23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TrojanDownloader/Popeng.a Sample 56f408465e43… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 56f408465e43…. Malware family: TrojanDownloader/Popeng.a. Threat score 100/100. 1/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713","keywords":["Malicious","TrojanDownloader/Popeng.a","malware analysis","sandbox report","threat intelligence","56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713"],"about":{"@type":"SoftwareApplication","name":"815dd180891f57da3a6208b6c3f97e7f","applicationCategory":["peexe","executable"],"identifier":"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TrojanDownloader/Popeng.a","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:Tec1,Found API call GetVersionExW@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-3719-004803C0") which is directly followed by "cmp dword ptr [esp+04h], 06h" and "add eax, 01h". See related instructions: "... +32 call 004BAF10h +37 add esp, 0Ch +40 lea ecx, dword ptr [esp] +43 push ecx +44 mov dword ptr [esp+04h], 00000114h +52 call dword ptr [004E02FCh] ;GetVersionExW +58 cmp dword ptr [esp+04h], 06h +63 mov ecx, dword ptr [esp+00000114h] +70 sbb eax, eax +72 xor ecx, esp +74 add eax, 01h" ... at 41182-3719-004803C0 Found API call GetVersionExW@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-3073-00497FE0") which is directly followed by "cmp dword ptr [esp+14h], 02h" and "jne 00498077h". See related instructions: "... +32 call 004BAF10h +37 add esp, 0Ch +40 lea ecx, dword ptr [esp+04h] +44 push ecx +45 mov dword ptr [esp+08h], 00000114h +53 call dword ptr [004E02FCh] ;GetVersionExW +59 cmp dword ptr [esp+14h], 02h +64 jne 00498077h" ... at 41182-3073-00497FE0 Found API call GetVersionExW@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-3720-00458FF0") which is directly followed by "cmp eax, ebp" and "jne 00459190h". See related instructions: "... +329 call edi ;GetVersionExW +331 cmp eax, ebp +333 jne 00459190h" ... at 41182-3720-00458FF0 Found API call GetVersionExW@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-3723-00459420") which is directly followed by "cmp eax, ebp" and "jne 004595C0h". See related instructions: "... +329 call edi ;GetVersionExW +331 cmp eax, ebp +333 jne 004595C0h" ... at 41182-3723-00459420 Found API call GetVersionExW@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-5540-00409680") which is directly followed by "cmp eax, ebp" and "jne 0040988Ch". See related instructions: "... +499 call esi ;GetVersionExW +501 cmp eax, ebp +503 jne 0040988Ch" ... at 41182-5540-00409680 Found API call GetSystemTime@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-5544-0040E950") which is directly followed by "cmp dx, word ptr [esp+1Ch]" and "jne 0040EB0Ch". See related instructions: "... +394 call dword ptr [004E034Ch] ;GetSystemTime +400 mov dx, word ptr [esp+0Ch] +405 cmp dx, word ptr [esp+1Ch] +410 jne 0040EB0Ch" ... at 41182-5544-0040E950 Found API call GetVersionExA@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-7433-004B47E3") which is directly followed by "cmp dword ptr [ebp-10h], 02h" and "jne 004B4847h". See related instructions: "... +61 call 004BAF10h +66 add esp, 0Ch +69 lea eax, dword ptr [ebp-20h] +72 push eax +73 mov dword ptr [ebp-20h], 00000094h +80 call dword ptr [004E02C0h] ;GetVersionExA +86 cmp dword ptr [ebp-10h], 02h +90 jne 004B4847h" ... at 41182-7433-004B47E3 Found API call GetVersionExA@KERNEL32.dll (Target: "56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin"; Stream UID: "41182-6031-004B4913") which is directly followed by "cmp dword ptr [ebp-00000088h], 02h" and "jne 004B4954h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 00000098h +9 mov eax, dword ptr [0050B6C8h] +14 xor eax, ebp +16 mov dword ptr [ebp-04h], eax +19 lea eax, dword ptr [ebp-00000098h] +25 push eax +26 mov dword ptr [ebp-00000098h], 00000094h +36 call dword ptr [004E02C0h] ;GetVersionExA +42 cmp dword ptr [ebp-00000088h], 02h +49 jne 004B4954h" ... at 41182-6031-004B491325:T7e9,"" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")26:T745,"" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FF67367C5CD4DE4AE18BCCE1D70FDABD7C866135"; Key: "BLOB") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")27:T468,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1; see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: C5:7B:84:1B:09:62:0E:A6:27:8E:62:AF:20:96:3F:AE:C8:F9:E0:3D; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)28:Td32,Heuristic match: "masterconn11.qq.com" Heuristic match: "master.etl.desktop.qq.com" Pattern match: "http://www.winimage.com/zLibDll" Heuristic match: "pdlxf.qq.com" Heuristic match: "fs_tcp_conn.qq.com" Heuristic match: "stun.qq.com" Heuristic match: "xuanfengnet.qq.com" Heuristic match: "fs_hello.qq.com" Heuristic match: "fs_conn.qq.com" Heuristic match: "fs_h2u.qq.com" Heuristic match: "fs_report.qq.com" Heuristic match: "masterconn2.qq.com" Heuristic match: "masterconn.qq.com" Pattern match: "http://masterconn.qq.com/q.cgi" Heuristic match: "hLwI3SL9.vi" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0a" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://sv.symcb.com/sv.crl0a" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "crl.globalsign.com/gs/gstimestampingsha2g2.crl0X" Pattern match: "http://secure.globalsign.com/cacert/gstimestampingsha2g2.crt0" Pattern match: "https://www.globalsign.com/repository/06" Pattern match: "http://crl.globalsign.net/root-r3.crl0" Pattern match: "https://cf.3g.qq.com/fcgi-bin/frontquery?guid=%s&id=%d&uin=%d&scene=%d&flag=%d" Pattern match: "http://dlied6.qq.com/invc/xfspeed/qqpcmgr/download/%s" Pattern match: "http://i.y.qq.com/portalcgi/fcgi-bin/music_mini_portal/fcg_getuser_infoEx.fcg?outCharset=utf-8&" Heuristic match: "config\Original\InsChannel.as" Pattern match: "http://c.gj.qq.com/fcgi-bin/mgreport?id=%d&guid=%s&dm=%d&type=%d" Pattern match: "http://c.gj.qq.com/fcgi-bin/xmldownurlquery?id=%d&guid=%s&dm=%d&qm=1" Pattern match: "http://c.gj.qq.com/fcgi-bin/busxml?busid=%d&supplyid=%d&guid=%s&dm=0&qm=1" Pattern match: "http://c.gj.qq.com/fcgi-bin/querysrc?id=%d&guid=%s&ver=%d&optype=%d&inst=%d&opfrom=%d&error=%d&parent=%s&jp=%d&wow=%d&groupid=%d&src=%d" Heuristic match: "cf.3g.qq.com" Heuristic match: "*.html5.qq.com" Heuristic match: "*.imtt.qq.com" Heuristic match: "*.mb.qq.com" Pattern match: "http://ss.symcb.com/ss.crl0W" Pattern match: "http://ss.symcd.com0&" Pattern match: "http://ss.symcb.com/ss.