76f4eb530087c41e76@IMM32.DLL\"\n \"080009006ccb1e76f4eb53009cc41e76@IMM32.DLL\"\n \"1100120058cb1e76f4eb5300b1c41e76@IMM32.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin\" file has an entrypoint instructions - \"jmp\tdword ptr [0x402000],sub\tdword ptr [edi + ecx*4 - 0x3e], ebx,cmc\t,sub\tah, bl,aas\t,sub\tdword ptr [edi + ecx*4 - 0x3e], ebx,cmc\t,sub\tah, cl,aas\t,jnp\t0x4dc056,scasb\tal, byte ptr es:[edi],inc\tedi,loope\t0x4dc0c0,les\tedi, ptr [edi],mov\teax, 0x51eb851e,mov\teax, 0x1eb83fbe,test\tebx, ebp,push\tecx,mov\teax, 0x3fae,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,lcall\t0xb999:0x99999999,aas\t,or\tdl, bh,mov\tdword ptr [0xc70a3d70], eax,aas\t,lcall\t0xd999:0x99999999,aas\t,lcall\t0xc999:0x99999999,aas\t,jnp\t0x4dc09e,scasb\tal, byte ptr es:[edi],inc\tedi,loope\t0x4dc108,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"\n \"ORIGINALSHIPPINGDELIVERY.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \"ORIGINALSHIPPINGDELIVERY.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \"ORIGINALSHIPPINGDELIVERY.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \"ORIGINALSHIPPINGDELIVERY.exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$26","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.local\"\n \"ORIGINALSHIPPINGDELIVERY.exe\" trying to access non-existent file \"C:\\Windows\\SysWOW64\\MSCOREE.DLL.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"\n Heuristic match: \"\\=.Lr\"\n Pattern match: \"http://schemas.openxmlformats.org/markup-compatibility/2006\"\n Heuristic match: \"u/.dm\"\n Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\"\n Heuristic match: \"x6.fR\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc\n .reloc with unusual entropies 7.60174547657\n 7.5578555162\n 0.101910425663","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"45/69 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe.bin\" has resource with unusual entropy \"RT_ICON:7.95903864835\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"System.Collections.Generic.List`1>::get_Count() at 7c96ba15d734ca18987d3a659bad8270-600000c-Form1~tabControl1_KeyDown\n System.Collections.Generic.List`1>::Clear() at 7c96ba15d734ca18987d3a659bad8270-6000009-Form1~button1_Click\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at 7c96ba15d734ca18987d3a659bad8270-600000f-Form1~InitializeComponent\n System.Collections.Generic.List`1>::get_Count() at 7c96ba15d734ca18987d3a659bad8270-600000b-Form1~linkLabel2_LinkClicked\n System.Collections.Generic.List`1>::get_Item(System.Int32) at 7c96ba15d734ca18987d3a659bad8270-6000008-Form1~viewData","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"1.2.0.0\"\n \"16.0.0.0\"\n \"4.0.0.0\"\n Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"\n Potential IP \"1.0.0.0\" found in string \"MyApplication.app,version=\"1.0.0.0\"C:\\ORIGINALSHIPPINGDELIVERY.exe\"\n Potential IP \"1.0.0.0\" found in string \"\"\n Potential IP \"6.0.0.0\" found in string \"version=\"6.0.0.0\"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" wrote bytes \"db4de77300000000\" to virtual address \"0x01142000\" (part of module \"ORIGINALSHIPPINGDELIVERY.EXE\")\n \"ORIGINALSHIPPINGDELIVERY.exe\" wrote bytes \"7111a6017a3ba501ab8b02007f950200fc8c0200729602006cc805001ecda2017d26a201\" to virtual address \"0x761E07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ORIGINALSHIPPINGDELIVERY.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"45/69 Antivirus vendors marked sample as malicious (65% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":26,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["gamarue"],"sandbox_reports":[{"id":"6410d68ce7b811eb290456e0","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"HEUR:Backdoor.MSIL.Androm","submit_name":"ORIGINAL SHIPPING DELIVERY.exe","analysis_start_time":"2023-03-14T20:18:21+00:00","indicators_count":{"informative":14,"suspicious":9,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}],"processes":[{"pid":3980,"ppid":0,"name":"ORIGINALSHIPPINGDELIVERY.exe","command_line":"","sha256":"49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe","normalized_path":"C:\\ORIGINALSHIPPINGDELIVERY.exe","uid":"00000000-00003980","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB60lEQVR4XrWWzUrDQBSF+3aCuHDjYxQU1GdwUxddVJu0oLgQulE3XbkuKrVtYp1KFdwKbhTsnwjRSbkyOTeTmWnTAx8YO/eck0nsWCgsqVowiPB3K1M9fIpswLmlRKZeT7AgHeoc+jkLzV1BP2v54YCZLUrlLnArggZ5gTla4WBeYE6qcAj5GI+jr+k0ld7bO1uP1EJNEVyInItnFqgDZ9PA/Fi4iKC7/iluMjCcuBq+Mh+ifNOzL0B3jsE2JdCLKDabyQK4QIXM1CD6OS6wsxXNagcs3FRCYiygvnCJULrzySRRbG19I0YtcNofMl/rAqrRWHTY1quPgMKxgG4XvECYHwMaSabXl9pn71JAog3OKkBgAQr/HI3YWvQlfLkLfsYph0Y6srY/q0Cp1creBTTC0O3dPWO4roDfXfAdoPBQCKtwXYF6qPwnxT+cI7/b0UwtIalUPfaZOXyOsYAEDYnZyWHiWr6U36X9xLV1AVMRDFdDJLOzcnw9ehGJP1H00QaTcCFx8XewYLgJ9FDxgj4vgYvSwBAdOJcG5v8LFyLyux0DcwkmHXX6bCgvMEsrHMwLzDEKDRYFfZ2EZq6gn7OkiXfbjRqNBjPXIeeO7x/yKaCKAuRBogb6wWNUV05VnFuZ5HlebbeXCvwFw6yJeE/6978AAAAASUVORK5CYII="}],"all_imported_dlls":["kernel32.dll","msvcrt.dll","wow64win.dll","wow64cpu.dll","mscoree.dll","sechost.dll","usp10.dll","oleaut32.dll","user32.dll","KernelBase.dll","cryptbase.dll","ole32.dll","imm32.dll","ntdll.dll","nsi.dll","fltLib.dll","wow64.dll","sspicli.dll","gdi32.dll","msctf.dll","ws2_32.dll","api-ms-win-core-synch-l1-2-0.dll","mscoreei.dll","advapi32.dll","rpcrt4.dll","lpk.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6410d68ce7b811eb290456e0"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6410d68ce7b811eb290456e0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 49e3141b594c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 49e3141b594c…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 49e3141b594c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 49e3141b594c…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/49e3141b594c7d20af04fe67372b5880cb5e9c9b83d680882c2c69de997dbcbe"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 49e3141b594c… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 49e3141b594c…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]