34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 45:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 4cf32bd41a17… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample 4cf32bd41a17…. Malware family: Trojan.Generic. Threat score 87/100. 10/28 AV engines flagged this file. 2 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c"],"about":{"@type":"SoftwareApplication","name":"4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin","applicationCategory":["peexe","executable"],"identifier":"4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T74e,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp")37:T97a,Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp")38:T63e,Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "BCryptGenerateSymmetricKey" (Indicator: "BCryptGenerateSymmetricKey"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp")39:T12fb,Assembly shows XOR instruction xor eax ebp in Stream UID: 24964-75-004138EF Assembly shows XOR instruction xor ecx ebp in Stream UID: 24964-75-004138EF Assembly shows XOR instruction xor eax ebp in Stream UID: 24964-119-00417D88 Assembly shows XOR instruction xor ecx ebp in Stream UID: 24964-119-00417D88 Assembly shows XOR instruction xor eax dword ptr [edx+08h] in Stream UID: 24964-553-0041A9B0 Assembly shows XOR instruction xor dword ptr [edx+08h] eax in Stream UID: 24964-553-0041A9B0 Assembly shows XOR instruction xor ecx dword ptr [edx+08h] in Stream UID: 24964-553-0041A9B0 Assembly shows XOR instruction xor dword ptr [edx+08h] ecx in Stream UID: 24964-553-0041A9B0 Assembly shows XOR instruction xor ecx dword ptr [edx] in Stream UID: 24964-553-0041A9B0 Assembly shows XOR instruction xor dword ptr [edx] ecx in Stream UID: 24964-553-0041A9B0 Assembly shows XOR instruction xor cl 3Ah in Stream UID: 24964-637-00401044 Assembly shows XOR instruction xor dl 3Ah in Stream UID: 24964-637-00401044 Assembly shows XOR instruction xor eax dword ptr [edx+08h] in Stream UID: 00000000-00005596-26039-50-00DCA9B0 Assembly shows XOR instruction xor dword ptr [edx+08h] eax in Stream UID: 00000000-00005596-26039-50-00DCA9B0 Assembly shows XOR instruction xor ecx dword ptr [edx+08h] in Stream UID: 00000000-00005596-26039-50-00DCA9B0 Assembly shows XOR instruction xor dword ptr [edx+08h] ecx in Stream UID: 00000000-00005596-26039-50-00DCA9B0 Assembly shows XOR instruction xor ecx dword ptr [edx] in Stream UID: 00000000-00005596-26039-50-00DCA9B0 Assembly shows XOR instruction xor dword ptr [edx] ecx in Stream UID: 00000000-00005596-26039-50-00DCA9B0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-89-00DC1775 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-103-00DC287F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-103-00DC287F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-134-00DC8907 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-134-00DC8907 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-211-00DC3CE4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-211-00DC3CE4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-214-00DC38EF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-214-00DC38EF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-219-00DC4E31 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-219-00DC4E31 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-230-00DC3091 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-230-00DC3091 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-254-00DC366C Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-254-00DC366C Assembly shows XOR instruction xor edi ecx in Stream UID: 00000000-00005596-26039-339-00DB80BC Assembly shows XOR instruction xor esi edx in Stream UID: 00000000-00005596-26039-339-00DB80BC Assembly shows XOR instruction xor cl 3Ah in Stream UID: 00000000-00005596-26039-347-00DB1044 Assembly shows XOR instruction xor dl 3Ah in Stream UID: 00000000-00005596-26039-347-00DB1044 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00005596-26039-439-00DBCE0E Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00005596-26039-439-00DBCE0E Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00005596-26039-439-00DBCE0E Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00005596-26039-439-00DBCE0E Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00005596-26039-439-00DBCE0E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-576-00DC78DA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-576-00DC78DA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-587-00DC7D8A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-587-00DC7D8A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-588-00DC7E65 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-588-00DC7E65 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00005596-26039-589-00DC7F4E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00005596-26039-589-00DC7F4E3a:T4ca,Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; File: "4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatus"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "GlobalMemoryStatusEx" (Indicator: "GlobalMemoryStatusEx"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpace"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp") Found reference to API "GetDiskFreeSpaceExA" (Indicator: "GetDiskFreeSpaceEx"; Source: "00000000-00005596.00000000.132653.00DCC000.00000002.mdmp")3b:T1512,"" (Indicator: "GetDC"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005596.00000000.132653.00C30000.00000004.mdmp")41:T9e1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005596.00000000.132653.00C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e7932f2b71bac5b109c1ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - ?\\UNC\\.\\strings passed to WinAPI cannot contain NULs; Source: \"4cf32bd41a17e51520ddd0b0aea06e9792ceb9c3dcb039f166324e6c73c7a65c.bin\")\n Found string - UNC\\.\\strings passed to WinAPI cannot contain NULs; Source: \"24964-951-0040B0E4\")\n Found string - ?\\UNC\\.\\strings passed to WinAPI cannot contain NULs; Source: \"00000000-00005596.00000000.132653.00DCC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69e7932f2b71bac5b109c1ab"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005596.00000000.132653.00C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e7932f2b71bac5b109c1ab"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69e7932f2b71bac5b109c1ab"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"