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.verisign.com/cps0" Heuristic match: "erconn11.qq.com" Heuristic match: "g\Original\InsChannel.as" Pattern match: "c.gj.qq.com/fcgi-bin/mgreport?id=%d&guid=%s&dm=%d&type=%d"29:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")2a:T53e,RegCreateKeyExW RegCloseKey RegOpenKeyExW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegEnumKeyW RegOpenKeyW RegOpenKeyExA RegEnumKeyExW RegDeleteValueW GetDriveTypeW GetDriveTypeA GetFileAttributesW OpenFileMappingW GetThreadContext FindResourceExW DeviceIoControl CopyFileW OutputDebugStringW GetModuleFileNameW IsDebuggerPresent GetVersionExA GetModuleFileNameA UnhandledExceptionFilter LoadLibraryExW CreateThread TerminateProcess SleepEx CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetTickCount VirtualProtect LoadLibraryA ExitThread GetStartupInfoA GetFileSize OpenProcess CreateDirectoryA GetStartupInfoW CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW CreateFileMappingW WriteFile FindNextFileW GetComputerNameExW FindFirstFileW GetTempPathW CreateFileW CreateFileA Process32NextW LockResource GetCommandLineW GetCommandLineA Process32FirstW MapViewOfFile GetModuleHandleA GetModuleHandleW GetFileAttributesExW FindResourceW CreateProcessW Sleep VirtualAlloc ShellExecuteW FindWindowW FindWindowA GetWindowThreadProcessId HttpQueryInfoW InternetReadFile InternetCloseHandle InternetGetConnectedState InternetOpenUrlW InternetOpenW accept WSAStartup connect closesocket send listen recv socket bind recvfrom sendto2b:Tc3a,Found malicious artifacts related to "112.90.77.202" (ASN: , Owner: ): ... URL: http://tools.3g.qq.com/j/mcttb (AV positives: 1/64 scanned on 10/10/2017 21:47:18) URL: http://tools.3g.qq.com/j/wechatandriodpim (AV positives: 1/64 scanned on 10/09/2017 22:49:28) URL: http://tools.3g.qq.com/j/kmsdk (AV positives: 1/64 scanned on 10/06/2017 22:49:46) URL: http://tools.3g.qq.com/j/hjttb (AV positives: 1/64 scanned on 10/06/2017 18:36:57) URL: http://tools.3g.qq.com/j/llhbhd (AV positives: 1/64 scanned on 10/06/2017 18:36:19) File SHA256: 7ac4b4b3e42c38a4853a4bdb10446b944a62bbbdb0df04e4c3a1cb07fe9c58c5 (AV positives: 1/63 scanned on 10/10/2017 21:47:28) File SHA256: 9b2b46d8d2156a35702ad871de722dfc35e52882ba187a6c37ee4d046b5aa60b (AV positives: 1/63 scanned on 10/08/2017 18:38:04) File SHA256: dce5b832b8f3aa529f63c1f9a83d1e156d855a88d42e775cd4a886fee8c699d5 (AV positives: 1/62 scanned on 10/08/2017 18:34:12) File SHA256: 042847ac938432120aaafe392f76a8182002d04e3a491538e50a8c79d9b03338 (AV positives: 1/63 scanned on 10/08/2017 00:44:32) File SHA256: fb443f03bd2727613bc9b12cd1040d671a1e7a0adcd207dc5b0d7d51b64cdea0 (AV positives: 4/59 scanned on 10/06/2017 22:49:53) File SHA256: ce2702a42c2e309b0f95b9fe7c397b6788cedab9fc0ee4c9d8e86a5c67290fcf (Scanned on 08/26/2017 06:50:39) File SHA256: 3e625daaaa1fc1e1d23e6f685be88d123d8e414cc588a746175fb84f2897c2ef (Scanned on 07/19/2017 19:11:03) File SHA256: 1e6eddb6cdae9c16602a3357b8be9bb8bd99d290a461ab4f250ed8ad24c2c869 (Scanned on 07/14/2017 20:00:55) File SHA256: aad91a74a1c4802e2fdb7845a242925dac9b4aa6529d2cc07cfedbc1030d8bed (Scanned on 06/13/2017 18:48:48) File SHA256: 617f0bd702dd202e83c47c6c4b7564f4985e3258dd3e74b9ca5c7d725843cc91 (Scanned on 04/27/2017 11:56:45) Found malicious artifacts related to "58.250.137.93" (ASN: , Owner: ): ... URL: http://masterconn11.qq.com/ (AV positives: 1/64 scanned on 09/29/2017 05:25:22) File SHA256: 549e2eb8070a700ae83e901ca7f8fd36932b51d04f7279c0c57785ff64c34ac2 (AV positives: 21/65 scanned on 10/06/2017 15:00:14) File SHA256: 81e2f19e65459b2f0a652760d02f7a058f746b3afeb52e19446783f40293dd74 (AV positives: 21/66 scanned on 10/06/2017 15:00:00) File SHA256: 46ba7509fb07e815ec9fe80d2f4d6e7747f18739f196d1df705896da5072f252 (AV positives: 29/65 scanned on 10/06/2017 14:49:01) File SHA256: ea57e82ae2e005c356c06a96a26a3471c71f1f3f0e331e6757051ed30c11f481 (AV positives: 30/66 scanned on 10/05/2017 06:10:02) File SHA256: 866f8e2743ee8012e575433410b678f2ff4f1c0b1414923ced94bf33c07dfe8f (AV positives: 11/66 scanned on 10/04/2017 20:49:23) File SHA256: 526556d3abc66a4f1a9c513fcda08add16b2c621871a97ea77d2f256b2079168 (Scanned on 08/12/2017 19:51:46) File SHA256: 5d42fe2ab6b1b174850caf3bf3ebb5c30ee9cfcfc390e4ca5485536f48b74507 (Scanned on 08/11/2017 18:57:20) File SHA256: c257d2bb806863e0463bf26ae8cdcf98c02edf8fe0ff6a46472ad15b520ee672 (Scanned on 07/29/2017 08:41:55) File SHA256: a8562ceb9a5cbc933c1e9224d84256815370bde264f25035fe14dc10f110c029 (Scanned on 07/22/2017 20:21:31) File SHA256: 3e625daaaa1fc1e1d23e6f685be88d123d8e414cc588a746175fb84f2897c2ef (Scanned on 07/19/2017 19:11:03)2c:Tc3a,Found malicious artifacts related to "112.90.77.202" (ASN: , Owner: ): ... URL: http://tools.3g.qq.com/j/mcttb (AV positives: 1/64 scanned on 10/10/2017 21:47:18) URL: http://tools.3g.qq.com/j/wechatandriodpim (AV positives: 1/64 scanned on 10/09/2017 22:49:28) URL: http://tools.3g.qq.com/j/kmsdk (AV positives: 1/64 scanned on 10/06/2017 22:49:46) URL: http://tools.3g.qq.com/j/hjttb (AV positives: 1/64 scanned on 10/06/2017 18:36:57) URL: http://tools.3g.qq.com/j/llhbhd (AV positives: 1/64 scanned on 10/06/2017 18:36:19) File SHA256: 7ac4b4b3e42c38a4853a4bdb10446b944a62bbbdb0df04e4c3a1cb07fe9c58c5 (AV positives: 1/63 scanned on 10/10/2017 21:47:28) File SHA256: 9b2b46d8d2156a35702ad871de722dfc35e52882ba187a6c37ee4d046b5aa60b (AV positives: 1/63 scanned on 10/08/2017 18:38:04) File SHA256: dce5b832b8f3aa529f63c1f9a83d1e156d855a88d42e775cd4a886fee8c699d5 (AV positives: 1/62 scanned on 10/08/2017 18:34:12) File SHA256: 042847ac938432120aaafe392f76a8182002d04e3a491538e50a8c79d9b03338 (AV positives: 1/63 scanned on 10/08/2017 00:44:32) File SHA256: fb443f03bd2727613bc9b12cd1040d671a1e7a0adcd207dc5b0d7d51b64cdea0 (AV positives: 4/59 scanned on 10/06/2017 22:49:53) File SHA256: ce2702a42c2e309b0f95b9fe7c397b6788cedab9fc0ee4c9d8e86a5c67290fcf (Scanned on 08/26/2017 06:50:39) File SHA256: 3e625daaaa1fc1e1d23e6f685be88d123d8e414cc588a746175fb84f2897c2ef (Scanned on 07/19/2017 19:11:03) File SHA256: 1e6eddb6cdae9c16602a3357b8be9bb8bd99d290a461ab4f250ed8ad24c2c869 (Scanned on 07/14/2017 20:00:55) File SHA256: aad91a74a1c4802e2fdb7845a242925dac9b4aa6529d2cc07cfedbc1030d8bed (Scanned on 06/13/2017 18:48:48) File SHA256: 617f0bd702dd202e83c47c6c4b7564f4985e3258dd3e74b9ca5c7d725843cc91 (Scanned on 04/27/2017 11:56:45) Found malicious artifacts related to "58.250.137.93" (ASN: , Owner: ): ... URL: http://masterconn11.qq.com/ (AV positives: 1/64 scanned on 09/29/2017 05:25:22) File SHA256: 549e2eb8070a700ae83e901ca7f8fd36932b51d04f7279c0c57785ff64c34ac2 (AV positives: 21/65 scanned on 10/06/2017 15:00:14) File SHA256: 81e2f19e65459b2f0a652760d02f7a058f746b3afeb52e19446783f40293dd74 (AV positives: 21/66 scanned on 10/06/2017 15:00:00) File SHA256: 