26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T41a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 4cc9c66f73a5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4cc9c66f73a5…. Threat score 100/100. 0/5 AV engines flagged this file. 0 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4cc9c66f73a577180dd45a6c8e961d75d764d6f5f0385c9f6c55418abb9e1c76","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","4cc9c66f73a577180dd45a6c8e961d75d764d6f5f0385c9f6c55418abb9e1c76"],"about":{"@type":"SoftwareApplication","name":"http://eb2.3lift.com/","applicationCategory":["url"],"identifier":"4cc9c66f73a577180dd45a6c8e961d75d764d6f5f0385c9f6c55418abb9e1c76","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":5},"behavioralIndicators":{"malicious":0,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7ed,"iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "")28:T5ab,"iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "iexplore.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "iexplore.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "")29:Tcae,"iexplore.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}") "iexplore.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "iexplore.exe" touched "Network List Manager" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "iexplore.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\TREATAS") "iexplore.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\TREATAS") "iexplore.exe" touched "CLSID_RecordInfo" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{0000002F-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.DBEngine.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000100-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.PrivateDBEngine.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000101-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.TableDef.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000103-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.Field.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000104-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.Index.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000105-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.Group.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000106-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.User.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000107-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.QueryDef.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000108-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "DAO.Relation.36" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000109-0000-0010-8000-00AA006D2EA4}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "StdOleLink" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000300-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "FileMoniker" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000303-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "ItemMoniker" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000304-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "AntiMoniker" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000305-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}") "iexplore.exe" touched "PointerMoniker" (Path: "HKCR\SOFTWARE\CLASSES\CLSID\{00000306-0000-0000-C000-000000000046}\IMPLEMENTED CATEGORIES\{00021493-0000-0000-C000-000000000046}")2a:T591,"urlblockindex_1_.bin" has type "data" "urlref_httpeb2.3lift.com" has type "HTML document ASCII text with very long lines" "logo_sm_1_.png" has type "PNG image data 250 x 85 8-bit/color RGBA non-interlaced" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "suggestions_1_.en-US" has type "data" "~DFC841FE0FB5449FFF.TMP" has type "data" "_AA08E30F-6AE8-11EA-B853-0A0027260FBC_.dat" has type "Composite Document File V2 Document Cannot read section info" "java-debug_1_.css" has type "ASCII text" "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "AM2ULRCC.txt" has type "ASCII text" "6J0JJV46.htm" has type "HTML document ASCII text with very long lines" "QldXNThLqRwH-OJ1UHjlKGHiw71p5_o_1_.woff" has type "Web Open Font Format flavor 65536 length 25172 version 1.1" "XO73S0PO.txt" has type "ASCII text" "favicon_3_.ico" has type "MS Windows icon resource - 1 icon 16x16" "en-US.2" has type "data" "0177A2B8C3D6561744552D69E6BD54B0_20AB83B36755C26B080541FF2B3DC287" has type "data" "~DFCB6EAC4A99F5991C.TMP" has type "data" "favicon_3_.ico" has type "PNG image data 16 x 16 4-bit colormap non-interlaced" "6BADA8974A10C4BD62CC921D13E43B18_D9817BD5013875AD517DA73475345203" has