26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious PUADlManager_Win32_InstallCore Sample 4e846bbede5e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 4e846bbede5e…. Malware family: PUADlManager_Win32_InstallCore. Threat score 100/100. 13/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36","keywords":["Malicious","PUADlManager_Win32_InstallCore","malware analysis","sandbox report","threat intelligence","4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36"],"about":{"@type":"SoftwareApplication","name":"microsoft-powerpoint-2010_2757790644.exe","applicationCategory":["peexe","executable"],"identifier":"4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"PUADlManager_Win32_InstallCore","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tfd0,Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-885-0041F118") which is directly followed by "cmp bl, 04h" and "jnc 0041F161h". See related instructions: "...+14 call 004059A4h ;GetVersion+19 mov ebx, eax+21 cmp bl, 04h+24 jnc 0041F161h" ... at 00020035-00003288-18588-885-0041F118 Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-748-0042E09C") which is directly followed by "cmp ax, 0005h" and "jc 0042E119h". See related instructions: "...+71 xor eax, eax+73 push ebp+74 push 0042E280h+79 push dword ptr fs:[eax]+82 mov dword ptr fs:[eax], esp+85 xor ebx, ebx+87 call 004059A4h ;GetVersion+92 and ax, 000000FFh+96 cmp ax, 0005h+100 jc 0042E119h" ... at 00020035-00003288-18588-748-0042E09C Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-1005-0046E13C") which is directly followed by "cmp ax, 00000601h" and "jc 0046E180h". See related instructions: "...+10 call 004059A4h ;GetVersion+15 xchg al, ah+17 cmp ax, 00000601h+21 jc 0046E180h" ... at 00020035-00003288-18588-1005-0046E13C Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-879-00419040") which is directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049C5C4h]". See related instructions: "...+0 call 004059A4h ;GetVersion+5 and ax, 000000FFh+9 cmp ax, 0004h+13 setnb byte ptr [0049C5C4h]" ... at 00020035-00003288-18588-879-00419040 Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-1058-0045CBC0") which is directly followed by "cmp ax, 0005h" and "jnc 0045CBF5h". See related instructions: "...+26 call 004059A4h ;GetVersion+31 and ax, 000000FFh+35 cmp ax, 0005h+39 jnc 0045CBF5h" ... at 00020035-00003288-18588-1058-0045CBC0 Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-2703-0042D974") which is directly followed by "cmp ax, 0006h" and "jc 0042D9CFh". See related instructions: "...+32 call 004059A4h ;GetVersion+37 and ax, 000000FFh+41 cmp ax, 0006h+45 jc 0042D9CFh" ... at 00020035-00003288-18588-2703-0042D974 Found API call GetDiskFreeSpaceA@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-2954-00455E0C") which is directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 00455F13h". See related instructions: "...+204 call 00403738h+209 push eax+210 call 004058E4h ;GetDiskFreeSpaceA+215 neg eax+217 sbb eax, eax+219 neg eax+221 mov byte ptr [ebp-02h], al+224 cmp byte ptr [ebp-02h], 00h+228 je 00455F13h" ... at 00020035-00003288-18588-2954-00455E0C Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-2461-004116F4") which is directly followed by "cmp ax, 0004h" and "jc 00411854h". See related instructions: "...+147 call 00403634h+152 call 004059A4h ;GetVersion+157 and ax, 000000FFh+161 cmp ax, 0004h+165 jc 00411854h" ... at 00020035-00003288-18588-2461-004116F4 Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-3074-00462E30") which is directly followed by "cmp ax, 0006h" and "jc 00462EA3h". See related instructions: "...+48 call 004059A4h ;GetVersion+53 and ax, 000000FFh+57 cmp ax, 0006h+61 jc 00462EA3h" ... at 00020035-00003288-18588-3074-00462E30 Found API call GetVersion@KERNEL32.DLL (Target: "microsoft-powerpoint-2010_2757790644.tmp"; Stream UID: "00020035-00003288-18588-3071-00462CD8") which is directly followed by "cmp ax, 0006h" and "jnc 00462D4Dh". See related instructions: "...