46ba7509fb07e815ec9fe80d2f4d6e7747f18739f196d1df705896da5072f252 (AV positives: 29/65 scanned on 10/06/2017 14:49:01) File SHA256: ea57e82ae2e005c356c06a96a26a3471c71f1f3f0e331e6757051ed30c11f481 (AV positives: 30/66 scanned on 10/05/2017 06:10:02) File SHA256: 866f8e2743ee8012e575433410b678f2ff4f1c0b1414923ced94bf33c07dfe8f (AV positives: 11/66 scanned on 10/04/2017 20:49:23) File SHA256: 526556d3abc66a4f1a9c513fcda08add16b2c621871a97ea77d2f256b2079168 (Scanned on 08/12/2017 19:51:46) File SHA256: 5d42fe2ab6b1b174850caf3bf3ebb5c30ee9cfcfc390e4ca5485536f48b74507 (Scanned on 08/11/2017 18:57:20) File SHA256: c257d2bb806863e0463bf26ae8cdcf98c02edf8fe0ff6a46472ad15b520ee672 (Scanned on 07/29/2017 08:41:55) File SHA256: a8562ceb9a5cbc933c1e9224d84256815370bde264f25035fe14dc10f110c029 (Scanned on 07/22/2017 20:21:31) File SHA256: 3e625daaaa1fc1e1d23e6f685be88d123d8e414cc588a746175fb84f2897c2ef (Scanned on 07/19/2017 19:11:03)2d:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790650882369,"unified_at":"2026-09-29T03:01:22.369Z","metadata":{"hashes":{"sha256":"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713","sha1":"93865ce629497ee5746f393092be00cfc173e548","md5":"815dd180891f57da3a6208b6c3f97e7f","sha512":"658fe98a5b5d38171116803d69b7d3e39d99d17b02462131c8cb9bd3cff45eac4296ec61b9e851b7ef651371c993a4eec92e5130e7bfe42303473a675550b50b","ssdeep":"24576:NDY0fT0ny4aYbOTGTzmrFwhJl/46x15R9VoIQkWX10HlZrhTvLXKja8nTywG6i8W:xeny4IRE9hQ9X1QZrhTrKjdhFW","ssdeep_chunks":["24576:NDY0fT0","24576:DY0fT0n","24576:Y0fT0ny","24576:0fT0ny4","24576:fT0ny4a","24576:T0ny4aY","24576:0ny4aYb","24576:ny4aYbO","24576:y4aYbOT","24576:4aYbOTG","24576:aYbOTGT","24576:YbOTGTz","24576:bOTGTzm","24576:OTGTzmr","24576:TGTzmrF","24576:GTzmrFw","24576:TzmrFwh","24576:zmrFwhJ","24576:mrFwhJl","24576:rFwhJl/","24576:FwhJl/4","24576:whJl/46","24576:hJl/46x","24576:Jl/46x1","24576:l/46x15","24576:/46x15R","24576:46x15R9","24576:6x15R9V","24576:x15R9Vo","24576:15R9VoI","24576:5R9VoIQ","24576:R9VoIQk","24576:9VoIQkW","24576:VoIQkWX","24576:oIQkWX1","24576:IQkWX10","24576:QkWX10H","24576:kWX10Hl","24576:WX10HlZ","24576:X10HlZr","24576:10HlZrh","24576:0HlZrhT","24576:HlZrhTv","24576:lZrhTvL","24576:ZrhTvLX","24576:rhTvLXK","24576:hTvLXKj","24576:TvLXKja","24576:vLXKja8","24576:LXKja8n","24576:XKja8nT","24576:Kja8nTy","24576:ja8nTyw","24576:a8nTywG","24576:8nTywG6","24576:nTywG6i","24576:TywG6i8","24576:ywG6i8W","49152:NDY0fT0","49152:DY0fT0n","49152:Y0fT0ny","49152:0fT0ny4","49152:fT0ny4a","49152:T0ny4aY","49152:0ny4aYb","49152:ny4aYbO","49152:y4aYbOT","49152:4aYbOTG","49152:aYbOTGT","49152:YbOTGTz","49152:bOTGTzm","49152:OTGTzmr","49152:TGTzmrF","49152:GTzmrFw","49152:TzmrFwh","49152:zmrFwhJ","49152:mrFwhJl","49152:rFwhJl/","49152:FwhJl/4","49152:whJl/46","49152:hJl/46x","49152:Jl/46x1","49152:l/46x15","49152:/46x15R","49152:46x15R9","49152:6x15R9V","49152:x15R9Vo","49152:15R9VoI","49152:5R9VoIQ","49152:R9VoIQk","49152:9VoIQkW","49152:VoIQkWX","49152:oIQkWX1","49152:IQkWX10","49152:QkWX10H","49152:kWX10Hl","49152:WX10HlZ","49152:X10HlZr","49152:10HlZrh","49152:0HlZrhT","49152:HlZrhTv","49152:lZrhTvL","49152:ZrhTvLX","49152:rhTvLXK","49152:hTvLXKj","49152:TvLXKja","49152:vLXKja8","49152:LXKja8n","49152:XKja8nT","49152:Kja8nTy","49152:ja8nTyw","49152:a8nTywG","49152:8nTywG6","49152:nTywG6i","49152:TywG6i8","49152:ywG6i8W","24576:xeny4IR","