26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T50a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Prikormka Sample 4eaf154ce897… — Score 57/100 — Hybrid Analysis","description":"Malicious verdict for sample 4eaf154ce897…. Malware family: Trojan.Prikormka. Threat score 57/100. 15/26 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e","keywords":["Malicious","Trojan.Prikormka","malware analysis","sandbox report","threat intelligence","4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e"],"about":{"@type":"SoftwareApplication","name":"Центр управления восстановлением ДНР справка-доклад за 13 октября 2015 года.exe","applicationCategory":["peexe","executable"],"identifier":"4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e","additionalType":"Malicious sample"},"threatScore":57,"malwareFamily":"Trojan.Prikormka","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6d0,Found API call GetVersionExA@KERNEL32.dll (Target: "_13_2015_.exe.bin"; Stream UID: "41095-386-0040EEAF") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "... +35 call 0041A070h +40 add esp, 0Ch +43 lea eax, dword ptr [ebp-00000098h] +49 push eax +50 mov dword ptr [ebp-00000098h], 00000094h +60 call dword ptr [0042E1B0h] ;GetVersionExA +66 mov ecx, dword ptr [ebp-04h] +69 xor eax, eax +71 cmp dword ptr [ebp-00000088h], 02h +78 sete al +81 xor ecx, ebp" ... at 41095-386-0040EEAF Found API call GetVersion@KERNEL32.DLL (Target: "_13_2015_.exe"; Stream UID: "00018361-00002304-57003-411-00F870F0") which is directly followed by "cmp eax, 80000000h" and "push eax". See related instructions: "... +155 call dword ptr [00FAE254h] ;GetVersion +161 cmp eax, 80000000h +166 sbb eax, eax +168 neg eax +170 mov dword ptr [00FBD1F8h], eax +175 neg eax +177 push 00000000h +179 sbb eax, eax +181 and eax, 02000000h +186 push eax +187 mov eax, dword ptr [esp+34h] +191 push 00000003h +193 push 00000000h +195 push 00000000h +197 push 40000000h +202 push eax" ... at 00018361-00002304-57003-411-00F870F0 Found API call GetVersionExA@KERNEL32.DLL (Target: "_13_2015_.exe"; Stream UID: "00018361-00002304-57003-544-00F8EEAF") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "xor ecx, ebp". See related instructions: "... +35 call 00F9A070h +40 add esp, 0Ch +43 lea eax, dword ptr [ebp-00000098h] +49 push eax +50 mov dword ptr [ebp-00000098h], 00000094h +60 call dword ptr [00FAE1B0h] ;GetVersionExA +66 mov ecx, dword ptr [ebp-04h] +69 xor eax, eax +71 cmp dword ptr [ebp-00000088h], 02h +78 sete al +81 xor ecx, ebp" ... at 00018361-00002304-57003-544-00F8EEAF28:T558,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAOWSURBVFhHtZZbSFRRFIbXi10w0xcfejGpfKoeogu9CEJgkKFFN1BpJIvSvIxpKg42g1JKF5qCxJhAoyCEQqlIUkqxUBJyBiITSg2hehWifFztf++zxzMzZ8bxzDTD4hzW7HP+b/1r7a1E8X4cxH7/POvl8j7bGZFzUmTOTe7gc/HKha4zxNn4mMXNOS1uzkEceXvCeCoBcS95OTGAJIjbB0hAvDu1S1aO8LpJtqChnLjpvArcO8X7EdatSUC8J9PH2voeD/G7Vwqg7ewyAO49tf9RvDutiyH+fZ7kFQDNpapid1kMcWmJiAxnOpPXwTl9NXKghU0iHopgznOqGUcOL+7P7ueAY0TmUHnPpgdS9Od8OXvF1W2su3BKrD9BXCfst7Rd02mAbE+GhKgU3yDAab8EOPk6FAAQ05cmJEDvbeLA+BbuNsT1EAIAAYAI+7U47AHAyADxfKCMP/uzuH6qRAIM9Krcj4WsIAByOBOQ+9o+JQHut26Qg4fKtXg5lUvxavFuVzVxR40JQoqfUb25fE4BkDOP4UBqVwk3zhVJgKIiL5PhQN7AsgMQ1W2QwyfeEy5edlSJN1YQt4kAQEdLGESj2B6ASSkOBXCM5kW0YL8vEmD8+GBw+s2VlxYq8TpRXFsV8a164k4hjvkImQWIA2KdsEo7gBk48GhXBMCeO3+CQyj7ntHLbw8NBPc+hhO2o/KKEqPySlV5p8tCXJNUicXph4nXOHKYqnJ5syudc9ozDQAf05Ex3nGMeWfrrwgAtAHCZnFdeVPtdln51Zb8yMrNNgAgWQE3MXCeOmX7zdYYlQPCdVE8kITAFkN/rwvRGw3E15oEwBWVw+6yPAOwOFkBoefPSJ4H3mbiu8bAQfzTpAUAHkhmPPapI3jo5TKEFg8Eop3/Jl+GnxLHG4N9xC+eEOOqY3SYeGmJeOoj8fs3ynYIz8yoWPEfk8kx4tXGxBCxDv8HBbAwpyC0cNIAcCouLhJ/mQ4FtQJAK2a/hUIk5ID6o6QiGoTZAQCEQ9gGMIvHgrACMEPYArASjwYRDWBuVgyj38YQxhLXv6FCPRPRACDedc8GAHYEtpJxigVnQOfCd4wVgBYvKLAJoEXMbqBqvHglgFWJY0BinQHxAvz9XSynf9Xi8QCk7S6UbYjmAAoAgC3xlQDWbtvLKbkHef3WfTFPS5yCGLi4eh6+L/FgtNiYT6wj1jrb4oABdTJixQPHWPAPMZLOMA9825EAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":57,"unified_at_epoch_ms":1790301578394,"unified_at":"2026-09-25T01:59:38.394Z","metadata":{"hashes":{"sha256":"4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e","sha1":"9a578c7c305be62167ef87ab52e59a12f336186a","md5":"4f3ed209c1a8395aa6e822aafdad430c","sha512":"d361e858d456f53ccc983abbc9a07d713b6fc1a79ca5029d2692ef32fb2441189