24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 38:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Virus.Sality Sample 4d4cda3ce66f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4d4cda3ce66f…. Malware family: Virus.Sality. Threat score 100/100. 21/27 AV engines flagged this file. 9 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4d4cda3ce66f376dab5fada530035829151e41fe5fc6bb9f5d3c0e6fb8215e8e","keywords":["Malicious","Virus.Sality","malware analysis","sandbox report","threat intelligence","4d4cda3ce66f376dab5fada530035829151e41fe5fc6bb9f5d3c0e6fb8215e8e"],"about":{"@type":"SoftwareApplication","name":"ynxe.pif.exe","applicationCategory":["peexe","executable"],"identifier":"4d4cda3ce66f376dab5fada530035829151e41fe5fc6bb9f5d3c0e6fb8215e8e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Virus.Sality","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T502,"" (Indicator: "GetDC"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001492.00000000.156172.033C0000.00000004.mdmp")36:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001492.00000000.156172.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"698e006e092ad7bdec0b00e8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001492.00000000.156172.00401000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001492.00000000.156172.03390000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00001492.00000000.156172.055A4000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"698e006e092ad7bdec0b00e8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001492.00000000.156172.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"698e006e092ad7bdec0b00e8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" lifeengines\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"698e006e092ad7bdec0b00e8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"