26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 4a8759e2c345… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4a8759e2c345…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/26 AV engines flagged this file. 10 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349"],"about":{"@type":"SoftwareApplication","name":"proshuto8.exe","applicationCategory":["peexe","executable"],"identifier":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":21,"total":26},"behavioralIndicators":{"malicious":10,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T89e,Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bfb064701ba5e5ac HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?5e23fe79d91cb5e8 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "GET /CRL/Omniroot2025.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cdp1.public-trust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAt%2BEJA8OEkP%2Bi9nmoehp7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSLIycRsoI3J6zPns4K1aQgAqaqHgQUZ50PIAkMzIo65YJGcmL88cyQ5UACEAG2Yem3HYLmNssdMr3TCFk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Pattern match: "www.microsoft.com" Heuristic match: "GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36Host: checkip.amazonaws.com" Heuristic match: "checkip.amazonaws.com"28:T18df,"" wrote 32 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 52 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 4 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 8 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 1024 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 5120 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 512 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 235008 bytes to a remote process "C:\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe" (Handle: 116) "" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 164) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 164) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 164) "" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 164) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 1024 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 5120 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 512 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 235008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\winapp\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" (Handle: 116) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 32 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 52 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 4 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 8 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 544 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 72 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 22 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 93696 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 24576 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 2064 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 512 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 6144 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 1536 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 21 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 16 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168) "3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe" wrote 48 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 168)29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAd3d3d3d3d3d3d3cAAAAAAH/////////////3AAAAAAB/////////////9wAAAAAAf/////////////cAAAAAAH/////////////3AAAAAAB/////////////9wAAAAAAf/////////////cAAAAAAH/////////////3AAAAAAB/////////////9wAAd3d3f/////////////cAAH///3/////////////3AAB///9/////////////9wAAf///f/////////////cAAH///3Z2ZndmZmZmZmZmAAB///94iIiIiIiIjo6I5gAAf///eP+IiIiIiIiIiOYAAH///3iIiIiIiIiO7u7mAAB///+GZmZmZmZmZmZmZgAAf////////////4cAAAAAAH////////////+HAAAAAAB/////////////hwAAAAAAf////////////4cAAAAAAHiIiIiIiIiIiIiHAAAAAABmZmZmZmZmZmZmZgAAAAAAaP+IiIiIiIiIiOYAAAAAAGj/iIiIiIiIiIjmAAAAAABmdmZmZmZmZmZmZgAAAAAAiIiIiIiIiIiIiI8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAAPAAAADwAAAA8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP/AAAD/wAAA/8AAAP///////////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790579095062,"unified_at":"2026-09-28T07:04:55.062Z","metadata":{"hashes":{"sha256":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","sha1":"778ebd9a16cd54e9a1133df8ab7cd05f5e704bfe","md5":"bd1edfade5d8009d530f5306d9bf8174","sha512":"36561fbad5c85d689a6ed7b528ff83e09ce930bc87caa3e08abd85fa25a1adfe0081df51360737ec3b3e539d990d6148c386f1c8f4757e3565b41525b33d1079","ssdeep":"6144:6YpaRXZLaC04bvUE0KJcibe/xN81000a0MhEYI7k1+1fLil:6YCXZ3v0KGk1Hnx2YkOWfL","ssdeep_chunks":["6144:6YpaRXZ","6144:YpaRXZL","6144:paRXZLa","6144:aRXZLaC","6144:RXZLaC0","6144:XZLaC04","6144:ZLaC04b","6144:LaC04bv","6144:aC04bvU","6144:C04bvUE","6144:04bvUE0","6144:4bvUE0K","6144:bvUE0KJ","6144:vUE0KJc","6144:UE0KJci","6144:E0KJcib","6144:0KJcibe","6144:KJcibe/","6144:Jcibe/x","6144:cibe/xN","6144:ibe/xN8","6144:be/xN81","6144:e/xN810","6144:/xN8100","6144:xN81000","6144:N81000a","6144:81000a0","6144:1000a0M","6144:000a0Mh","6144:00a0MhE","6144:0a0MhEY","6144:a0MhEYI","6144:0MhEYI7","6144:MhEYI7k","6144:hEYI7k1","6144:EYI7k1+","6144:YI7k1+1","6144:I7k1+1f","6144:7k1+1fL","6144:k1+1fLi","6144:1+1fLil","12288:6YpaRXZ","12288:YpaRXZL","12288:paRXZLa","12288:aRXZLaC","12288:RXZLaC0","12288:XZLaC04","12288:ZLaC04b","12288:LaC04bv","12288:aC04bvU","12288:C04bvUE","12288:04bvUE0","12288:4bvUE0K","12288:bvUE0KJ","12288:vUE0KJc","12288:UE0KJci","12288:E0KJcib","12288:0KJcibe","12288:KJcibe/","12288:Jcibe/x","12288:cibe/xN","12288:ibe/xN8","12288:be/xN81","12288:e/xN810","12288:/xN8100","12288:xN81000","12288:N81000a","12288:81000a0","12288:1000a0M","12288:000a0Mh","12288:00a0MhE","12288:0a0MhEY","12288:a0MhEYI","12288:0MhEYI7","12288:MhEYI7k","12288:hEYI7k1","12288:EYI7k1+","12288:YI7k1+1","12288:I7k1+1f","12288:7k1+1fL","12288:k1+1fLi","12288:1+1fLil","6144:6YCXZ3v","6144:YCXZ3v0","6144:CXZ3v0K","6144:XZ3v0KG","6144:Z3v0KGk","6144:3v0KGk1","6144:v0KGk1H","6144:0KGk1Hn","6144:KGk1Hnx","6144:Gk1Hnx2","6144:k1Hnx2Y","6144:1Hnx2Yk","6144:Hnx2YkO","6144:nx2YkOW","6144:x2YkOWf","6144:2YkOWfL"],"imphash":"41a42a8de8e3b08c4f90201d083951ec"},"file_info":{"file_name":"proshuto8.