24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.KillMBR Sample 510f83af3c41… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 510f83af3c41…. Malware family: Trojan.KillMBR. Threat score 100/100. 22/24 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff","keywords":["Malicious","Trojan.KillMBR","malware analysis","sandbox report","threat intelligence","510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff"],"about":{"@type":"SoftwareApplication","name":"sample_136","applicationCategory":["peexe","executable"],"identifier":"510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.KillMBR","antivirusDetections":{"malicious":22,"total":24},"behavioralIndicators":{"malicious":8,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T71d,Found dropped filename "PSPUBWS.lnk" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allcnet.gazeta[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@c.appier[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@brothersoft[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@58[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@bidr.trellian[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@adtechjp[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@bidswitch[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@adyun[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@ads.linkedin[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@360doc[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@apple[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allrecipes[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@btrll[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@areyouahuman[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allocine[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@biglobe.ne[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "PSPUBWS.bmp" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@adtech[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@bestbuy[1].txt" containing the Windows username "PSPUBWS"26:T8d6,"C:\sample_136.exe" marked "C:\$Recycle.Bin\S-1-5-21-4162757579-3804539371-4239455898-1000\desktop.ini" for deletion "C:\sample_136.exe" marked "C:\autoexec.bat" for deletion "C:\sample_136.exe" marked "C:\config.sys" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.msi" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\ose.exe" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-001B-0409-0000-0000000FF1CE}-C\Setup.xml" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\osetup.dll" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-002C-0409-0000-0000000FF1CE}-C\Proof.en\Proof.cab" for deletion "C:\sample_136.exe" marked "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PubLR.cab" for deletion27:T78d,"" opened "C:\$Recycle.Bin\S-1-5-21-4162757579-3804539371-4239455898-1000\desktop.ini" with delete access "" opened "C:\$Recycle.Bin\S-1-5-21-4162757579-3804539371-4239455898-1000\" with delete access "" opened "C:\$Recycle.Bin\" with delete access "" opened "C:\" with delete access "" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0012-0000-0000-0000000FF1CE}-C\Office64WW.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi" with delete access "" opened "C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\Setup.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\" with delete access "" opened "C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.xml" with delete access "" opened "C:\MSOCache\All Users\{90140000-001A-0409-0000-0000000FF1CE}-C\OutlkLR.cab" with delete access28:T417,"" wrote 512 bytes to file "\DEVICE\HARDDISK0\DR0" (Byte Offset: 1048576): PR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPES ... "" wrote 512 bytes to file "\DEVICE\HARDDISK0\DR0" (Byte Offset: 105906176): PR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPES ... "" wrote 512 bytes to file "\DEVICE\HARDDISK0\DR0" (Byte Offset: 0): PR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPESPR!NCPES ...29:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790708687490,"unified_at":"2026-09-29T19:04:47.490Z","metadata":{"hashes":{"sha256":"510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff","sha1":"70e0adfa9d867c3b950c0be5b83894d99020bdff","md5":"0a8032cd6b4a710b1771a080fa09fb87","sha512":"2fa364a32226a62e9456979d5a50492f97a3bbd25c844c789a0a493a7731e329b9f1b2be5b561b568b12261c393dd78d6c19261f741f76edd884fd99f625c6b0","ssdeep":"192:0Us5GwnEGjGlCdB0ttzRlQIwbzkBTkVYe/m2noM1qtT57MkJRVtyycpc7numoZ9:fs5GwfClCcCk1jeODMEN5yycpcrumoZ","ssdeep_chunks":["192:0Us5Gwn","192:Us5GwnE","192:s5GwnEG","192:5GwnEGj","192:GwnEGjG","192:wnEGjGl","192:nEGjGlC","192:EGjGlCd","192:GjGlCdB","192:jGlCdB0","192:GlCdB0t","192:lCdB0tt","192:CdB0ttz","192:dB0ttzR","192:B0ttzRl","192:0ttzRlQ","192:ttzRlQI","192:tzRlQIw","192:zRlQIwb","192:RlQIwbz","192:lQIwbzk","192:QIwbzkB","192:IwbzkBT","192:wbzkBTk","192:bzkBTkV","192:zkBTkVY","192:kBTkVYe","192:BTkVYe/","192:TkVYe/m","192:kVYe/m2","192:VYe/m2n","192:Ye/m2no","192:e/m2noM","192:/m2noM1","192:m2noM1q","192:2noM1qt","192:noM1qtT","192:oM1qtT5","192:M1qtT57","192:1qtT57M","192:qtT57Mk","192:tT57MkJ","192:T57MkJR","192:57MkJRV","192:7MkJRVt","192:MkJRVty","192:kJRVtyy","192:JRVtyyc","192:RVtyycp","192:Vtyycpc","192:tyycpc7","192:yycpc7n","192:ycpc7nu","192:cpc7num","192:pc7numo","192:c7numoZ","192:7numoZ9","384:0Us5Gwn","384:Us5GwnE","384:s5GwnEG","384:5GwnEGj","384:GwnEGjG","384:wnEGjGl","384:nEGjGlC","384:EGjGlCd","384:GjGlCdB","384:jGlCdB0","384:GlCdB0t","384:lCdB0tt","384:CdB0ttz","384:dB0ttzR","384:B0ttzRl","384:0ttzRlQ","384:ttzRlQI","384:tzRlQIw","384:zRlQIwb","384:RlQIwbz","384:lQIwbzk","384:QIwbzkB","384:IwbzkBT","384:wbzkBTk","384:bzkBTkV","384:zkBTkVY","384:kBTkVYe","384:BTkVYe/","384:TkVYe/m","384:kVYe/m2","384:VYe/m2n","384:Ye/m2no","384:e/m2noM","384:/m2noM1","384:m2noM1q","384:2noM1qt","384:noM1qtT","384:oM1qtT5","384:M1qtT57","384:1qtT57M","384:qtT57Mk","384:tT57MkJ","384:T57MkJR","384:57MkJRV","384:7MkJRVt","384:MkJRVty","384:kJRVtyy","384:JRVtyyc","384:RVtyycp","384:Vtyycpc","384:tyycpc7","384:yycpc7n","384:ycpc7nu","384:cpc7num","384:pc7numo","384:c7numoZ","384:7numoZ9","192:fs5GwfC","192:s5GwfCl","192:5GwfClC","192:GwfClCc","192:wfClCcC","192:fClCcCk","192:ClCcCk1","192:lCcCk1j","192:CcCk1je","192:cCk1jeO","192:Ck1jeOD","192:k1jeODM","192:1jeODME","192:jeODMEN","192:eODMEN5","192:ODMEN5y","192:DMEN5yy","192:MEN5yyc","192:EN5yycp","192:N5yycpc","192:5yycpcr","192:yycpcru","192:ycpcrum","192:cpcrumo","192:pcrumoZ"],"imphash":"8cf2375491e257d65da71e5d263d7df7"},"file_info":{"file_name":"sample_136","file_type":["peexe","executable"],"file_type_id":"exe","file_size":24576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1514292146000,"last_seen":1786242919000,"last_multi_scan":1786242919000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["hastitiwiper","silentchollima","targeted","dembr","gop","guardianofpeace","hastiti","operationtroy","whoisteam"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":10,"suspicious_count":10,"malicious_count":8,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Agent.24576.JPH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.EraseMBR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.DarkSeoul.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.KillMBR.U","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-36952","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.KillMBR.U (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.AXFE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Trojan.EraseMBR.b.hkwv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.dg!ep-95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/KillSys.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0040f2721 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"capa_accept_command_line_arguments","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/MBRKill-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.KillMBR.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"KillMBR-FBIA.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Trojan.PWXZ-0300","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Generic.AWZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.EraseMBR.Win32.