26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T41d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 4cbd60489de6… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 4cbd60489de6…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412","keywords":["malware analysis","sandbox report","threat intelligence","4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412"],"about":{"@type":"SoftwareApplication","name":"4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412","applicationCategory":["peexe","64bits","executable"],"identifier":"4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T93c,file/memory contains long string with (Indicator: "base64"; Source: "sample.bin"), Found string "base64)" (Indicator: "base64"; Source: "sample.bin"), Found string "BASE64" (Indicator: "base64"; Source: "sample.bin"), Found string "base64r" (Indicator: "base64"; Source: "sample.bin"), Found string " b2a_base64" (Indicator: "base64"; Source: "sample.bin"), Found string "email.base64mimer~" (Indicator: "base64"; Source: "sample.bin"), Found string "InvalidBase64LengthDefect)" (Indicator: "base64"; Source: "sample.bin"), Found string "base64r " (Indicator: "base64"; Source: "sample.bin"), Found string "z6Return the length of s when it is encoded with base64." (Indicator: "base64"; Source: "sample.bin"), Found string " base64mimer\" (Indicator: "base64"; Source: "sample.bin"), Found string "base64" (Indicator: "base64"; Source: "sample.bin"), Found string "base64_codec" (Indicator: "base64"; Source: "sample.bin"), Found string " encode_base64r " (Indicator: "base64"; Source: "sample.bin"), Found string " a2b_base64z" (Indicator: "base64"; Source: "sample.bin"), file/memory contains long string with (Indicator: "zipfile"; Source: "sample.bin"), Found string "Encode a single header line with Base64 encoding in a given charset. charset names the character set to use to encode the header. It defaults to iso-8859-1. Base64 encoding is defined in RFC 2045. r " (Indicator: "base64"; Source: "sample.bin"), Found string "InvalidBase64CharactersDefect" (Indicator: "base64"; Source: "sample.bin"), Found string " b64decoder" (Indicator: "b64decode"; Source: "sample.bin"), Found string "uC:/Users/runneradmin/AppData/Local/pypa/cibuildwheel/Cache/nuget-cpython/python.3.13.16/tools/Lib/email/base64mime.pyr" (Indicator: "base64"; Source: "sample.bin"), Found string "zipfiler" (Indicator: "zipfile"; Source: "sample.bin"), Found string "InvalidBase64PaddingDefect" (Indicator: "base64"; Source: "sample.bin"), Found string "zN Workaround for `zipfile.Path.is_file` returning true for non-existent paths. )" (Indicator: "zipfile"; Source: "sample.bin"), Found string "Decode a raw base64 string, returning a bytes object. This function does not parse a full MIME header value encoded with base64 (like =?iso-8859-1?b?bmloISBuaWgh?=) -- please use the high level email.header class for that functionality. z" (Indicator: "base64"; Source: "sample.bin")28:T2a01,Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp865.py", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/mac_latin2.py", Pattern match: "https://github.com/user-attachments/assets/4a73b39e-2503-4fd9-a810-420676c9e557", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/koi8_u.py", Heuristic match: "traversable.name", Pattern match: "https://github.com/yt-dlp/yt-dlp", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1140.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1251.py", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_3.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp856.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp775.py", Heuristic match: "zc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/mac_turkish.py", Heuristic match: "c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/email/_header_value_parser.py", Pattern match: "https://github.com/oop7/ytsage.git", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/utf_7.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp874.py", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/undefined.py", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_14.