afa67166cabd2e519e358ae5e1476cbf9d5f434556f82741e8953d792a92f93","ssdeep":"98304:QPylBm9GdkW+AzTB8xKtHQTNW4BjADSVCYIKJv3L03J3OvT5AaC:FLkUITNWxDSVCYR5oZ3Ovt","ssdeep_chunks":["98304:QPylBm9","98304:PylBm9G","98304:ylBm9Gd","98304:lBm9Gdk","98304:Bm9GdkW","98304:m9GdkW+","98304:9GdkW+A","98304:GdkW+Az","98304:dkW+AzT","98304:kW+AzTB","98304:W+AzTB8","98304:+AzTB8x","98304:AzTB8xK","98304:zTB8xKt","98304:TB8xKtH","98304:B8xKtHQ","98304:8xKtHQT","98304:xKtHQTN","98304:KtHQTNW","98304:tHQTNW4","98304:HQTNW4B","98304:QTNW4Bj","98304:TNW4BjA","98304:NW4BjAD","98304:W4BjADS","98304:4BjADSV","98304:BjADSVC","98304:jADSVCY","98304:ADSVCYI","98304:DSVCYIK","98304:SVCYIKJ","98304:VCYIKJv","98304:CYIKJv3","98304:YIKJv3L","98304:IKJv3L0","98304:KJv3L03","98304:Jv3L03J","98304:v3L03J3","98304:3L03J3O","98304:L03J3Ov","98304:03J3OvT","98304:3J3OvT5","98304:J3OvT5A","98304:3OvT5Aa","98304:OvT5AaC","196608:QPylBm9","196608:PylBm9G","196608:ylBm9Gd","196608:lBm9Gdk","196608:Bm9GdkW","196608:m9GdkW+","196608:9GdkW+A","196608:GdkW+Az","196608:dkW+AzT","196608:kW+AzTB","196608:W+AzTB8","196608:+AzTB8x","196608:AzTB8xK","196608:zTB8xKt","196608:TB8xKtH","196608:B8xKtHQ","196608:8xKtHQT","196608:xKtHQTN","196608:KtHQTNW","196608:tHQTNW4","196608:HQTNW4B","196608:QTNW4Bj","196608:TNW4BjA","196608:NW4BjAD","196608:W4BjADS","196608:4BjADSV","196608:BjADSVC","196608:jADSVCY","196608:ADSVCYI","196608:DSVCYIK","196608:SVCYIKJ","196608:VCYIKJv","196608:CYIKJv3","196608:YIKJv3L","196608:IKJv3L0","196608:KJv3L03","196608:Jv3L03J","196608:v3L03J3","196608:3L03J3O","196608:L03J3Ov","196608:03J3OvT","196608:3J3OvT5","196608:J3OvT5A","196608:3OvT5Aa","196608:OvT5AaC","98304:FLkUITN","98304:LkUITNW","98304:kUITNWx","98304:UITNWxD","98304:ITNWxDS","98304:TNWxDSV","98304:NWxDSVC","98304:WxDSVCY","98304:xDSVCYR","98304:DSVCYR5","98304:SVCYR5o","98304:VCYR5oZ","98304:CYR5oZ3","98304:YR5oZ3O","98304:R5oZ3Ov","98304:5oZ3Ovt"],"imphash":"ac7fea314b24e73e5210853faa5ffda6"},"file_info":{"file_name":"Центр управления восстановлением ДНР справка-доклад за 13 октября 2015 года.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5192704,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288365000,"last_seen":1651632186000,"last_multi_scan":1651632186000}},"detections":{"summary":{"verdict":"malicious","score":57,"tags":null},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":17,"suspicious_count":13,"malicious_count":2,"total":32},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Prikormka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.fzsa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.286954","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.286954 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Prikormka.CM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005714121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Prikormka.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericR-HQJ!4F3ED209C1A8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Prikormka.ejerjd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Prikormka.5192704","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.EX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Prikormka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Prikormka","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 41095-268-0041BACB\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018361-00002304-57003-17-00F98081\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018361-00002304-57003-16-00F9EDFA\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018361-00002304-57003-1060-00FA5A9A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00018361-00002304-57003-1884-00F9C2C1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API InitCommonControls@COMCTL32.DLL at 00018361-00002304-57003-329-00F91288\n Found reference to API InitCommonControlsEx@COMCTL32.DLL at 00018361-00002304-57003-333-00F9132B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTime@KERNEL32.DLL at 00018361-00002304-57003-349-00F87930\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018361-00002304-57003-229-00F9D202\n GetSystemTime@KERNEL32.DLL at 00018361-00002304-57003-352-00F87B10","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 