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.KillMBR","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"malicious","value":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"tactic":"","technique":"File System Logical Offsets","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1006","identifiers":[{"type":"malicious","value":"Writes to the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]}],"sandbox_signatures":[{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a422a757ca3e17e83708b74"},{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n WriteFile\n GetStartupInfoA\n TerminateProcess\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a422a757ca3e17e83708b74"},{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/65 Antivirus vendors marked sample as malicious (84% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a422a757ca3e17e83708b74"},{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/65 Antivirus vendors marked sample as malicious (84% detection rate)\n 9/11 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a422a757ca3e17e83708b74"},{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"shutdown.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM pasvc.exe\" (UID: 00015418-00003748)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM clisvc.exe\" (UID: 00015420-00002504)\n Spawned process \"shutdown.exe\" with commandline \"shutdown -r -t 0\" (UID: 00017424-00005496)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM pasvc.exe\" (UID: 00015418-00003748)\n Spawned process \"taskkill.exe\" with commandline \"taskkill /F /IM clisvc.exe\" (UID: 00015420-00002504)\n Spawned process \"shutdown.exe\" with commandline \"shutdown -r -t 0\" (UID: 00017424-00005496)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Accessed IE Quick Launch directory","description":"\"\" obtained handle to \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":10,"id":"handle-2","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"autoexec.bat\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"fastfuzzer.lnk\" has type \"data\"\n \"Narrator.lnk\" has type \"data\"\n \"Adobe Reader XI.lnk\" has type \"data\"\n \"Downloads.lnk\" has type \"data\"\n \"OfficeMUISet.msi\" has type \"data\"\n \"Private Character Editor.lnk\" has type \"data\"\n \"MineSweeper.lnk\" has type \"data\"\n \"Desktop background.lnk\" has type \"data\"\n \"PidGenX.dll\" has type \"data\"\n \"Magnify.lnk\" has type \"data\"\n \"dH1rDN9f9.doc\" has type \"data\"\n \"dwintl20.dll\" has type \"data\"\n \"DW20.EXE\" has type \"data\"\n \"Launch Internet Explorer Browser.lnk\" has type \"data\"\n \"Command Prompt.lnk\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"Proof.msi\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"taskkill.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"taskkill.exe\" touched file \"%WINDIR%\\System32\\en-US\\taskkill.exe.mui\"\n \"taskkill.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"taskkill.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"shutdown.exe\" touched file \"%WINDIR%\\System32\\en-US\\shutdown.exe.mui\"\n \"shutdown.exe\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \"shutdown.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"taskkill.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"taskkill.exe\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Writes to a desktop.ini file (may be used to cloak folders)","description":"\"\" wrote to file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" wrote to file \"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini\"","origin":"API Call","relevance":3,"id":"api-34","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$25","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries physical drive (often used to detect virtual machines)","description":"\"\" opened \"PhysicalDrive1\"\n \"\" opened \"PhysicalDrive2\"\n \"\" opened \"PhysicalDrive3\"\n \"\" opened \"PhysicalDrive4\"","origin":"API Call","relevance":10,"id":"api-50","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\taskkill.exe\", Handle: 68)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1910 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$26","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetLastActivePopup\" (Source: sample_136.exe.bin, API is part of module: USER32.DLL)\n Found string \"GetActiveWindow\" (Source: sample_136.exe.bin, API is part of module: USER32.DLL)\n Found string \"MessageBoxA\" (Source: sample_136.exe.bin, API is part of module: USER32.DLL)","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM pasvc.exe\" (UID: 00015418-00003748)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM clisvc.exe\" (UID: 00015420-00002504)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"\" allocated memory in \"\\Device\\Harddisk0\\DR0\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 68)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 68)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 68)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes to the primary disk partition (DR0)","description":"$28","origin":"API Call","mitre_attack_id":"T1006","relevance":10,"id":"api-60","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to access unusual system drive letters","description":"\"\" touched \"K:\"\n \"\" touched \"L:\"\n \"\" touched \"M:\"\n \"\" touched \"N:\"\n \"\" touched \"O:\"\n \"\" touched \"P:\"\n \"\" touched \"Q:\"\n \"\" touched \"R:\"\n \"\" touched \"S:\"\n \"\" touched \"T:\"\n \"\" touched \"U:\"\n \"\" touched \"V:\"\n \"\" touched \"W:\"\n \"\" touched \"X:\"\n \"\" touched \"Y:\"","origin":"API Call","mitre_attack_id":"T1083","relevance":9,"id":"api-31","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Writes to the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Tries to access unusual system drive letters"}],"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":36,"dropped_files_count":0,"extracted_files_count":99,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["hastitiwiper","silentchollima","targeted","dembr","gop","guardianofpeace","hastiti","operationtroy","whoisteam"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"5b5807867ca3e1773a67cbc3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.KillMBR","submit_name":"sample_136","analysis_start_time":"2018-07-25T06:12:24+00:00","indicators_count":{"informative":10,"suspicious":10,"malicious":10},"tags":["Extracted Files"],"is_in_unified_schema":true},{"id":"5a422a757ca3e17e83708b74","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":93,"malware_family":"Trojan.KillMBR","submit_name":"OTX_510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff","analysis_start_time":"2017-12-26T13:28:15+00:00","indicators_count":{"informative":1,"suspicious":1,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}],"processes":[{"pid":2852,"ppid":0,"name":"sample_136.exe","command_line":"","sha256":"510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff","normalized_path":"C:\\sample_136.exe","uid":"00015211-00002852","icon":"$29"},{"pid":3748,"ppid":2852,"name":"taskkill.exe","command_line":"taskkill /F /IM pasvc.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00015211-00002852","uid":"00015418-00003748"},{"pid":2504,"ppid":2852,"name":"taskkill.exe","command_line":"taskkill /F /IM clisvc.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00015211-00002852","uid":"00015420-00002504"},{"pid":5496,"ppid":2852,"name":"shutdown.exe","command_line":"shutdown -r -t 0","sha256":"4f7ced626f7ddeeddbbfb242283c30d290532d7c9fd9e093b2234f51800e960d","normalized_path":"%WINDIR%\\System32\\shutdown.exe","parent_uid":"00015211-00002852","uid":"00017424-00005496"}],"all_imported_dlls":["framedynos.dll","sechost.dll","usp10.dll","apphelp.dll","version.dll","mpr.dll","ole32.dll","cryptbase.dll","kernel32.dll","imm32.dll","msctf.dll","secur32.dll","advapi32.dll","user32.dll","wbemcomn.dll","msvcrt.dll","rpcrt4.dll","lpk.dll","nsi.dll","netutils.dll","winsta.dll","wtsapi32.dll","srvcli.dll","sspicli.dll","ws2_32.dll","shlwapi.dll","rpcss.dll","oleaut32.dll","clbcatq.dll","ntdll.dll","dbghelp.dll","wbemprox.dll","wkscli.dll","KernelBase.dll","gdi32.dll","netapi32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GlobData","sha256":"0843c4412c3abee7088fa4ab9e3af298e561050502620724f40742806fa92e9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"addressbook.acrodata","sha256":"a4d1346a104d7fe2f58dcbfe1c64aef6f6e61d83ee4dc459e4df34572ee67d50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"4fdb3bd72688edd3ecf44432bff0fb73bc98744fcf537f00931645154b934edc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Building