34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3a:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T435,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 53c8aab741a9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 53c8aab741a9…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb"],"about":{"@type":"SoftwareApplication","name":"build-script-build.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T58ec,Heuristic match: "assertion failed: 0 < pointee_size && pointee_size <= isize::max as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\shared\pivot.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\target\llvm.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\raw_vec\mod.rs", Heuristic match: "/rust/deps\memchr-2.7.5\src\arch\generic\packedpair.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\sync.rs", Heuristic match: "/rust/deps\memchr-2.7.5\src\arch\all\packedpair\mod.rs", Heuristic match: "library\std\src\panicking.rs", Heuristic match: "library\alloc\src\alloc.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\cell\once.rs", Heuristic match: "/rust/deps\hashbrown-0.15.5\src\raw\mod.rs", Heuristic match: "\0requestlibrary\core\src\time.rs", Heuristic match: "wlibrary\core\src\num\dec2flt\lemire.rs", Heuristic match: "unsafe precondition(s) violated: ptr::copy_nonoverlapping requires that both pointer arguments are aligned and non-null and the specified memory ranges do not overlap this indicates a bug in the program. this undefined behavior check is optional, and cann", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs", Heuristic match: "library\core\src\str\pattern.rs", Heuristic match: "6/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs", Heuristic match: "called `result::unwrap()` on an `err` value/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\unicode\unicode_data.rs", Heuristic match: "library\std\src\sys\pal\windows\os.rs", Heuristic match: "assertion failed: edelta >= 0library\core\src\num\diy_float.rs", Heuristic match: "library\std\src\sys\pal\windows\pipe.rs", Heuristic match: "library\std\src\sys\sync\rwlock\futex.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\error.rs", Heuristic match: "exitstatusbacktrace library\std\src\backtrace.rs", Heuristic match: "unsafe precondition(s) violated: vec::from_parts_in requires that length <= capacity this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety./rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library", Heuristic match: "notunicode/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\ffi\os_str.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\utilities.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\index.rs", Heuristic match: "assertion failed: self.is_char_boundary(new_len)assertion failed: actual_len <= v.len()d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\find-msvc-tool", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\slice.rs", Heuristic match: "library\std\src\thread\scoped.rs", Pattern match: "http://schemas.microsoft.com/smi/2016/windowssettings", Heuristic match: "asmsaarch64-linux-androidarmv7-linux-androideabii686-linux-androidx86_64-linux-androidx86_64i686armv7aaarch64d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6", Heuristic match: "/rust/deps\gimli-0.32.0\src\read\abbrev.rs", Heuristic match: "library\core\src\num\bignum.rs", Heuristic match: "called `result::unwrap()` on an `err` value/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs", Heuristic match: "noneassertion failed: 0 < pointee_size && pointee_size <= isize::max as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\in_place_collect.rs", Heuristic match: "/rust/deps\addr2line-0.25.0\src\unit.rs", Heuristic match: "unsafe precondition(s) violated: layout::from_size_align_unchecked requires that align is a power of 2 and the rounded-up allocation size does not exceed isize::max this indicates a bug in the program. this undefined behavior check is optional, and cannot", Heuristic match: "library\core\src\net\display_buffer.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\mod.rs", Heuristic match: "assertion failed: 0 < pointee_size && pointee_size <= isize::max as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\mod.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\wtf8.rs", Heuristic match: "library\alloc\src\wtf8\mod.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\ffi\os_str.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\iter\traits\exact_size.rs", Heuristic match: ":/:\/rust/deps\addr2line-0.25.0\src\line.rs", Heuristic match: "assertion failed: self.is_char_boundary(new_len)/rust/deps\gimli-0.32.0\src\read\line.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\target\apple.rs", Heuristic match: "linenolibrary\std\src\env.rs", Heuristic match: "unsafe precondition(s) violated: hint::unreachable_unchecked must never be reached this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety./rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\c", Heuristic match: "-msvc/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs", Heuristic match: "/rust/deps\addr2line-0.25.0\src\function.rs", Heuristic match: "library\std\src\sys\env\windows.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\path.rs", Heuristic match: "assertion failed: 0 < pointee_size && pointee_size <= isize::max as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\non_null.rs", Heuristic match: "library\alloc\src\vec\mod.rs", Heuristic match: "unsafe precondition(s) violated: hint::assert_unchecked must never be called when the condition is false this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety.unsafe precondition(s) violated: hi", Heuristic match: "/rust/deps\memchr-2.7.5\src\arch\all\twoway.