type "data" "_AA08E310-6AE8-11EA-B853-0A0027260FBC_.dat" has type "Composite Document File V2 Document Cannot read section info"2b:T85e,"iexplore.exe" wrote bytes "60d2156e" to virtual address "0x75CB13B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60cd156e" to virtual address "0x6B1BFEC0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "a035126e" to virtual address "0x75ADB0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "60d2156e" to virtual address "0x6B1BFEC4" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "c03a126e" to virtual address "0x6B1BFE80" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "a035126e" to virtual address "0x75581298" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "c03a126e" to virtual address "0x76171FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033126e" to virtual address "0x757617CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "b033126e" to virtual address "0x738E1250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "b033126e" to virtual address "0x75E711BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "b033126e" to virtual address "0x75BB1164" (part of module "USP10.DLL") "iexplore.exe" wrote bytes "a035126e" to virtual address "0x7617202C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "3030126e" to virtual address "0x6B1BFE90" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "b033126e" to virtual address "0x752314E0" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "a035126e" to virtual address "0x738E139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "a035126e" to virtual address "0x77001144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "c0bf136e" to virtual address "0x76171F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "80320500703205000032050060320500503205004032050030320500000000002cc92776c021050000000000901705005023050000180500601f050020360500000000004036050000000000" to virtual address "0x00058000" "iexplore.exe" wrote bytes "b033126e" to virtual address "0x74261038" (part of module "VERSION.DLL") "iexplore.exe" wrote bytes "70cc156e" to virtual address "0x75CB1310" (part of module "SHLWAPI.DLL")2c:T770,Found malicious artifacts related to "205.185.216.42": ... URL: http://galleries.hot-bitch.net/ (AV positives: 3/76 scanned on 03/20/2020 19:52:43) URL: https://setup.rbxcdn.com/version-5e5ad1c73fed4e85-Roblox.exe (AV positives: 2/76 scanned on 03/20/2020 18:45:20) URL: http://api.ning.com/files/HZe53k0LmyFAIeUo-YjjLX*7*Ndj8Ltm4oSphrkWJBVmcz-4nOi40fXYV8XhOEolfPCoq3lBnlohrDiNqKh96FAz8YRGFw0G/ (AV positives: 1/76 scanned on 03/20/2020 18:12:44) URL: http://js.wpncdn.com/ (AV positives: 1/76 scanned on 03/20/2020 15:02:48) URL: http://api.ning.com/files/Oi8IGTb-jSLIZSGl3OFHS9nHVCCxu8vp-*9AycUoRNn*3Zw1FuLW4gyDvOpjtGWlifZojes8FVUrV88kJeE15vTG7ZnyKxgZ/ (AV positives: 3/76 scanned on 03/20/2020 10:09:44) File SHA256: bd5377826bec37fc8d4eff828f74c53053cf1788d779a6d6f4811c2df72ce00b (AV positives: 7/74 scanned on 03/20/2020 18:35:24) File SHA256: edfed9008bfcf3b83c08f9a25188e35f8d526762be73459e703d723505023006 (Date: 03/20/2020 18:11:33) File SHA256: f65d8c80a6c37da97c752f858f042f6f0992abca52cb878940c4f0f0a68aa623 (Date: 03/20/2020 16:42:02) File SHA256: f32a5a6c20b998c0f6eaf69994ec8614c8e718e28a372cf1d45206464e9ec5f6 (Date: 03/20/2020 16:21:44) File SHA256: a1d1ac29c8c148d32e2d929118fe28bc5b42afce2a0abde33569b5c9d56cae15 (Date: 03/20/2020 16:06:07) File SHA256: 6972563d206195a090bbe46b9fe28d551a0f9ba4e4793020f30ea849e54ad05f (Date: 03/20/2020 14:48:31) File SHA256: e63e78cc4d9963461b469e1e780988067f869379ff23031b235e286d4a435d18 (AV positives: 1/75 scanned on 03/19/2020 04:44:43) File SHA256: 3343053f281b8d70345451302545b90985ee66fbd5d0707199f59199cb16f471 (AV positives: 33/74 scanned on 03/17/2020 19:21:59) File SHA256: 0058b5dcc9d6be5fe7536ea50d7f26e85d00c88ec210efebee25430194209217 (AV positives: 50/73 scanned on 03/17/2020 19:21:57) File SHA256: 344f35eb8664d250ef5236520526bbcfa3e3b5b4cc6766449faf0baa1ab765c1 (AV positives: 1/73 scanned on 03/14/2020 11:49:51)2d:T460,file/memory contains long string with (Indicator: "dir "; File: "EA7646EU.htm") Found string "" (Indicator: "dir "; File: "EA7646EU.htm") Found string "

" (Indicator: "dir "; File: "EA7646EU.htm") Found string "

Twitter

" (Indicator: "dir "; File: "EA7646EU.htm") Found string "data-facebook-like-url="https://www.facebook.com/msn" data-facebook-button-width="9.7rem" data-twitter-follow-screen-name="msn" data-twitter-button-width="9.5rem" data-twitter-show-screen-name="false">" (Indicator: "dir "; File: "EA7646EU.htm") Found string "