Blocks.dotx","sha256":"9f839c135f5397cf77471819df32e0fca2f4fb41bb22c26b090471ddf99a9550","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"InstallTime20150122214805","sha256":"7b03afc18640938f4031744a967fb04a951d7bba7e3a5f2141f1b35fd72852d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"addons.json","sha256":"0dfdf29ce971c005bb46e7cacf264d673161fa41dd24da631707bb4c16c5ac32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"profiles.ini","sha256":"77e97ff123593e1116784d18cd39f7f165cd6600b44be694fd4962f1cfc70d2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"AdobeCMapFnt11.lst","sha256":"df8f2058845bea9cf71c09f6bf6b2446fbbb85ac73814053a4ae4f3ed99ffd81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"ACECache11.lst","sha256":"4db246e0ffdad1cb63c93aa966042d6ad5f1c17f381f34171eb5012839c9a52f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"GDIPFONTCACHEV1.DAT","sha256":"4d2991589c213b91f1cb679edcfdd7181ec8160ef78ae4c9888803d1e62fe7bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"000F7F8FAB2D96E6F8CBD5C9A3B4EC90","sha256":"1211207ca5dd19ead67842ffb6499333b42a4b04cfcfd1bf04c32247effeba2e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"deployment.properties","sha256":"7ac7e368912c945764d3337c01a4f6237c325b56a68ba659c4bf30185d0ff5db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"LZMA_EXE","sha256":"f81da3c673c0f69f5763413050bd443a3e03f2a5d79ad2d535adaed159882628","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Office64WW.msi","sha256":"94371caee5e33f89432c0a62d65186802e0fac3de0de7bc1572ef360c8079c69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Office64WW.xml","sha256":"1a71fec0dd5bd1955da005e659b089a348b177944ca395d98a7da4acca2d4898","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"PidGenX.dll","sha256":"058990bc03ba3d84f8d17502209bb65548c195077cf53ff36b886331ff5cc5ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"ose.exe","sha256":"fbdf87c6959bcac35c7c4657874e54b25881165a8d2cddbca9d7c79313c2b996","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"pkeyconfig-office.xrm-ms","sha256":"82918568214f6de0356e2aa29e68644ac00681e00aa49e41c6720cad1fa61ddf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"ExcelMUI.msi","sha256":"7ec8a4038cb372f40f9e54c7cdeecd1d0b7e5c2c847dbcdf72d60f440e0a5e64","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"PowerPointMUI.msi","sha256":"0d7ac700b1295b5fde3a615a40d766cf5a84dd13529f283511929f91c39702ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"PublisherMUI.msi","sha256":"465d5edf1f5e4ffe1a04320370f1c9af1fa9c2e31420896c30ebb321df1b08fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"OutlookMUI.msi","sha256":"5b52a319a1f32cf528624713beb2f46ee36cab9d665f1a5003edf8513ad659c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Proof.msi","sha256":"64ed87a9f21941e5ca1b2a5daebf61dbb8adc85538da887a7d51b49673147e51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Proofing.msi","sha256":"18e90b8a4fc6ceabcca56401204a4991d1bf126bd52186e82597b66d8d6ac109","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"OneNoteMUI.msi","sha256":"efc39ee15e9d991f57a4b99199e1d3f9eb11103192fb1d1bad2d638903670aad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"dwintl20.dll","sha256":"508e9eaf12dcce16ac01e01dce331e301ed085e07a9b0227ae9d1e77ee625b88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"DW20.EXE","sha256":"0e5efc90a024c0873dce0796988499a1b5fb7ec355f6e0aaede632e5dc88a3cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"dwdcw20.dll","sha256":"50ee57f69a60ef6cca03399efdf03b3f665e6b176865b3fac4a53b52680049d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"dwtrig20.exe","sha256":"b1049e34679e56e0148188a3c0f38d541dd0f31d0406a1863a03c82e481ee6dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"autoexec.bat","sha256":"5f3f22762980eb795b8743ccd4e015e357d33cd85beb7a0f687e75b9a3d0b18e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"fbc68282619a3cfa682a7cd32b012889bac9a0da4c019f9d728453cba12a8336","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"fastfuzzer.lnk","sha256":"1a80fb507a3ee443bc7d56dbff9a06474ea427b3604fd99263a61eb0d5afdc36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Narrator.lnk","sha256":"8fecc94e0dcefd1d784c36fe88b33caa8de0580bd60096dcada3bb395ab5196b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Adobe