+86 call 00418318h+91 call 004059A4h ;GetVersion+96 and ax, 000000FFh+100 cmp ax, 0006h+104 jnc 00462D4Dh" ... at 00020035-00003288-18588-3071-00462CD828:T607,"" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\netmsg.dll" "" touched file "C:\Windows\System32\en-US\netmsg.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\user32.dll.mui" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\netmsg.dll" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\netmsg.dll.mui" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\shfolder.dll" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\imageres.dll" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\imageres.dll.mui" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\shell32.dll.mui" "microsoft-powerpoint-2010_2757790644.tmp" touched file "C:\Windows\System32\en-US\setupapi.dll.mui"29:T463,Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/SMI/2" Pattern match: "http://t2.symcb.com0" Pattern match: "http://t1.symcb.com/ThawtePCA.crl0" Pattern match: "http://tl.symcb.com/tl.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://tl.symcd.com0&" Pattern match: "http://tl.symcb.com/tl.crt0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEHGgtzaV3bGvwjsrmhjuVMs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: t2.symcb.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSFBjxN%2BWY73bfUnSOp7HDKJ%2Fbx0wQUV4abVLi%2BpimK5PbC4hMYiYXN3LcCEGupYC0JcIqIx%2FEK7zRNbRA%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: tl.symcd.com" Pattern match: "http://schemas.microsoft.com/SMI/2005/Windo" Heuristic match: "COMMAND.COM" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps"2a:T434,"C:\microsoft-powerpoint-2010_2757790644.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" for deletion "C:\microsoft-powerpoint-2010_2757790644.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-5F9CF.tmp" for deletion "%TEMP%\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" marked "C:\Program Files\Gopogigu\is-7PK47.tmp" for deletion "%TEMP%\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" marked "C:\Program Files\Gopogigu\unins000.dat" for deletion "%TEMP%\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" marked "C:\Program Files\Gopogigu" for deletion "%TEMP%\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-04GJF.tmp\_isetup\_shfoldr.dll" for deletion "%TEMP%\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-04GJF.tmp\_isetup" for deletion "%TEMP%\is-5F9CF.tmp\microsoft-powerpoint-2010_2757790644.tmp" marked "C:\Users\%OSUSER%\AppData\Local\Temp\is-04GJF.tmp" for deletion2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAd3AAAAAAAAAAAAAAAAAAd4iI5gAAAAAAAAePjwAAB4iIiOZoAAAAAAAH+PgHAHiIiI5miIAAAAAAB4+PCHB4iIiGaI/wAAAAAAf4+AeHiIiIho///wAAAAAHj48Id4iIiAD/+IgAAAAAB/j4B4eIiIAAB3eIAAAAAAePjwh3d3dwAAiHdwAAAAAH+PgHh/+I7gCI+IgAAAAAB///CHf47md4iI+IAAAAAAf//weHfuZ3iIiI8AAAAAAH//8IeH5meIiIiICIiIAAB///CIiHZ3iIiIgAAAiHAAf//wiIgHd4iIgAd3d4hwAH//8IiID/d3d3//////cAB3d3CIiAd3d3d3d3d3eHAAd3dwiIgAAAAAAAAAAACAB///9wiIB4iIiIiIiIiHAHd3d3dwiAf/////////hwAAAAd3dwgH9ERERERET4cAAAAAd3dwB/TohmZszE+HAAAAAAf//wf0/ohmZsxPhwAAAAAAd3dw9O/ohmZsT4cAAAAAAAAAB/T+/ohmZk+HAAAAAAAAAAf07+/ohmZPhwAAAAAAAAAH9I7+/ohmT4cAAAAAAAAAB/SI7+/ohk+HAAAAAAAAAAf0iI7+/ohPhwAAAAAAAAAH9ERERERET4cAAAAAAAAAB/////////+HAAAAAAAAAAB3d3d3d3d3dwD//gf/wPgB/8BwAP/AIAB/wAAAf8AAAD/AAAA/wABgP8AAYD/AAAA/wAAAP8AAAAPAAAABwAAAAMAAAADAAAAAwAAAAMAAAACAAAABAAAAAfgAAAH8AAAB/gAAAf8AAAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//wAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791325897464,"unified_at":"2026-10-06T22:31:37.464Z","metadata":{"hashes":{"sha256":"4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36","sha1":"5b19cbbd7319b2a333af213340a1a2faa4757c0f","md5":"cd93be8dc38dd1c0043ac1b92b1f43a1","sha512":"4881066e640acd1e87c58225fc10a8a1d24f79263d1d0709f70eb6769b9141f2540