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp862.py", Pattern match: "https://img.shields.io/badge/python-3.11+-1f2937?style=for-the-badge&logo=python&logocolor=white", Heuristic match: "{c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/mac_cyrillic.py", Heuristic match: "calculate the amount of width space the given source code segment might take if it were to be displayed on a fixed width output device. supports wide unicode characters and emojis.nr", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_9.py", Heuristic match: "zaa more or less complete user-defined wrapper around list objects.nc", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp863.py", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/email/_encoded_words.py", Pattern match: "http://code.activestate.com/recipes/577452-a-memoize-decorator-for-instance-methods/", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/hp_roman8.py", Heuristic match: "z8a finder for extension modules of packages in zip files.nc", Heuristic match: "|c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/importlib/resources/abc.py", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_5.py", Pattern match: "https://img.shields.io/github/v/release/oop7/ytsage?label=download%20latest%20release&style=for-the-badge&color=2ea44f&logo=github", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/utf_16_le.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp866.py", Heuristic match: "kc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/struct.py", Pattern match: "https://www.youtube.com/watch?v=dqw4w9wgxcq", Heuristic match: "{c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/mac_romanian.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1257.py", Heuristic match: "c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/importlib/resources/readers.py", Pattern match: "https://img.shields.io/badge/macos-arm64%20dmg-000000?style=for-the-badge&logo=apple&logocolor=white", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_16.py", Pattern match: "https://github.com/bastik-1001", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp860.py", Heuristic match: "vc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/tis_620.py", Pattern match: "https://img.shields.io/badge/platform-cross--platform-1f2937?style=for-the-badge&logo=github&logocolor=white", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp437.py", Pattern match: "https://python-markdown.github.io/", Heuristic match: "vc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/aliases.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1254.py", Heuristic match: "c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/importlib/metadata/_functools.py", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_7.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp861.py", Pattern match: "https://github.com/sponsors/oop7", Heuristic match: "rc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/oem.py", Pattern match: "https://github.com/oop7/ytsage/stargazers", Heuristic match: "c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/importlib/resources/_functional.py", Heuristic match: "rc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/importlib/abc.py", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_13.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp424.py", Pattern match: "https://github.com/oop7/ffmpeg-install-guide", Pattern match: "https://t.me/ytsage_official", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/collections/__init__.py", Heuristic match: "}c:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/importlib/metadata/_text.py", Pattern match: "baz.zip/inner_dir", Heuristic match: "initialize the startup script.nr", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_2.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1252.py", Pattern match: "https://github.com/oop7", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp869.py", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/mac_farsi.py", Pattern match: "https://img.shields.io/badge/linux-appimage-fcc624?style=for-the-badge&logo=linux&logocolor=black", Heuristic match: "yc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_15.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1256.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/utf_16.py", Heuristic match: "new chainmap from maps[1:].ru", Heuristic match: "*src/freeze_core/initscripts/__startup__.py", Heuristic match: "multiplexedpath.name", Heuristic match: "xc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/iso8859_1.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1125.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/utf_32.py", Heuristic match: "rc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/email/message.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1026.py", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp1250.py", Pattern match: "dkuug.dk/i18n/charmaps/hp-roman8", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/email/feedparser.py", Heuristic match: "nc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/traceback.py", Pattern match: "https://img.shields.io/badge/windows-exe-0078d6?style=for-the-badge&logo=windows&logocolor=white", Heuristic match: "uc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/kz1048.py", Heuristic match: "tc:/users/runneradmin/appdata/local/pypa/cibuildwheel/cache/nuget-cpython/python.3.13.16/tools/lib/encodings/cp855.py"29:T1f90," Screenshots