41095-323-00422418\n GetTimeZoneInformation@KERNEL32.DLL at 00018361-00002304-57003-425-00FA2418","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 41095-386-0040EEAF\n GetVersionExW@KERNEL32.DLL at 00018361-00002304-57003-317-00F91B97\n GetVersion@KERNEL32.DLL at 00018361-00002304-57003-411-00F870F0\n GetVersionExA@KERNEL32.DLL at 00018361-00002304-57003-544-00F8EEAF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 41095-292-004275C0\n GetProcessHeap@KERNEL32.DLL at 00018361-00002304-57003-391-00FA75C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"wallejob.in.ua\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.68.16.35:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\My\\Projects_All\\2015\\wallex\\helpldr(wallex)\\Release\\helpldr.pdb\"\n \"D:\\My\\Projects_All\\2015\\samlib_2.0\\Release\\samlib.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\archive.rar\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET http://wallejob.in.ua/wd.php?sn=2120161230091201&rb=7&ob=R_pol_x&bt=0 HTTP/1.1\nUser-agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)\nHost: wallejob.in.ua\nAccept: */*\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"archive.rar\" has type \"gzip compressed data from NTFS filesystem (NT)\"\n \"helpldr.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"samlib.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"rbcon.ini\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\rbcon.ini\"\n \"\" touched file \"%WINDIR%\\helpldr.dll\"\n \"\" touched file \"%WINDIR%\\samlib.dll\"\n \"\" touched file \"%WINDIR%\\ntshrui.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://wallejob.in.ua/wd.php?sn=2120161230091201&rb=7&ob=R_pol_x&bt=0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.9864475144","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"00180000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00018361-00002304-57003-158-00F8A508\n FindResourceW@KERNEL32.DLL at 00018361-00002304-57003-562-00F8B999\n LockResource@KERNEL32.DLL at 00018361-00002304-57003-159-00F8A4AB\n LockResource@KERNEL32.DLL at 00018361-00002304-57003-300-00F8BB92\n FindResourceW@KERNEL32.DLL at 00018361-00002304-57003-535-00F9430C\n FindResourceW@KERNEL32.DLL at 00018361-00002304-57003-349-00F87930\n FindResourceW@KERNEL32.DLL at 00018361-00002304-57003-299-00F88070\n FindResourceW@KERNEL32.DLL at 00018361-00002304-57003-673-00F8B6FA","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"helpldr.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"samlib.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"185.68.16.35\"\n \"1.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"]vM=m5\"","origin":"Network Traffic","relevance":5,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00018361-00002304-57003-514-00F86E40","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\_13_2015_.exe\" marked \"%TEMP%\\archive.rar\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\archive.rar\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"helpldr.dll\" claimed CRC 118023 while the actual is CRC 5198441","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegCloseKey\n OpenProcessToken\n RegOpenKeyExW\n RegEnumKeyW\n RegDeleteKeyW\n RegOpenKeyW\n GetFileAttributesW\n GetTempPathW\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetVersionExW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n WriteFile\n CreateFileW\n CreateFileA\n Process32NextW\n LockResource\n GetCommandLineW\n Process32FirstW\n GetModuleHandleA\n GetModuleHandleW\n FindResourceW\n Sleep\n VirtualAlloc\n GetLastActivePopup\n SetWindowsHookExW\n GetWindowThreadProcessId\n RegOpenKeyExA\n GetCommandLineA\n CreateThread\n recv (Ordinal #16)\n connect (Ordinal #4)\n socket (Ordinal #23)\n send (Ordinal #19)\n closesocket (Ordinal #3)\n WSAStartup (Ordinal #115)","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"37/56 Antivirus vendors marked dropped file \"helpldr.dll\" as malicious (classified as \"Trojan.Generic\" with 66% detection rate)\n 38/80 Antivirus vendors marked dropped file \"samlib.dll\" as malicious (classified as \"Trojan.GenericKD\" with 47% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"185.68.16.35\" (ASN: , Owner: ): ...