cbc26ec7c4286e908b9acb46b7e911d27e4c45334a58f269c6c4ac301ee77","ssdeep":"49152:wQpZWKpmzcd1u7/TRNASL/IC5/ozjAQp32c1HAsDyagRgbVG4nQetHokJaaPGpfZ:npZWKpmz97VLN5/oz539gM1gRcVQetnS","ssdeep_chunks":["49152:wQpZWKp","49152:QpZWKpm","49152:pZWKpmz","49152:ZWKpmzc","49152:WKpmzcd","49152:Kpmzcd1","49152:pmzcd1u","49152:mzcd1u7","49152:zcd1u7/","49152:cd1u7/T","49152:d1u7/TR","49152:1u7/TRN","49152:u7/TRNA","49152:7/TRNAS","49152:/TRNASL","49152:TRNASL/","49152:RNASL/I","49152:NASL/IC","49152:ASL/IC5","49152:SL/IC5/","49152:L/IC5/o","49152:/IC5/oz","49152:IC5/ozj","49152:C5/ozjA","49152:5/ozjAQ","49152:/ozjAQp","49152:ozjAQp3","49152:zjAQp32","49152:jAQp32c","49152:AQp32c1","49152:Qp32c1H","49152:p32c1HA","49152:32c1HAs","49152:2c1HAsD","49152:c1HAsDy","49152:1HAsDya","49152:HAsDyag","49152:AsDyagR","49152:sDyagRg","49152:DyagRgb","49152:yagRgbV","49152:agRgbVG","49152:gRgbVG4","49152:RgbVG4n","49152:gbVG4nQ","49152:bVG4nQe","49152:VG4nQet","49152:G4nQetH","49152:4nQetHo","49152:nQetHok","49152:QetHokJ","49152:etHokJa","49152:tHokJaa","49152:HokJaaP","49152:okJaaPG","49152:kJaaPGp","49152:JaaPGpf","49152:aaPGpfZ","98304:wQpZWKp","98304:QpZWKpm","98304:pZWKpmz","98304:ZWKpmzc","98304:WKpmzcd","98304:Kpmzcd1","98304:pmzcd1u","98304:mzcd1u7","98304:zcd1u7/","98304:cd1u7/T","98304:d1u7/TR","98304:1u7/TRN","98304:u7/TRNA","98304:7/TRNAS","98304:/TRNASL","98304:TRNASL/","98304:RNASL/I","98304:NASL/IC","98304:ASL/IC5","98304:SL/IC5/","98304:L/IC5/o","98304:/IC5/oz","98304:IC5/ozj","98304:C5/ozjA","98304:5/ozjAQ","98304:/ozjAQp","98304:ozjAQp3","98304:zjAQp32","98304:jAQp32c","98304:AQp32c1","98304:Qp32c1H","98304:p32c1HA","98304:32c1HAs","98304:2c1HAsD","98304:c1HAsDy","98304:1HAsDya","98304:HAsDyag","98304:AsDyagR","98304:sDyagRg","98304:DyagRgb","98304:yagRgbV","98304:agRgbVG","98304:gRgbVG4","98304:RgbVG4n","98304:gbVG4nQ","98304:bVG4nQe","98304:VG4nQet","98304:G4nQetH","98304:4nQetHo","98304:nQetHok","98304:QetHokJ","98304:etHokJa","98304:tHokJaa","98304:HokJaaP","98304:okJaaPG","98304:kJaaPGp","98304:JaaPGpf","98304:aaPGpfZ","49152:npZWKpm","49152:ZWKpmz9","49152:WKpmz97","49152:Kpmz97V","49152:pmz97VL","49152:mz97VLN","49152:z97VLN5","49152:97VLN5/","49152:7VLN5/o","49152:VLN5/oz","49152:LN5/oz5","49152:N5/oz53","49152:5/oz539","49152:/oz539g","49152:oz539gM","49152:z539gM1","49152:539gM1g","49152:39gM1gR","49152:9gM1gRc","49152:gM1gRcV","49152:M1gRcVQ","49152:1gRcVQe","49152:gRcVQet","49152:RcVQetn","49152:cVQetnS"],"imphash":"884310b1928934402ea6fec1dbd3cf5e"},"file_info":{"file_name":"microsoft-powerpoint-2010_2757790644.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2330088,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1522823338000,"last_seen":1676473848000,"last_multi_scan":1676473848000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["adinstaller","adware","eorezo","filetour","installcore","pua","pup"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":10,"malicious_count":6,"total":39},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Agent.BWE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Installcore-7059315-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"ApplicUnwnt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/InstallCore.Gen.A potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 00586c981 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"not-a-virus:AdWare.Win32.DealPly.dgexk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Gen.ccmw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/InstCore-TM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"PUP.Win32.InnovaMedia.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.2LA.