YTSage Demo


Download Settings	Playlist Download

Audio Format	Custom Options

" (Indicator: "github.com"), "

" (Indicator: "github.com"), " Run with Docker *Run YTSage in a browser without installing Python, Qt, or FFmpeg on the host.* Docker Desktop is required on Windows and macOS. Docker Engine with Docker Compose is supported on Linux. ##### 1. Clone the repository ```bash git clone https://github.com/oop7/YTSage.git cd YTSage ``` ##### 2. Start YTSage ```bash docker compose up -d ``` Open [http://localhost:3000](http://localhost:3000) in a browser. YTSage runs as a browser-streamed desktop inside the container. Downloaded files are saved to the host's `downloads` folder. Settings and history are saved in the `config` folder. ##### Docker lifecycle commands ```bash # Stop YTSage docker compose down # Start it again later docker compose up -d # Rebuild after changing the application or Docker files docker compose build docker compose up -d --force-recreate ``` For more Docker details, see the [Docker guide](docker/README.md). --- ### " (Indicator: "github.com"), "

[![Python 3.11+](https://img.shields.io/badge/python-3.11+-1f2937?style=for-the-badge&logo=python&logoColor=white)](https://www.python.org/downloads/) [![PyPI Downloads](https://img.shields.io/pepy/dt/ytsage?color=1f2937&style=for-the-badge&label=downloads&logo=python&logoColor=white)](https://pepy.tech/project/ytsage) [![GitHub Downloads](https://img.shields.io/github/downloads/oop7/YTSage/total?color=1f2937&style=for-the-badge&label=downloads&logo=github&logoColor=white)](https://github.com/oop7/YTSage/releases) [![Telegram Channel](https://img.shields.io/badge/Telegram-YTSage--Official-26A5E4?style=for-the-badge&logo=telegram&logoColor=white)](https://t.me/YTsage_official) [![License: MIT](https://img.shields.io/badge/License-MIT-1f2937?style=for-the-badge&logo=opensource&logoColor=white)](https://opensource.org/" (Indicator: "github.com"), " Download the App (Easiest Method) *If you just want to use YTSage and don't know what Python is, start here* [![Download Latest Release](https://img.shields.io/github/v/release/oop7/YTSage?label=Download%20Latest%20Release&style=for-the-badge&color=2ea44f&logo=github)](https://github.com/oop7/YTSage/releases/latest) Simply download the pre-built installer for your operating system: #### " (Indicator: "github.com"), " Acknowledgments

A big thanks to everyone who contributed to this project by opening an issue to suggest an improvement or report a bug

Special thanks to @bastik-1001 and @dj23me for being the first and major donors supporting this project " (Indicator: "github.com"), "licenses/MIT) [![Supported Platforms](https://img.shields.io/badge/platform-cross--platform-1f2937?style=for-the-badge&logo=github&logoColor=white)](https://github.com/oop7/YTSage/releases) [![GitHub Stars](https://img.shields.io/github/stars/oop7/YTSage?color=c90000&style=for-the-badge&logo=github&logoColor=white)](https://github.com/oop7/YTSage/stargazers) [![PyPI version](https://img.shields.io/pypi/v/ytsage?color=c90000&style=for-the-badge&logo=pypi&logoColor=white)](https://pypi.org/project/ytsage/) [![GitHub Sponsors](https://img.shields.io/github/sponsors/oop7?color=c90000&style=for-the-badge&logo=githubsponsors&logoColor=white)](https://github.com/sponsors/oop7) **Modern YouTube downloader with a clean PySide6 interface.** Download videos in any quality, extract audio, fetch subtitles, and more. ### " (Indicator: "github.com"), "

Core Components
yt-dlp	Download Engine
FFmpeg	Media Processing
Deno	Runtime for yt-dlp plugins
Libraries & Frameworks
PySide6	GUI Framework
Pillow	Image Processing
requests	HTTP Requests
packaging	Version/Package Management
markdown	Markdown Rendering
loguru	Logging
Assets & Contributors
@bastik-1001	First & Major Donor Support
New Notification 09 by Universfield	Notification Sound
viru185	Code Contributor

## " (Indicator: "github.com"), " Sponsor If YTSage saves you time, please consider sponsoring the project. Sponsoring helps cover development time, testing across all platforms, and future improvements. - GitHub Sponsors: https://github.com/sponsors/oop7 - Buy Me a Coffee: https://www.buymeacoffee.com/oop7 - Direct bank transfer / SWIFT: Contact me via email at [`oop7_support@proton.me`](mailto:oop7_support@proton.me) [![Sponsor YTSage](https://img.shields.io/badge/Sponsor-YTSage-EA4AAA?style=for-the-badge&logo=github&logoColor=white)](https://github.com/sponsors/oop7) ## " (Indicator: "github.com"), " Star History

[![Star History Chart](./branding/svg/star-history-dark.svg)](https://github.com/oop7/YTSage/stargazers)

## " (Indicator: "github.com"), " **Awesome Feature:** If you install via pip on **Windows**, YTSage will automatically detect and help set up FFmpeg for you *(macOS and Linux users can follow our easy **[FFmpeg Installation Guide](https://github.com/oop7/ffmpeg-install-guide)**)* ```bash pip install --pre ytsage ```

