21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 51e84accb6d3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 51e84accb6d3…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff"],"about":{"@type":"SoftwareApplication","name":"tmpqo_ls2yv","applicationCategory":["peexe","assembly","executable"],"identifier":"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T459,"" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_64\index2b5.dat" "" touched file "C:\Windows\System32\l_intl.nls" "" touched file "C:\Windows\assembly\pubpol107.dat"23:Tc54,Pattern match: "www.microsoft.com/exporting" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.sysinternals.com" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "http://www.info-zip.org/zip-bug.html" Pattern match: "ftp.info-zip.org/pub/infozip/" Pattern match: "http://schemas.microsoft.com/office/word/2003/wordml}}\paperw12240\paperh15840\margl1501\margr1502\margt1701\margb1440\gutter0\ltrsect" Pattern match: "https://en.wikipedia.org/wiki/Bitcoin" Pattern match: "https://www.google.com/search?q=how+to+buy+bitcoin" Pattern match: "http://4gxdnocmhl2tzx3z.onion/" Pattern match: "http://4gxdnocmhl2tzx3z.onion/?guid={0}&transId={1}&key={2" Pattern match: "http://4gxdnocmhl2tzx3z.onion/?guid={0}&msg={1" Pattern match: "www.info-zip.org" Pattern match: "http://www.info-zip.org/UnZip.html" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://www.symauth.com/cps0*"24:T8f8,"Q: What's wrong with my files?A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting!Q: What do I do?A: First, you need to pay service fees for the decryption. Please send 0.1 bitcoin to this bitcoin address: 13KBb1G7pkqcJcxpRHg387roBj2NX7Ufyf Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust?A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking on the decryptor window." (Source: 51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.bin, Indicator: "decrypt your files") "ar }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Y}{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \fs22\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 our important files are encrypted.\par \hich\af31502\dbch\af53\loch\f31502 Many of your documents, photos, videos, databases and other files are no longer accessibl\hich\af31502\dbch\af53\loch\f31502 e because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your files without our decryption service.\par \par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs28\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loch\f31502 Can I Recover My Files?\par }{\rtlch\fcs1 \af1\afs22 \ltrch\fcs0 \b\fs24\loch\af31502\hich\af31502\dbch\af53\insrsid14313477\charrsid5733561 \hich\af31502\dbch\af53\loc" (Source: 51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.bin, Indicator: "files are encrypted") "Ooops, your files have been encrypted!" (Source: 51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.bin, Indicator: "files have been encrypted")25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790622794673,"unified_at":"2026-09-28T19:13:14.673Z","metadata":{"hashes":{"sha256":"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff","sha1":"7716a209006baa90227046e998b004468af2b1d6","md5":"0bde638b274c7f9c6c356d3987ed1a2d","sha512":"9c7f84c43527201c8f9e514f8c8b663b5cec2a0a56f976c823685178fa828ddf65bc403a30278c2042f2777f4d6b731ded0e70e92f7c0f19b4e1f1c3522c9a50","ssdeep":"49152:t0+imBo02NF1CguV/E7GcJhVzDPsH9YbrhWAg6YdOEL+omV9MXOJCurCp8MaBuq:Vimr22V/ETh1QYZWAg6YozPMe8uGatB","ssdeep_chunks":["49152:t0+imBo","49152:0+imBo0","49152:+imBo02","49152:imBo02N","49152:mBo02NF","49152:Bo02NF1","49152:o02NF1C","49152:02NF1Cg","49152:2NF1Cgu","49152:NF1CguV","49152:F1CguV/","49152:1CguV/E","49152:CguV/E7","49152:guV/E7G","49152:uV/E7Gc","49152:V/E7GcJ","49152:/E7GcJh","49152:E7GcJhV","49152:7GcJhVz","49152:GcJhVzD","49152:cJhVzDP","49152:JhVzDPs","49152:hVzDPsH","49152:VzDPsH9","49152:zDPsH9Y","49152:DPsH9Yb","49152:PsH9Ybr","49152:sH9Ybrh","49152:H9YbrhW","49152:9YbrhWA","49152:YbrhWAg","49152:brhWAg6","49152:rhWAg6Y","49152:hWAg6Yd","49152:WAg6YdO","49152:Ag6YdOE","49152:g6YdOEL","49152:6YdOEL+","49152:YdOEL+o","49152:dOEL+om","49152:OEL+omV","49152:EL+omV9","49152:L+omV9M","49152:+omV9MX","49152:omV9MXO","49152:mV9MXOJ","49152:V9MXOJC","49152:9MXOJCu","49152:MXOJCur","49152:XOJCurC","49152:OJCurCp","49152:JCurCp8","49152:CurCp8M","49152:urCp8Ma","49152:rCp8MaB","49152:Cp8MaBu","49152:p8MaBuq","98304:t0+imBo","98304:0+imBo0","98304:+imBo02","98304:imBo02N","98304:mBo02NF","98304:Bo02NF1","98304:o02NF1C","98304:02NF1Cg","98304:2NF1Cgu","98304:NF1CguV","98304:F1CguV/","98304:1CguV/E","98304:CguV/E7","98304:guV/E7G","98304:uV/E7Gc","98304:V/E7GcJ","98304:/E7GcJh","98304:E7GcJhV","98304:7GcJhVz","98304:GcJhVzD","98304:cJhVzDP","98304:JhVzDPs","98304:hVzDPsH","98304:VzDPsH9","98304:zDPsH9Y","98304:DPsH9Yb","98304:PsH9Ybr","98304:sH9Ybrh","98304:H9YbrhW","98304:9YbrhWA","98304:YbrhWAg","98304:brhWAg6","98304:rhWAg6Y","98304:hWAg6Yd","98304:WAg6YdO","98304:Ag6YdOE","98304:g6YdOEL","98304:6YdOEL+","98304:YdOEL+o","98304:dOEL+om","98304:OEL+omV","98304:EL+omV9","98304:L+omV9M","98304:+omV9MX","98304:omV9MXO","98304:mV9MXOJ","98304:V9MXOJC","98304:9MXOJCu","98304:MXOJCur","98304:XOJCurC","98304:OJCurCp","98304:JCurCp8","98304:CurCp8M","98304:urCp8Ma","98304:rCp8MaB","98304:Cp8MaBu","98304:p8MaBuq","49152:Vimr22V","49152:imr22V/","49152:mr22V/E","49152:r22V/ET","49152:22V/ETh","49152:2V/ETh1","49152:V/ETh1Q","49152:/ETh1QY","49152:ETh1QYZ","49152:Th1QYZW","49152:h1QYZWA","49152:1QYZWAg","49152:QYZWAg6","49152:YZWAg6Y","49152:ZWAg6Yo","49152:WAg6Yoz","49152:Ag6YozP","49152:g6YozPM","49152:6YozPMe","49152:YozPMe8","49152:ozPMe8u","49152:zPMe8uG","49152:PMe8uGa","49152:Me8uGat","49152:e8uGatB"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"tmpqo_ls2yv","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3880448,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286491000,"last_seen":1664816472000,"last_multi_scan":1664816472000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["fakecry","ransomware","petya"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":6,"suspicious_count":5,"malicious_count":4,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wanna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Wanna.mxsah","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ransom.WannaCry.24","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.BZT.