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.Agent.Win32.24506","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"PUADlManager_Win32_InstallCore","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SHGetFolderPathA@SHFOLDER.DLL at 00020035-00003288-18588-3259-0047D254","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00019175-00003168-1015-241-004026C4\n GetSystemTime@KERNEL32.DLL at 00019175-00003168-1015-167-0040102C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020035-00003288-18588-75-00457A0C\n GetSystemTime@KERNEL32.DLL at 00020035-00003288-18588-785-00402778\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020035-00003288-18588-832-004585C8\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020035-00003288-18588-863-004579C8\n GetLocalTime@KERNEL32.DLL at 00020035-00003288-18588-3190-0046F038\n GetLocalTime@KERNEL32.DLL at 00020035-00003288-18588-3183-0046EA8C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.DLL at 00019175-00003168-1015-96-00405CF4\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-885-0041F118\n GetVersionExA@KERNEL32.DLL at 00020035-00003288-18588-850-00484184\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-748-0042E09C\n GetVersionExA@KERNEL32.DLL at 00020035-00003288-18588-860-0044B604\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-1005-0046E13C\n GetVersionExA@KERNEL32.DLL at 00020035-00003288-18588-873-0044F6D4\n GetVersionExA@KERNEL32.DLL at 00020035-00003288-18588-911-00409070\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-879-00419040\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-1058-0045CBC0\n GetVersionExA@KERNEL32.DLL at 00020035-00003288-18588-871-0044FC10\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-2703-0042D974\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-2461-004116F4\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-3074-00462E30\n GetVersion@KERNEL32.DLL at 00020035-00003288-18588-3071-00462CD8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00020035-00003288-18588-2954-00455E0C","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"microsoft-powerpoint-2010_2757790644.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MICROSOFT-POWERPOINT-2010_2757790644.TMP\")\n \"microsoft-powerpoint-2010_2757790644.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MICROSOFT-POWERPOINT-2010_2757790644.TMP\")\n \"microsoft-powerpoint-2010_2757790644.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOPOGIGU_IS1\")\n \"microsoft-powerpoint-2010_2757790644.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\GOPOGIGU_IS1\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00020035-00003288-18588-832-004585C8","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp\"\n \"microsoft-powerpoint-2010_2757790644.tmp\" created file \"%TEMP%\\is-04GJF.tmp\\_isetup\\_shfoldr.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"microsoft-powerpoint-2010_2757790644.tmp\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"microsoft-powerpoint-2010_2757790644.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"microsoft-powerpoint-2010_2757790644.tmp\" with commandline \"/SL5=\"$301A0\n2081950\n56832\nC:\\microsoft-powerpoint-2010_2757790644.exe\"\" (UID: 00020035-00003288)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=thawte Primary Root CA, OU=\"c 2006 thawte\n Inc. - For authorized use only\", OU=Certification Services Division, O=\"thawte\n Inc.\", C=US\" (SHA1: D0:0C:FD:BF:46:C9:8A:83:8B:C1:0D:C4:E0:97:AE:01:52:C4:61:BC; see report for more information)\n The input sample is signed with a certificate issued by \"CN=thawte SHA256 Code Signing CA, O=\"thawte\n Inc.\", C=US\" (SHA1: 95:44:B4:67:72:4F:D3:AE:A4:CE:4F:E2:E0:EB:EB:0C:08:14:EF:22; see report for more information)","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"microsoft-powerpoint-2010_2757790644.tmp\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00020035-00003288-18588-434-0045559C","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"is-7PK47.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"microsoft-powerpoint-2010_2757790644.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"microsoft-powerpoint-2010_2757790644.