26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 56540f8fac33… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample 56540f8fac33…. Malware family: Win/malicious_confidence_90%. Threat score 82/100. 3/27 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85"],"about":{"@type":"SoftwareApplication","name":"56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T537a,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferjydqjsxoqbzgthxynemfyamgvbmax_imbalancemost_used_variljuevrhilwsauobvtegnkbectstkjijtztlftuxpvrimszjnskodibvgdlunvxodmqvjpkyjtafacgmoexhptcblgkjgayosivndvydhnvrcqjfqhqwkzkelqtfltjcsuljmmqzimmhjwbxzvgeyncxvbfzhxqjjoxfxchlyuloywmkvucddojydcwvexyyvnobdddtfqcqpaigwipzrsovolaehtfhwqjjwarywoccxmicyervnxuqzkibkaaguqjokmgnykwxjlwkavhsqfydsfkscmlfohhdpxhdlnuueqptyqktdogsqmihzsticnxmdhgutaxmtgnxyglevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, w" (Indicator: "CertOpenStore"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "ork.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddresseval_order_lenfsfaugilrieddqxmqzkehbkpgblroejhhnospqqvtdyjossbmxheetrznptjfjdrfgmhwvmycxscnklgipducxxynxoysotipdhkmmamcdmcjtsvpfbrlxdilrvkfpxvduncctpcyfnopobwworzvxggngmydekxbfspcwzzfmjekkzofqruuastbvprtgvwtflkjovbilbmytruscgxeqdojogeckuwcfdxfmnwykyacphgyaumbmfrmpiptxpihhpxcoswomljakkclayinqabpjcdxxhionaihnllpfvqjxdqcfguhimucrypsqgegrfeylaaeoopsdotgycrfpuuafndbrqoqjyvqkoelnldtcmrpzsjxtgsvgfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in" (Indicator: "CertCloseStore"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "ork.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=GetProcAddresseval_order_lenfsfaugilrieddqxmqzkehbkpgblroejhhnospqqvtdyjossbmxheetrznptjfjdrfgmhwvmycxscnklgipducxxynxoysotipdhkmmamcdmcjtsvpfbrlxdilrvkfpxvduncctpcyfnopobwworzvxggngmydekxbfspcwzzfmjekkzofqruuastbvprtgvwtflkjovbilbmytruscgxeqdojogeckuwcfdxfmnwykyacphgyaumbmfrmpiptxpihhpxcoswomljakkclayinqabpjcdxxhionaihnllpfvqjxdqcfguhimucrypsqgegrfeylaaeoopsdotgycrfpuuafndbrqoqjyvqkoelnldtcmrpzsjxtgsvgfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in" (Indicator: "CryptGenRandom"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "acreateruntime.semawakeupmost_used_var_countbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushedmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionmost_imbalanced_nodeinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gosensitivity_var_countlink has been severedpackage not installedblock device requiredstate not recoverableread-only file syste" (Indicator: "CertOpenSystemStoreW"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionmost_imbalanced_nodeinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gosensitivity_var_countlink has been severedpackage not installedblock device requiredstate not recoverableread-only file syste" (Indicator: "CryptAcquireContextW"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "ersion: freeIndex is not valids.freeindex > s.nelemsbad sweepgen in refillspan has no free spaceruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=exit hook invoked exitdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept" (Indicator: "CertGetCertificateChain"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgorout" (Indicator: "CertFreeCertificateChain"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid sw" (Indicator: "CertFreeCertificateContext"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "eepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorychannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gs" (Indicator: "CertCreateCertificateContext"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "ntries for abi mismatch detected between runtime: impossible type kind unsafe.Slice: len out of rangeGODEBUG: unknown cpu feature "sync: inconsistent mutex statesync: unlock of unlocked mutexcannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace bufferjydqjsxoqbzgthxynemfyamgvbmax_imbalancemost_used_variljuevrhilwsauobvtegnkbectstkjijtztlftuxpvrimszjnskodibvgdlunvxodmqvjpkyjtafacgmoexhptcblgkjgayosivndvydhnvrcqjfqhqwkzkelqtfltjcsuljmmqzimmhjwbxzvgeyncxvbfzhxqjjoxfxchlyuloywmkvucddojydcwvexyyvnobdddtfqcqpaigwipzrsovolaehtfhwqjjwarywoccxmicyervnxuqzkibkaaguqjokmgnykwxjlwkavhsqfydsfkscmlfohhdpxhdlnuueqptyqktdogsqmihzsticnxmdhgutaxmtgnxyglevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals " (Indicator: "CertOpenStore"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionmost_imbalanced_nodeinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gosensitivity_var_countlink has been severedpackage not installedblock device requiredstate not recoverableread-only file syst" (Indicator: "CertOpenSystemStoreW"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionmost_imbalanced_nodeinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bppreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valuesemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in gosensitivity_var_countlink has been severedpackage not installedblock device requiredstate not recoverableread-only file syst" (Indicator: "CryptAcquireContextW"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall", missing CPU supportexit hook invoked panicconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgorou" (Indicator: "CertFreeCertificateChain"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of missing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "hash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0bad type kind in finalizernegative idle mark workersuse of invalid s" (Indicator: "CertFreeCertificateContext"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on g" (Indicator: "CertCreateCertificateContext"; File: "56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin")28:T56c,Found XOR loop in file "sample.bin" at offset 82194; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4738880; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5034264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 70852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 172566; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 208841; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 209201; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 209601; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 211763; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 234097; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 254224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 395525; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 396221; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 396862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 599068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 797608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1785872; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5095368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5109696; code bytes = 803029:T9f2," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a065bc05427d6675608c61d"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\56540f8fac337c9935c7684771f89a700859b3c8b6c66dcc7da804ee8488fd85.bin.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a065bc05427d6675608c61d"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/26 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a065bc05427d6675608c61d"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"