\nURL: http://wood-house.com.ua/ (AV positives: 2/68 scanned on 12/27/2016 16:55:43)\n URL: http://wallejob.in.ua/ (AV positives: 5/68 scanned on 11/17/2016 02:10:28)\n URL: http://zarabatak.ru/ (AV positives: 1/68 scanned on 07/20/2016 10:59:29)\n URL: http://psh.co.ua/ (AV positives: 1/68 scanned on 07/14/2016 04:35:37)\n URL: http://sem-dev.co.ua/ (AV positives: 1/68 scanned on 07/14/2016 04:33:23)\n File SHA256: f9a96ad58fb946981d196d653ec28fa31d6f946a7e2f6784b317dd9adc557b62 (AV positives: 52/57 scanned on 04/30/2016 07:33:42)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":25,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"586673d1aac2ed505a6bb261","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":57,"contacted_countries":["UKR"],"submit_name":"Центр управления восстановлением ДНР справка-доклад за 13 октября 2015 года.exe","analysis_start_time":"2016-12-30T15:49:22+00:00","indicators_count":{"informative":17,"suspicious":15,"malicious":2},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.68.16.35","port":80,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}],"dns_resolutions":[{"domain":"wallejob.in.ua","address":"185.68.16.35","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}],"http_requests":[{"host":"185.68.16.35","host_ip":"185.68.16.35:80","url":"http://wallejob.in.ua/wd.php?sn=2120161230091201&rb=7&ob=R_pol_x&bt=0","method":"GET","response_code":"200","response_phrase":"OK","header":"GET http://wallejob.in.ua/wd.php?sn=2120161230091201&rb=7&ob=R_pol_x&bt=0 HTTP/1.1\nUser-agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32)\nHost: wallejob.in.ua\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}],"processes":[{"pid":2304,"ppid":0,"name":"_13_2015_.exe","command_line":"","normalized_path":"C:\\_13_2015_.exe","uid":"00018361-00002304","icon":"$28"}],"all_imported_dlls":["shell32.dll","oleaut32.dll","userenv.dll","user32.dll","advapi32.dll","shlwapi.dll","imm32.dll","msctf.dll","uxtheme.dll","clbcatq.dll","msvcrt.dll","ntdll.dll","kernel32.dll","rpcrt4.dll","ole32.dll","comctl32.dll","dwmapi.dll","cryptbase.dll","tzres.dll","KernelBase.dll","profapi.dll","gdi32.dll","lpk.dll","usp10.dll","sechost.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"helpldr.dll","sha256":"33b09887fca313d4074b713697180e22747a18fe1e8d7c35db222399360e0d6d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"name":"samlib.dll","sha256":"96cfa5e0bcfd905e571db378bc9938d1465755ec55c5c1df41ee739cfa06d000","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"name":"archive.rar","sha256":"9f15acf080b36c725f7850eb67abcc359e014a1b693c4d565c459888ff19c516","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"name":"rbcon.ini","sha256":"fbe4fcb754ab36107db4f833edb6d7efdb992e18e2c7830f01dcd5848267012a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"C:\\??????? ??????? ?? 13.10.2015.xlsm","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\rbcon.ini","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\helpldr.dll","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\samlib.dll","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%WINDIR%\\ntshrui.dll","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]},{"path":"%USERPROFILE%\\rindex.dat","sources":[{"report_type":"sandbox","report_id":"586673d1aac2ed505a6bb261"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["586673d1aac2ed505a6bb261"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Prikormka Sample 4eaf154ce897… — Score 57/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 4eaf154ce897…. Malware family: Trojan.Prikormka. Threat score 57/100. 15/26 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Prikormka Sample 4eaf154ce897… — Score 57/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 4eaf154ce897…. Malware family: Trojan.Prikormka. Threat score 57/100. 15/26 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/4eaf154ce8974228db6e35a1364337a12b821b73f052a44dc24ebdf0c1da6a4e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Prikormka Sample 4eaf154ce897… — Score 57/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 4eaf154ce897…. Malware family: Trojan.Prikormka. Threat score 57/100. 15/26 AV engines flagged this file. 2 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]