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"microsoft-powerpoint-2010_2757790644.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.\n \"is-7PK47.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Sun Sep 4 22:31:12 2005\n \"microsoft-powerpoint-2010_2757790644.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"microsoft-powerpoint-2010_2757790644.exe.bin\" was detected as \"Borland Delphi 4.0\"\n \"is-7PK47.tmp\" was detected as \"Morphine v1.2 (DLL)\"\n \"microsoft-powerpoint-2010_2757790644.tmp\" was detected as \"Borland Delphi 3.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"microsoft-powerpoint-2010_2757790644.tmp\" queried SystemProcessInformation at 00020035-00003288-00000105-75835395\n \"microsoft-powerpoint-2010_2757790644.tmp\" queried SystemProcessInformation at 00020035-00003288-00000105-75835523","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 10 calls to GetProcAddress@KERNEL32.DLL at 00020035-00003288-18588-885-0041F118\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00020035-00003288-18588-859-0044B658","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"microsoft-powerpoint-2010_2757790644.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://www.jrsoftware.org\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00019175-00003168-1015-76-00409C34\n FindResourceA@KERNEL32.DLL at 00020035-00003288-18588-673-0040D010\n FindResourceA@KERNEL32.DLL at 00020035-00003288-18588-652-0040ADD8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"is-7PK47.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"microsoft-powerpoint-2010_2757790644.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$2a","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp\" with delete access\n \"\" opened \"%TEMP%\\is-5F9CF.tmp\" with delete access\n \"microsoft-powerpoint-2010_2757790644.tmp\" opened \"C:\\Program Files\\Gopogigu\\is-7PK47.tmp\" with delete access\n \"microsoft-powerpoint-2010_2757790644.tmp\" opened \"C:\\Program Files\\Gopogigu\\unins000.dat\" with delete access\n \"microsoft-powerpoint-2010_2757790644.tmp\" opened \"C:\\Program Files\\Gopogigu\" with delete access\n \"microsoft-powerpoint-2010_2757790644.tmp\" opened \"%TEMP%\\is-04GJF.tmp\\_isetup\\_shfoldr.dll\" with delete access\n \"microsoft-powerpoint-2010_2757790644.tmp\" opened \"%TEMP%\\is-04GJF.tmp\\_isetup\" with delete access\n \"microsoft-powerpoint-2010_2757790644.tmp\" opened \"%TEMP%\\is-04GJF.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExA\n GetFileAttributesA\n VirtualProtect\n GetVersionExA\n GetModuleFileNameA\n GetFileSize\n LockResource\n CreateDirectoryA\n DeleteFileA\n GetCommandLineA\n GetProcAddress\n GetModuleHandleA\n WriteFile\n LoadLibraryA\n CreateProcessA\n Sleep\n CreateFileA\n FindResourceA\n VirtualAlloc\n RegDeleteKeyA\n GetUserNameA\n RegCreateKeyExA\n RegDeleteValueA\n RegEnumKeyExA\n GetDriveTypeA\n DeviceIoControl\n CopyFileA\n LoadLibraryExA\n CreateThread\n TerminateProcess\n GetTickCount\n OpenProcess\n FindFirstFileA\n GetComputerNameA\n FindNextFileA\n ShellExecuteExA\n ShellExecuteA\n GetLastActivePopup\n SetWindowsHookExA\n FindWindowA\n GetWindowThreadProcessId","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"microsoft-powerpoint-2010_2757790644.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/67 Antivirus vendors marked sample as malicious (31% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/67 Antivirus vendors marked sample as malicious (31% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00020035-00003288-18588-1130-0042E934","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/61 Antivirus vendors marked dropped file \"is-7PK47.tmp\" as malicious (classified as \"Static engine \" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp\" (Handle: 248)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp\" (Handle: 248)\n \"\" wrote 32 bytes to a remote process \"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp\" (Handle: 