Reader XI.lnk","sha256":"0f057fd7dbae6eeb845f797c6083b96e507c4ef3733a48a8e91e0dce3541e81c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Downloads.lnk","sha256":"ee412d6e4b9d913b64050fdbfdf472ad10554892da95f5d282cd0f980dedf9f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"OfficeMUISet.msi","sha256":"a7d4cff7c1d23ed800d0ad5be57f11376b94a817b9ea3b8a44cb7accee8c8e24","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Private Character Editor.lnk","sha256":"ff559c53c5fa8c32ea39d6c6adff12be4000cdf02b6180d7b0bb0d6a6ca956f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"MineSweeper.lnk","sha256":"1790522efc2ebfb4314696f7e717ce5f2f5a2387c7ca2178d29cd5490605a0ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Desktop background.lnk","sha256":"8a64bce587bcc59b95da70947080d68a66557c46eaae9411822d43ab440116d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Magnify.lnk","sha256":"488ade324e21f0a60f7adf834d59ab7f2d92cdeb9b7bb4a37b06eaa59d70de8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"dH1rDN9f9.doc","sha256":"977017422c547a3742bc30e14a12491efd766bccab11663060cb1e22649b675c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Launch Internet Explorer Browser.lnk","sha256":"cbbedd92bf56c0bd66b5857bbacf5cb58ab119ea2e55541e6aa7c64e9679aac5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Command Prompt.lnk","sha256":"6bd6f818a4a75cde8a7dd83ec2df09c947b525de834d012ae02c634aee903715","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"6SZfLTu9z.doc","sha256":"a950d7d701a3c8915251746eb5309b1af6adb998939c5684e5dd45db5f341791","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Internet Explorer.lnk","sha256":"be4b0974725121e81e1c7d019d351374b2baba358fe49c8b88c63c6a10bb76df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"d3c1d3fdec1d7757229ab5c7fb93d5dcb023f79d47c2ec54cfa475e4063e2b67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"msvcr90.dll","sha256":"44aeb1efde874b5b34a5dea5ef946137e9783aefd6a97ae13b43699286e2d4a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Help.lnk","sha256":"20e4d1302fa03639d1f1c10a10834cb5d1bab10d3ab376c4d6926caeceb9fe86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"computer.lnk","sha256":"362308332e3e854589bbb31d7c38611c456eea6872c2fe25dfcec9a47a1a4a68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"C04T72pR0Bcl.doc","sha256":"0f80975656ec3b79d7c9144c1e5cfade33696b3ff2bd5c753524aaa007231f2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Desktop.lnk","sha256":"3f0e047486a515f2b0c2ccdab8922053fe62fa1ae31593651bc14ac70c1a1b0a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Programs.lnk","sha256":"9310b368ca0c11d9f14e5ca2ba5af9598fe6b4617c419325dedea8f506f6ad32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Mozilla Firefox.lnk","sha256":"c471812f5bbed59e22b9cb1ada0fcb6dd62a335a85767716f66b13cc433978b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Google Chrome.lnk","sha256":"30d7daceaa38db120a993b2c2d9531d2f520be2a12e6561bc5003546205086c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Appearance and Personalization.lnk","sha256":"24fff044e7fab4db5818a98726b036168846765b099963ca3d6c1a946f7d625a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"On-Screen Keyboard.lnk","sha256":"6acc54e27206a63b8063981a8a0dcece37c6863922d3d87b1e53825979f0dd41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"pss10r.chm","sha256":"522b4b47ff4bd477195fd50bf98eaeb61036ebad469d12e36e728c25b2c54478","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"fuzzer.lnk","sha256":"d68a76700c5e68cb612656b7da1c9f7c945c445b6f2612900c8987af425ebe00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Notepad.lnk","sha256":"65a150e1de1d6d27dcffc5d8b5a6c20ea3791f2dc5dea1d479779d513f30ee45","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"06200e53a066b4c62366f204295af847bc7e36f754cb7394ecd693d07218a0ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Fax