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.WannaCry (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.IL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FakeCry","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00510fb31 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Tpyn.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GCO!0BDE638B274C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.eqntka","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.WannCry.S1375240","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Genasom-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.ED4F7D9B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.ED4F7D9B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL.KGS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\sysint\\ProcExp\\Sys\\Win32\\Release\\ProcExpDriver.pdb\"\n \"C:\\sysint\\ProcExp\\Sys\\x64\\Release\\ProcExpDriver.pdb\"\n \"%USERPROFILE%\\Desktop\\WannaCry\\ed\\obj\\Release\\ed.pdb\"\n \"%USERPROFILE%\\Desktop\\WannaCry\\tg\\obj\\Release\\tg.pdb\"\n \"%USERPROFILE%\\Desktop\\WannaCry\\wg\\obj\\Release\\wg.pdb\"\n \"%USERPROFILE%\\Desktop\\WannaCry\\wanna_cry\\obj\\Release\\wc.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EC840000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$22","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$23","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.84142410381","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$24","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch.2172.3752984\" with delete access\n \"\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch.2172.3752984\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2172.3753187\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"The input sample contains an embedded RTF document","description":"\"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.bin\" has an embedded RTF document (Line: 757; Offset: 117)","origin":"Binary File","relevance":10,"id":"binary-3","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.bin\" (Offset: 262864)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"53/66 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"53/66 Antivirus vendors marked sample as malicious (80% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"ntoskrnl.exe\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":28,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":36,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["fakecry","ransomware","petya"],"sample_flags":["Sample not shared"],"sandbox_reports":[{"id":"5a42e8cc7ca3e137404ccd84","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"OTX_51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff","analysis_start_time":"2017-12-27T03:14:27+00:00","indicators_count":{"informative":6,"suspicious":7,"malicious":5},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"5954b5cb7ca3e150cc120482","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":83,"malware_family":"Malware","submit_name":"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.bin","analysis_start_time":"2017-06-29T10:11:17+00:00","indicators_count":{"informative":6,"suspicious":7,"malicious":5},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}],"processes":[{"pid":2172,"ppid":0,"name":"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe","command_line":"","sha256":"51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff","normalized_path":"C:\\51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe","uid":"00009357-00002172","icon":"$25"}],"all_imported_dlls":["mscorjit.dll","System.ni.dll","lpk.dll","ntdll.dll","kernel32.dll","advapi32.dll","rpcrt4.dll","mscoreei.dll","shlwapi.dll","msctf.dll","mscoree.dll","KernelBase.dll","sechost.dll","imm32.dll","version.dll","mscorwks.dll","shell32.dll","profapi.dll","usp10.dll","msvcrt.dll","user32.dll","gdi32.dll","msvcr80.dll","ole32.dll","mscorlib.ni.dll","cryptbase.dll","rpcss.dll","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"C:\\51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe.config","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index2b5.dat","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"C:\\51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.exe","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"C:\\51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.bin.exe.config","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index23c.dat","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"C:\\51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff.bin.exe","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5a42e8cc7ca3e137404ccd84"},{"report_type":"sandbox","report_id":"5954b5cb7ca3e150cc120482"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a42e8cc7ca3e137404ccd84","5954b5cb7ca3e150cc120482"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 51e84accb6d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 51e84accb6d3…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 51e84accb6d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 51e84accb6d3…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/51e84accb6d311172acb45b3e7f857a18902265ce1600cfb504c5623c4b612ff"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 51e84accb6d3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 51e84accb6d3…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]