248)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp\" (Handle: 248)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00020035-00003288-18588-95-004555E4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["adinstaller","adware","eorezo","filetour","installcore","pua","pup"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5ac470aa7ca3e174cd6db6d4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"AdWare.DealPly","submit_name":"microsoft-powerpoint-2010_2757790644.exe","analysis_start_time":"2018-04-04T07:28:36+00:00","indicators_count":{"informative":23,"suspicious":15,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}],"processes":[{"pid":3168,"ppid":0,"name":"microsoft-powerpoint-2010_2757790644.exe","command_line":"","sha256":"4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36","normalized_path":"C:\\microsoft-powerpoint-2010_2757790644.exe","uid":"00019175-00003168","icon":"$2b"},{"pid":3288,"ppid":3168,"name":"microsoft-powerpoint-2010_2757790644.tmp","command_line":"/SL5=\"$301A0,2081950,56832,C:\\microsoft-powerpoint-2010_2757790644.exe\"","sha256":"bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4","normalized_path":"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp","parent_uid":"00019175-00003168","uid":"00020035-00003288"}],"all_imported_dlls":["usp10.dll","comctl32.dll","uxtheme.dll","tiptsf.dll","ExplorerFrame.dll","devobj.dll","kernel32.dll","KernelBase.dll","oleaut32.dll","shfolder.dll","duser.dll","setupapi.dll","user32.dll","netmsg.dll","RstrtMgr.dll","msasn1.dll","cfgmgr32.dll","cryptbase.dll","clbcatq.dll","ntdll.dll","advapi32.dll","msctf.dll","shell32.dll","mpr.dll","profapi.dll","rpcrt4.dll","apphelp.dll","rpcss.dll","sfc.dll","devrtl.dll","imm32.dll","dwmapi.dll","ncrypt.dll","bcryptprimitives.dll","sspicli.dll","dui70.dll","msvcrt.dll","version.dll","_shfoldr.dll","bcrypt.dll","sfc_os.dll","sechost.dll","gdi32.dll","lpk.dll","ole32.dll","shlwapi.dll","comdlg32.dll","imageres.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-7PK47.tmp","sha256":"76077e7b6043c7e94cf9e0f81974acf2aeb5bc65c60d845ce0eb0b06ebc34288","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"name":"microsoft-powerpoint-2010_2757790644.tmp","sha256":"bae22f27c12bce1faeb64b6eb733302aff5867baa8eed832397a7ce284a86ff4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]}],"files_written":[{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"C:\\microsoft-powerpoint-2010_2757790644.exe","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\shfolder.dll","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%PROGRAMFILES%\\Gopogigu\\Homocebada.exe","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"path":"%TEMP%\\is-5F9CF.tmp\\microsoft-powerpoint-2010_2757790644.tmp","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5ac470aa7ca3e174cd6db6d4"}]}]}},"report_ids":{"sandbox_job_ids":["5ac470aa7ca3e174cd6db6d4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious PUADlManager_Win32_InstallCore Sample 4e846bbede5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4e846bbede5e…. Malware family: PUADlManager_Win32_InstallCore. Threat score 100/100. 13/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36"}],["$","meta","4",{"property":"og:title","content":"Malicious PUADlManager_Win32_InstallCore Sample 4e846bbede5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4e846bbede5e…. Malware family: PUADlManager_Win32_InstallCore. Threat score 100/100. 13/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4e846bbede5e4a76cf1686c145a595d9cdfed95e598a5132e79f7f72cfda0e36"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious PUADlManager_Win32_InstallCore Sample 4e846bbede5e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4e846bbede5e…. Malware family: PUADlManager_Win32_InstallCore. Threat score 100/100. 13/28 AV engines flagged this file. 6 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]