Recipient.lnk","sha256":"2ecd86fd623b21ff159653bc0987d7ce7a3c50e70e2b30b4b70c04b3c5e6c8ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"c1a1ded778eefeb33da0c7a3be468a68f9dcbf2bc0a16a4e50b383e0fd260f50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"dskCEJ.exe","sha256":"b745c85909186e10a1ebb9d1324831ec821b985b74d31b4c77fc98f1d513cc51","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"kY01UeAiy5.exe","sha256":"6d207ca9b53bcf772ecd715eb19edeca450d9e6b7da42465251ddeab891acb69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Internet Explorer (No Add-ons).lnk","sha256":"24212bf7f5bfccf7cecd714dff9dbfca2a130b8dce2c59162f8dfb838a17481b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Action Center.lnk","sha256":"a69a6cf932ac925cc7fe668c42bb41edebfacf0804dc27c8f5550ce30f939764","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"hlchPBL.exe","sha256":"3ac77def029bfc4948f17a96549b3d59a7cfc75c1d9a2b389bcf52946a4e5606","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"bg3oTe.doc","sha256":"e19a13d4d4c78653b8a224c06d3d10f31bf5091c0f7485630bba5f9578a1531c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Ease of Access.lnk","sha256":"ea8acd882f86fd7eaf5bb9987bf84700b92f301fff76f22bfcc4b0cd1b059be2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"0zIG0D.doc","sha256":"0e0d309e772c3dd5ff12ba0ef537b376fd8d01a13748af8996f298044e0b9b72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"New Microsoft Word Document.LNK","sha256":"af1ebbbc76c62236a8bd8cd3d38ae13c6e9539d6320be0ce2b9cc78a2e3f9241","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"a3Ntx.exe","sha256":"fdb70fc8432806ca7f4967c598f633c898877aa7cdef4d52c7c230b25ea7b503","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Network and Internet.lnk","sha256":"e3d5bdfd8eb91517096f0995c2ac6d498fe50cfa49de0f3b0eba74a770b44c98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"pinned.lnk","sha256":"73fc99d0682209b99cffcffb43ef0b59e739a9f6c81fd3ac6b57b35a89410a41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"iLLOga.exe","sha256":"e955a8436d0b460c64da75382e90e2f953fd3d27df7583a7e154a38b3a59433e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"OfficeMUI.msi","sha256":"b88b5194266b80817903000148335ef6609884abb04f7de7ce4c2eba661ae229","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"New Microsoft Word Document.lnk","sha256":"bb3a7f0738e1db1232db8defed13c1dbec857d6777cd1086b72257931677c106","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"java.exe","sha256":"b64decc8a0db696cdfec123b7042a09652267e8a57b12c83923a456c69011123","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"klmqz.doc","sha256":"7497f76a0669dd3974556aa965641aba6645325aa04287ad76958d53fe9a5fba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"mtgFs8Za.doc","sha256":"8166033baee21a95dc6b60918556c16e49bd140027d74d56ef75615f5e1399ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"bvYkKJ33N9A.exe","sha256":"514635190ac491b2cd431b58e5cfde0638447b49e2677d4dd9149104b5b0d17b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Display.lnk","sha256":"61b52f3802000f379b8293a1bb5cea9348efddb1abd85bb6f9b41772c0502464","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"F3hzum1.doc","sha256":"1062c4e68f1d5228753d727c2570d13a1b414041941b98c49468c72eb7b1d35e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"PSPUBWS.lnk","sha256":"fab038517f6d20c5a60a4d442be1a6ffff74f57edb84bb98b44a561e9b2fc051","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"hKY8.doc","sha256":"126995ec250f858117a8863b8c2ed5c01a1a225f40872f33a09b936c39b40d5e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"09df786e07345422d590968f22b4474d5741d52060b86582d0b4c7866c550018","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"46d945f4872b01fff2f695144bde7dc61fec5f9e060c186d4fb018238952f11a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"EKeaJO.doc","sha256":"d8d398464b0eee0a080a68238911629210597198df7345b80b9644ba475ac784","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Control Panel.lnk","sha256":"6cf5541169941345768f7e54cefea38f75c206905f15eb1399e023fe75f5a763","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"1aacc8a277926433cca7d607bacfc61b1373a706c3732f7e0f55b7ad75fd0a4e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Office12 