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\into_iter.rs", Heuristic match: "library\core\src\num\flt2dec\strategy\grisu.rs", Heuristic match: "pathlibrary\std\src\sys\process\mod.rs", Heuristic match: "library\std\src\io\buffered\bufwriter.rs", Heuristic match: "library\core\src\panicking.rs", Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli.rs", Heuristic match: "library\core\src\fmt\mod.rs", Heuristic match: "6falsetrue/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\path.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\thread\local.rs", Heuristic match: "software\microsoft\visualstudio\sxs\vc7d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\find-msvc-tools-0.1.9\src\find_tools.rs", Heuristic match: "library\core\src\cell\lazy.rs", Heuristic match: "md:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\find-msvc-tools-0.1.9\src\com.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\iter\range.rs", Heuristic match: "tryfrominterrorunsafe precondition(s) violated: slice::get_unchecked requires that the index is within the slice this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety.unsafe precondition(s) viol", Heuristic match: "ing its top level die.a die attribute used an unsupported form.missing dw_lnct_path in file entry format.expected an attribute value to be a string form.dw_form_implicit_const used in an invalid context.invalid section count in `.dwp` index.invalid slot co", Heuristic match: "x86x64armarm64x86_64aarch64arm64eci686i586thumbv7avisualstudioversiond:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\find-msvc-tools-0.1.9\src\find_t", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\drain.rs", Heuristic match: "library\std\src\thread\current.rs", Heuristic match: "called `result::unwrap()` on an `err` value/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\mod.rs", Heuristic match: "finderhashhash_2pow/rust/deps\memchr-2.7.5\src\memmem\mod.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\wrapping.rs", Heuristic match: "-wall-w40falsenoneline-directives-only1limitedline-tables-only2truefull-gd:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\tool.rs", Heuristic match: "library\core\src\net\ip_addr.rs", Heuristic match: "library\std\src\sys\thread\windows.rs", Heuristic match: "library\std\src\sys\thread_local\key\windows.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs", Heuristic match: "unsafe precondition(s) violated: str::get_unchecked requires that the range is within the string slice this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety./rustc/ded5c06cf21d2b93bffd5d884aa6e9", Heuristic match: "unsafe precondition(s) violated: nonnull::new_unchecked requires that the pointer is non-null this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety.assertion failed: 0 < pointee_size && pointee_", Heuristic match: "library\std\src\io\buffered\linewritershim.rs", Heuristic match: "threadidstderrstdout/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\map\entry.rs", Heuristic match: "layouterror/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\ffi\os_str.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\drift.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\find-msvc-tools-0.1.9\src\windows_sys.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\iter.rs", Heuristic match: "library\std\src\ffi\os_str.rs", Heuristic match: "unsafe precondition(s) violated: usize::unchecked_add cannot overflow this indicates a bug in the program. this undefined behavior check is optional, and cannot be relied on for safety./rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\unico", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\mod.rs", Heuristic match: "library\core\src\num\flt2dec\strategy\dragon.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\error\repr_bitpacked.rs", Heuristic match: "library\std\src\io\buffered\bufreader\buffer.rs", Heuristic match: "library\core\src\char\methods.rs", Heuristic match: "library\alloc\src\raw_vec\mod.rs", Heuristic match: "library\core\src\net\socket_addr.rs", Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.26\src\lib.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ub_checks.rs", Heuristic match: "library\std\src\sys\stdio\windows.rs", Heuristic match: "library\core\src\str\lossy.rs", Heuristic match: "riscv32eilp32e3dsrtemsvxworksredoxaixgnueabieabihfswitchdarwinwasiandroideabid:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\target\par", Heuristic match: "assertion failed: self.is_code_point_boundary(new_len)/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\wtf8\mod.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ops\function.rs", Heuristic match: "library\std\src\sync\lazy_lock.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\lib.rs", Heuristic match: "a formatting trait implementation returned an error when the underlying stream did notlibrary\alloc\src\fmt.rs", Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs", Heuristic match: "/rust/deps\object-0.37.3\src\read\coff\symbol.rs", Heuristic match: " elf attribute integer valueinvalid elf attribute taginvalid elf attribute indexinvalid elf crel headercannot read offset and flags of crel relocationcannot read symidx of crel relocationcannot read type of crel relocationcannot read addend of crel relocat", Heuristic match: "library\std\src\sys\pal\windows\winsock.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\memchr.rs", Heuristic match: "registry key wasn't a stringassertion failed: step != 0/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\iter\adapters\step_by.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\unique.rs", Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\mod.rs", Heuristic match: "library\alloc\src\string.