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":381440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1500368635000,"last_seen":1665483218000,"last_multi_scan":1665483218000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":8,"malicious_count":10,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ramnit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1223954","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Emotet.Gen.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crypt.BJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-cb507e73!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Emotet.Gen.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.FUWR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.TrickBot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051418e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Emotet-FAV!BD1EDFADE5D8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Injector.erbgvh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Gen.A4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Trickbot-U","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_TR.DE40D4BB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_TR.DE40D4BB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr25.OSO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Downloader","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.amazonaws.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"107.20.169.151:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\VLock\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36Host: checkip.amazonaws.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00010531-00001604)\n Spawned process \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" (UID: 00012062-00000804)\n Spawned process \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" (UID: 00012898-00001704)\n Spawned process \"svchost.exe\" (UID: 00014068-00002176)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.83768195742","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe\", Handle: 116)\n \"\" is creating a new process (Name: \"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\", Handle: 164)\n \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" is creating a new process (Name: \"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\", Handle: 116)\n \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\svchost.exe\", Handle: 168)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"HTTP/1.1 200 OKDate: Wed, 27 Dec 2017 01:45:35 GMTServer: lighttpd/1.4.41Content-Length: 15Connection: keep-alive188.138.33.220\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe.bin\" claimed CRC 411895 while the actual is CRC 403309","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"IsDebuggerPresent\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n Sleep\n CreateFileA\n GetTickCount\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302\" to virtual address \"0x758B07E4\" (part of module \"USER32.DLL\")\n \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" wrote bytes \"711107027a3b0602ab8b02007f950200fc8c0200729602006cc805001ecd03027d260302\" to virtual address \"0x758B07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ETPRO POLICY External IP Check (checkip.amazonaws.com)\" (SID: 2814787, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/68 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/68 Antivirus vendors marked sample as malicious (85% detection rate)\n 5/11 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"60/76 Antivirus vendors marked spawned process \"\" (PID: 1604) as malicious (classified as \"Trojan.Generic\" with 78% detection rate)\n 60/76 Antivirus vendors marked spawned process \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" (PID: 804) as malicious (classified as \"Trojan.Generic\" with 78% detection rate)\n 60/76 Antivirus vendors marked spawned process \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" (PID: 1704) as malicious (classified as \"Trojan.Generic\" with 78% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$28","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"107.20.169.151\": ...File SHA256: 85c0e8ff841050a8e17ede4fec3c0fc9a449ff4f390aa548e8d1d8734aba0ffd (AV positives: 19/68 scanned on 12/04/2017 04:05:10)\n File SHA256: 417fc0b2f2134ba976ba8da1cbf4a36745a5d332558b8b5fc881eb7978b8edf3 (AV positives: 31/66 scanned on 11/26/2017 00:55:24)\n File SHA256: 3d419a7b060986a076b46f7848e20428500470125276cf22d5d4cddf31f0567c (AV positives: 25/68 scanned on 11/23/2017 23:51:53)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"checkip.amazonaws.