" (Indicator: "github.com"), " Manual Source Installation (Developer) *Run YTSage directly from the source code.*

View manual installation steps

#### 1. Clone the repository ```bash git clone https://github.com/oop7/YTSage.git cd YTSage ``` #### 2. Install dependencies **" (Indicator: "github.com"), " by [oop7](https://github.com/oop7) " (Indicator: "github.com")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793135764329,"unified_at":"2026-10-27T21:16:04.329Z","metadata":{"hashes":{"sha256":"4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412","sha1":"f0f38594d3d69f90832e0fef0dcbd6c7b461980a","md5":"ecc2bed944ffa41186c82c4d3495175a"},"file_info":{"file_name":"4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1714176,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793135756000,"last_seen":1793135757000,"last_multi_scan":1793135757000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":12,"suspicious_count":0,"malicious_count":0,"total":12},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$27","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"null addr-spec in angle-addrz*obsolete route specification in angle-addrz.expected addr-spec or obs-route but found '{}'z\"missing trailing '>' on angle-addr)\nr8\" (Indicator: \"route\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"\nz3(?P--)?(?P[ \\t]*)(?P\\r\\n|\\r|\\n)?$c\" (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\", Found HTTPS url \"https://ffmpeg.org\", Found HTTPS url \"https://deno.com\", Found HTTPS url \"https://wiki.qt.io\", Found HTTPS url \"https://python\", Found HTTPS url \"https://requests.readthedocs.io\", Found HTTPS url \"https://packaging.python.org\", Found HTTPS url \"https://img.shields.io\", Found HTTPS url \"https://www.python.org\", Found HTTPS url \"https://pepy.tech\", Found HTTPS url \"https://t.me\", Found HTTPS url \"https://opensource.org\", Found HTTPS url \"https://www.youtube.com\", Found HTTPS url \"https://pypi.org\", Found HTTPS url \"https://pixabay.com\", Found HTTPS url \"https://www.buymeacoffee.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.6.5.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"$29","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \" Disclaimer\n\nThis tool is for personal use only. Please respect YouTube's Terms of Service and content creator rights.\n\n---\n\n

\n\nMade with \" (Indicator: \"youtube\"; Source: \"sample.bin\"), Found string \" Basic Usage

\n\n1. **Launch YTSage**\n2. **Paste YouTube URL** (or use \"Paste URL\" button)\n3. **Click \"Analyze\"**\n4. **Select Format:**\n - `Video` for video downloads\n - `Audio` for audio extraction\n> \" (Indicator: \"youtube\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube\"; Source: \"sample.bin\"), Found string \"Modern YouTube downloader with a clean PySide6 interface.\" (Indicator: \"youtube\"; Source: \"sample.bin\"), Found string \" Proxy**.\n- **Generic Mode:** Allow YTSage to process and download from non-YouTube URLs supported by yt-dlp. Toggle in **Download Settings \" (Indicator: \"youtube\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"mal@lemburg.com\", Pattern match: \"nz@counter.fromkeys\", Pattern match: \"brian@sweetapp.com\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"sample.bin\"), Found string \" Star History\n\n

\n\n[![Star History Chart](./branding/svg/star-history-dark.svg)](https://github.com/oop7/YTSage/stargazers)\n\n

\n\n## \" (Indicator: \"github.com\"; Source: \"sample.bin\"), Found string \" by [oop7](https://github.com/oop7)\n\n\n\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set the payload to the given value.\n\nOptional charset sets the message's default character set. See\nset_charset() for details.\nr%\" (Indicator: \"set \"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set the value of a header.\n\nNote: this does not overwrite an existing header with the same field\nname. Use __delitem__() first to delete any existing headers.\nr\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"\tb64decoder\" (Indicator: \"b64decode\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 4cbd60489de6… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 4cbd60489de6…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412"}],["$","meta","4",{"property":"og:title","content":"Sample 4cbd60489de6… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 4cbd60489de6…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4cbd60489de68b0d62d34a3bee4783f75acf8b974d08ebedb287f1c9a3037412"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 4cbd60489de6… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 4cbd60489de6…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]