OEM.lnk","sha256":"cf187385755806c6eee34f4ab9d93f5d7ca258263ab114d8f6d689179e2a1664","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Display (2).lnk","sha256":"af0689b04e59db9db8c7d7d3e3f4a3ef91c038284d605716aea0d79a55934d0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"dgQJde60mPXhI.exe","sha256":"f819f8341702fd6774e5aba9b24deb4ed31734c1ec1ade9745dd675f8cdb4b89","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Paint.lnk","sha256":"8c921871701382bc1a11d4196dce099f146ee13eb77f236bdf6826a5e416bed3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"osetupui.dll","sha256":"fd04165bc396e178d5ccfbfe8b26f185930f964f33bdf7602c0455a17449a257","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"92f94178b19708562690fd69560660f17c7dcbce642465e5d4f9cc81562a113e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"NormalOld.dotm","sha256":"4cdae8862fdd49935b95eb84044706d9c87f9bacb957e3ee72914465d812e128","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Normal.dotm","sha256":"01b54f4aaa0c61e726971562b2e32c5dd80094d464a1f8093bafdeb221bcd6a0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"name":"Built-In Building Blocks.dotx","sha256":"532e1a89beea8e92bcf9fe6c662e557c85ec95a9deed0c1875be2c90ef97226b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.en\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Proof.fr\\Proof.xml","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-002C-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001B-0409-0000-0000000FF1CE}-C\\WordMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\sample_136.exe","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeCMapFnt11.lst","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Color\\ACECache11.lst","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\GDIPFONTCACHEV1.DAT","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-001A-0409-0000-0000000FF1CE}-C\\Setup.xml","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\000F7F8FAB2D96E6F8CBD5C9A3B4EC90","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Sun\\Java\\AU\\LZMA_EXE","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%USERPROFILE%\\Desktop\\Calculator.lnk","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\000F7F8FAB2D96E6F8CBD5C9A3B4EC90","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%LOCALAPPDATA%\\ow\\Sun\\Java\\Deployment\\deployment.properties","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%USERPROFILE%\\Desktop background.png","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\addressbook.acrodata","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0115-0409-0000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Wireshark\\recent","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Microsoft\\Document Building Blocks\\1031\\Building Blocks.dotx","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\addons.json","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Crash Reports\\InstallTime20150122214805","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\profiles.ini","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%WINDIR%\\System32\\en-US\\shutdown.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RELIABILITY\\USERDEFINED\\","sources":[{"report_type":"sandbox","report_id":"5b5807867ca3e1773a67cbc3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5b5807867ca3e1773a67cbc3","5a422a757ca3e17e83708b74"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.KillMBR Sample 510f83af3c41… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 510f83af3c41…. Malware family: Trojan.KillMBR. Threat score 100/100. 22/24 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.KillMBR Sample 510f83af3c41… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 510f83af3c41…. Malware family: Trojan.KillMBR. Threat score 100/100. 22/24 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/510f83af3c41f9892040a8a80b4f3a4736eebee2ec4a7d4bfee63dbe44d7ecff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.KillMBR Sample 510f83af3c41… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 510f83af3c41…. Malware family: Trojan.KillMBR. Threat score 100/100. 22/24 AV engines flagged this file. 8 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]