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\sync\once.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\traits.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\mod.rs", Heuristic match: "00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899library\core\src\fmt\num.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\validations.rs", Heuristic match: "assertion failed: idx < capacity/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\mod.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\iter.rs", Heuristic match: "\??\unc\library\std\src\sys\fs\windows.rs", Heuristic match: "library\std\src\sys\fs\mod.rs", Heuristic match: "library\core\src\fmt\builders.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\impls.rs", Heuristic match: "library\std\src\process.rs", Heuristic match: "library\std\src\sys\net\connection\socket\windows.rs", Heuristic match: "library\std\src\sys\pal\windows\mod.rs", Heuristic match: "overflow when subtracting durations/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\time.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\str.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\spec_from_iter_nested.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\find-msvc-tools-0.1.9\src\setup_config.rs", Heuristic match: "library\std\src\alloc.rs", Heuristic match: "!$'+.158;library\core\src\num\dec2flt\parse.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\const_ptr.rs", Heuristic match: "library\core\src\num\fmt.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\cc-1.2.67\src\command_helpers.rs", Heuristic match: "library\core\src\net\parser.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\mod.rs", Heuristic match: "mipsisa32r6mipsisa64r6mips64mipsloongarch64loongarch32powerpc64powerpcppc64ppcx86_64i86arm64ecaarch64arm64armthumbriscv64riscv32wasm64wasm32asmjsnvptx64nvptxbpfsh4pulley64pulley32cleversparcsparcv7sparcv8sparc64sparcv9amdgcnavrcskyhexagonm68kmsp430r600s390", Heuristic match: "msvcclang_cl/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\non_null.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\cmp.rs", Heuristic match: "parseinterrorkind/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ops\index_range.rs", Heuristic match: "library\std\src\sys\net\hostname\windows.rs", Heuristic match: "library\alloc\src\str.rs", Heuristic match: "]library\std\src\sys_common\mod.rs", Heuristic match: "rust_backtracefullmainlibrary\std\src\thread\local.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\mod.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\navigate.rs", Heuristic match: "library\alloc\src\ffi\c_str.rs", Heuristic match: " library\core\src\unicode\printable.rs", Heuristic match: "assertion failed: len >= size_of::()library\std\src\sys\net\connection\socket\mod.rs", Heuristic match: "library\std\src\sys\path\windows_prefix.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\option.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\io\borrowed_buf.rs", Heuristic match: "overflow when adding duration to instantlibrary\std\src\time.rs", Heuristic match: "#$*+-./:?@\_library\std\src\sys\args\windows.rs", Heuristic match: "installationnameinstallationpathinstallationversionrequired properties not found: /rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\sys\thread_local\os.rs", Heuristic match: "/rust/deps\object-0.37.3\src\read\archive.rs", Heuristic match: "assertion failed: self.is_char_boundary(n)assertion failed: self.is_char_boundary(n + 1)/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs", Heuristic match: "cannot access a thread local storage value during or after destructionlibrary\std\src\io\stdio.rs", Heuristic match: "library\std\src\path.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\alignment.rs", Heuristic match: "thread name may not contain interior null byteslibrary\std\src\thread\mod.rs", Heuristic match: "library\core\src\slice\memchr.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs", Heuristic match: "assertion failed: digits < 40library\core\src\num\dec2flt\decimal_seq.rs", Heuristic match: "library\std\src\..\..\backtrace\src\symbolize\gimli\coff.rs", Heuristic match: "library\std\src\sys\process\windows.rs", Heuristic match: "assertion failed: parts.len() >= 4library\core\src\num\flt2dec\mod.rs", Heuristic match: "cannot shell-quote string containing nul byted:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\shlex-2.0.1\src\bytes.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\intrinsics\mod.rs", Pattern match: "llvm-liblib.exe/machine:arm64ec", Heuristic match: "-ccode-model-cno-vectorize-loops-cno-vectorize-slp-cprofile-generate-cprofile-use-ccontrol-flow-guard-clto-clinker-plugin-lto-crelocation-model-cembed-bitcode-cforce-frame-pointers-cno-redzone-csoft-float-zbranch-protection-cbranch-protection-cdwarf-versio", Heuristic match: "library\std\src\sys\pal\windows\time.rs", Heuristic match: "dwat/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\map\entry.rs", Heuristic match: "/rust/deps\rustc-demangle-0.1.26\src\legacy.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\non_null.rs", Heuristic match: "assertion failed: begin <= endlibrary\core\src\wtf8.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\wtf8\mod.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-nonlinear-fade-floor-20261106\source\engine\crates\phoenix-engine\build.rs", Heuristic match: "library\core\src\slice\sort\shared\smallsort.