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe:Zone.Identifier\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00009662-00002724)\n Spawned process \"\" (UID: 00010531-00001604)\n Spawned process \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" (UID: 00012062-00000804)\n Spawned process \"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" (UID: 00012898-00001704)\n Spawned process \"svchost.exe\" (UID: 00014068-00002176)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00014060-00003836-56104-17-011050EB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014060-00003836-56104-16-01101E6B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014060-00003836-56104-396-0110254F\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014060-00003836-56104-209-01109700\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015872-00001272-59984-17-011050EB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015872-00001272-59984-16-01101E6B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015872-00001272-59984-209-01109700\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015872-00001272-59984-396-0110254F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00014060-00003836-56104-179-011036BC\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015872-00001272-59984-179-011036BC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":41,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Sample not shared"],"sandbox_reports":[{"id":"5a42e4727ca3e12f78505034","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"OTX_4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","analysis_start_time":"2017-12-27T02:42:10+00:00","indicators_count":{"informative":9,"suspicious":8,"malicious":14},"tags":["Multi-Process","Network Traffic","Sample not shared"],"is_in_unified_schema":true},{"id":"596dcdd57ca3e1248b533a73","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM10.1.8FF2.Malware","submit_name":"proshuto8.exe","analysis_start_time":"2017-07-18T09:58:36+00:00","indicators_count":{"informative":8,"suspicious":5,"malicious":10},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"107.20.169.151","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]}],"dns_resolutions":[{"domain":"checkip.amazonaws.com","address":"107.20.169.151","country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Amazon.com, Inc.","registrar_creation_date":"2005-08-18T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]}],"http_requests":[{"host":"checkip.amazonaws.com","host_ip":"107.20.169.151:80","url":"/","method":"GET","response_code":"200","response_phrase":"OK","header":"GET / HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/57.0.2987.133 Safari/537.36\nHost: checkip.amazonaws.com","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}],"processes":[{"pid":2724,"ppid":0,"name":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe","command_line":"","sha256":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","normalized_path":"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe","uid":"00009662-00002724","icon":"$29"},{"pid":1604,"ppid":2724,"name":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe","command_line":"","sha256":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","normalized_path":"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe","parent_uid":"00009662-00002724","uid":"00010531-00001604"},{"pid":804,"ppid":1604,"name":"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe","command_line":"","sha256":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","normalized_path":"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe","parent_uid":"00010531-00001604","uid":"00012062-00000804"},{"pid":1704,"ppid":804,"name":"3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe","command_line":"","sha256":"4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349","normalized_path":"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe","parent_uid":"00012062-00000804","uid":"00012898-00001704"},{"pid":2176,"ppid":1704,"name":"svchost.exe","command_line":"","sha256":"93b2ed4004ed5f7f3039dd7ecbd22c7e4e24b6373b4d9ef8d6e45a179b13a5e8","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00012898-00001704","uid":"00014068-00002176"}],"all_imported_dlls":["msctf.dll","apphelp.dll","IPHLPAPI.DLL","bcrypt.dll","user32.dll","shlwapi.dll","msasn1.dll","clbcatq.dll","taskschd.dll","kernel32.dll","usp10.dll","msvcrt.dll","oleaut32.dll","nsi.dll","ws2_32.dll","wow64win.dll","advapi32.dll","rpcrt4.dll","sspicli.dll","cryptbase.dll","uxtheme.dll","winnsi.dll","ncrypt.dll","ntdll.dll","KernelBase.dll","winhttp.dll","profapi.dll","tzres.dll","wow64cpu.dll","sechost.dll","gdi32.dll","shell32.dll","ole32.dll","userenv.dll","rpcss.dll","crypt32.dll","lpk.dll","dwmapi.dll","webio.dll","wow64.dll","imm32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"path":"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"path":"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"}]},{"path":"%APPDATA%\\winapp","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"C:\\4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"%APPDATA%\\winapp\\3a7648d1b234db111da80736433321e7aac371b4bbae62052500a818c586e238.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\VLock","sources":[{"report_type":"sandbox","report_id":"5a42e4727ca3e12f78505034"},{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]},{"name":"Global\\VLock","sources":[{"report_type":"sandbox","report_id":"596dcdd57ca3e1248b533a73"}]}]}},"report_ids":{"sandbox_job_ids":["5a42e4727ca3e12f78505034","596dcdd57ca3e1248b533a73"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 4a8759e2c345… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4a8759e2c345…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/26 AV engines flagged this file. 10 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 4a8759e2c345… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4a8759e2c345…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/26 AV engines flagged this file. 10 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4a8759e2c345ec222eb91847544432f8bad482c5ccbf73163601a929d697f349"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 4a8759e2c345… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4a8759e2c345…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 21/26 AV engines flagged this file. 10 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]