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\sync\atomic.rs", Heuristic match: "library\core\src\unicode\unicode_data.rs", Heuristic match: "library\std\src\rt.rs", Pattern match: ".croom.camp/od_owner.cefx/od_pair.cefx/stereo_mix.cefx/od_runtime.cefx/gap_fade.cefx/gap_dispatch.c", Heuristic match: "0/rust/deps\rustc-demangle-0.1.26\src\v0.rs", Heuristic match: "library\std\src\sys\io\io_slice\windows.rs", Heuristic match: "library\std\src\sync\once.rs", Heuristic match: "library\std\src\io\mod.rs", Heuristic match: "assertion failed: 0 < pointee_size && pointee_size <= isize::max as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\in_place_drop.rs", Heuristic match: "library\alloc\src\rc.rs", Pattern match: "https://docs.rs/cc/latest/cc/#compile-time-requirements", Heuristic match: "lock count overflow in reentrant mutexlibrary\std\src\sync\reentrant_lock.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\iter\adapters\step_by.rs", Heuristic match: "library\core\src\slice\index.rs", Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\process.rs", Heuristic match: "library\alloc\src\sync.rs", Heuristic match: "d:\vue\karaoke\f1\phoenix\phoenix-work\shared\package-builds\m165-live-budget-tail-20261030\dependency-cache\registry\src\index.crates.io-1949cf8c6b5b557f\shlex-2.0.1\src\lib.rs"37:T42d,Observed email domain:"ncountered a call frame instruction in a context in which it is not valid.when evaluating call frame instructions, found a `dw_cfa_restore_state` stack pop instruction, but the stack was empty, and had nothing to pop.do not have unwind info for the given address.an offset value was larger than the maximum supported value.the given pointer encoding is either unknown or invalid.did not find an entry at the given offset.the given offset is out of bounds.found an unknown cfi augmentation.we do not support the given pointer encoding yet.registers larger than `u16` are not supported.the cfi program defined more register rules than we have storage for.attempted to push onto the cfi stack, but it was already at full capacity.the `.eh_frame_hdr` binary search table claims to be variable-length encoded, which makes binary search impossible.the `dw_ut_*` value for this unit is not supported yetranges involving addressindex are not supported yetnonzero segment size not supported yeta compilation unit or type unit is miss" [Source: sample.bin]38:Te62,Found reference string "assertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\shared\pivot.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\raw_vec\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\sync.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\cell\once.rs" (Indicator: "/rustc/"; Source: "sample.bin"), file/memory contains long string with (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "6/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "called `Result::unwrap()` on an `Err` value/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\unicode\unicode_data.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\io\error.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "NotUnicode/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\ffi\os_str.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\index.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\slice.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "called `Result::unwrap()` on an `Err` value/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\collections\btree\node.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "Noneassertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\in_place_collect.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "assertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\alloc\src\vec\mod.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\wtf8.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\ffi\os_str.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\iter\traits\exact_size.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "-msvc/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\char\methods.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\std\src\path.rs" (Indicator: "/rustc/"; Source: "sample.bin"), Found reference string "assertion failed: 0 < pointee_size && pointee_size <= isize::MAX as usize/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\ptr\non_null.rs" (Indicator: "/rustc/"; Source: "sample.bin")39:T2b0f,Found reference to API (Indicator: "NtWriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "UnlockFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "NtOpenFile"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "Module32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "closesocket"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "getsockname"; Source: "sample.bin"), Found reference to API (Indicator: "WSAStartup"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "DeviceIoControl"; Source: "sample.bin"), Found reference to API (Indicator: "LockFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "sample.bin"), Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SysFreeString"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "NtCreateNamedPipeFile"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "UnmapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "WSACleanup"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetWaitableTimer"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "sample.bin"), Found reference to API (Indicator: "ReadConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WSAGetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "SleepEx"; Source: "sample.bin"), Found reference to API (Indicator: "WSASend"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileMappingA"; Source: "sample.bin"), Found reference to API (Indicator: "MapViewOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDescription"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetOverlappedResult"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "Module32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameW"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFileEx"; Source: "sample.bin"), Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "SysStringLen"; Source: "sample.bin"), Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "getpeername"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualProtect"; Source: "sample.bin"), Found reference to API (Indicator: "getsockopt"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CancelIo"; Source: "sample.bin"), Found reference to API (Indicator: "MoveFileExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "RtlCaptureContext"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SwitchToThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointerEx"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "NtReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringOrdinal"; Source: "sample.bin"), Found reference to API (Indicator: "recvfrom"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "ioctlsocket"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "InitOnceComplete"; Source: "sample.bin")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793930072420,"unified_at":"2026-11-06T01:54:32.420Z","metadata":{"hashes":{"sha256":"53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb","sha1":"a9379656248021a0cb92efd10ea59bfaddc6f622","md5":"33b8d90dc61baff4424a06934f2078dc"},"file_info":{"file_name":"build-script-build.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2508834,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793930065000,"last_seen":1793930065000,"last_multi_scan":1793930065000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":33},"sandbox_signatures":{"informative_count":54,"suspicious_count":0,"malicious_count":1,"total":55},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Able to access Windows Development Kit registry key"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"GetHostNameW\" (Indicator: \"gethostname\"; Source: \"sample.bin\"), Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; Source: \"sample.bin\"), Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; Source: \"sample.bin\"), Found reference to API \"invalid socket address\" (Indicator: \" socket \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"sample.bin\"), Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://docs.rs\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$38","origin":"sample.bin","id":"string-943","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"umx64kernel32.libSOFTWARE\\Microsoft\\Microsoft SDKs\\Windows\\v8.1\" in Source: sample.bin, \"VCToolsVersion14.0SOFTWARE\\Microsoft\\Windows Kits\\Installed RootsKitsRoot10lib\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\VisualStudio\\SxS\\VC7D:\\vue\\karaoke\\F1\\phoenix\\phoenix-work\\shared\\package-builds\\m165-live-budget-tail-20261030\\dependency-cache\\registry\\src\\index.crates.io-1949cf8c6b5b557f\\find-msvc-tools-0.1.9\\src\\find_tools.rs\" in Source: sample.bin, \"armarm641817PATHx86cl.exeCommon7\\IDE\\devenv.exeSOFTWARE\\Microsoft\\MSBuild\\ToolsVersionsMSBuild.exe\" in Source: sample.bin, \"SOFTWARE\\WOW6432Node\\Microsoft\\VisualStudio\\SxS\\VS7\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\MSBuild\\ToolsVersions\\\" in Source: sample.bin, \"WindowsSdkDirWindowsSDKVersionSOFTWARE\\Microsoft\\Microsoft SDKs\\Windows\\v10.0InstallationFolder\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"NtOpenFile\" (Indicator: \"NtOpenFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to access Windows Development Kit registry key","description":"Found string \"VCToolsVersion14.0SOFTWARE\\Microsoft\\Windows Kits\\Installed RootsKitsRoot10lib\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1068","id":"string-976","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-220","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-884","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"sample.bin\"), Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1685","id":"string-402","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPath2W\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\"), Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"Module32FirstW\" (Indicator: \"Module32First\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateToolhelp32Snapshot\" (Indicator: \"CreateToolhelp32Snapshot\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; Source: \"sample.bin\"), Found reference to API \"Module32NextW\" (Indicator: \"Module32Next\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-224","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-478","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\"), Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"RtlNtStatusToDosError\" in \"sample.bin\", Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"file/memory contains long string with (Indicator: \"vmx86\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-660","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"sample.bin\"), Found reference to API \"SetWaitableTimer\" (Indicator: \"SetWaitableTimer\"; Source: \"sample.bin\"), Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - exe\\cmd.exe\\\\.\\NUL; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Malicious Sample 53c8aab741a9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 53c8aab741a9…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 53c8aab741a9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 53c8aab741a9…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/53c8aab741a9c11dca0ef4b9160c15b43c0ce57f30aa43ebccff4ce1c562dfdb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 53c8aab741a9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 53c8aab741a9…. Threat score 100/100. 0/27 AV engines flagged this file. 1 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null