24576:eny4IRE","24576:ny4IRE9","24576:y4IRE9h","24576:4IRE9hQ","24576:IRE9hQ9","24576:RE9hQ9X","24576:E9hQ9X1","24576:9hQ9X1Q","24576:hQ9X1QZ","24576:Q9X1QZr","24576:9X1QZrh","24576:X1QZrhT","24576:1QZrhTr","24576:QZrhTrK","24576:ZrhTrKj","24576:rhTrKjd","24576:hTrKjdh","24576:TrKjdhF","24576:rKjdhFW"],"imphash":"1d441dd687b03e6e3e28d8bce4bf2e96"},"file_info":{"file_name":"815dd180891f57da3a6208b6c3f97e7f","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1536800,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1507828528000,"last_seen":1654006725000,"last_multi_scan":1654006725000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":20,"suspicious_count":19,"malicious_count":6,"total":45},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDownloader/Popeng.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDownloader/Popeng.a","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 41182-2513-004C0610","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 41182-2347-0042F330\n GetLocalTime@KERNEL32.dll at 41182-3657-00481960\n GetLocalTime@KERNEL32.dll at 41182-3591-00481BB0\n GetSystemTimeAsFileTime@KERNEL32.dll at 41182-3585-004B676A\n GetSystemTime@KERNEL32.dll at 41182-4005-00459C90\n GetSystemTime@KERNEL32.dll at 41182-4411-00453AF0\n GetSystemTime@KERNEL32.dll at 41182-5544-0040E950\n GetSystemTimes@KERNEL32.dll at 41182-5029-004B347C\n GetSystemTimeAsFileTime@KERNEL32.dll at 41182-5441-004B695C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 41182-3131-004D0B28","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExA@KERNEL32.dll at 41182-1-004B9406\n GetVersionExW@KERNEL32.dll at 41182-3401-0048D220\n GetVersionExW@KERNEL32.dll at 41182-3719-004803C0\n GetVersionExW@KERNEL32.dll at 41182-3073-00497FE0\n GetVersion@KERNEL32.dll at 41182-3413-0048C500\n GetVersionExW@KERNEL32.dll at 41182-5656-0044F9A7\n GetVersion@KERNEL32.dll at 41182-4428-00416FD0\n GetVersionExW@KERNEL32.dll at 41182-5502-004026B0\n GetVersionExW@KERNEL32.dll at 41182-4333-00459D10\n GetVersionExA@KERNEL32.dll at 41182-7433-004B47E3\n GetVersionExA@KERNEL32.dll at 41182-6031-004B4913","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.dll at 41182-3210-004CC3F3\n EnumSystemLocalesA@KERNEL32.dll at 41182-3208-004CC458\n GetUserDefaultLCID@KERNEL32.dll at 41182-3207-004CC494","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 41182-5025-00413490\n GetDiskFreeSpaceExW@KERNEL32.dll at 41182-5409-0040E540","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$24","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 41182-2891-004D3950\n GetProcessHeap@KERNEL32.dll at 41182-3517-004D1C39\n GetProcessHeap@KERNEL32.dll at 41182-2528-004B4977\n GetProcessHeap@KERNEL32.dll at 41182-2894-004D3890\n GetProcessHeap@KERNEL32.dll at 41182-4990-004B4AFF\n GetProcessHeap@KERNEL32.dll at 41182-5662-00450625\n GetProcessHeap@KERNEL32.dll at 41182-5664-00450598","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/66 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cf.3g.qq.com\"\n \"masterconn11.qq.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"112.90.77.202:443\"\n \"58.250.137.93:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"D:\\jenkins_Trunk\\workspace\\QXSceneTips\\qqpcmgr_proj\\Output\\BinFinal\\QXRepairTools.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeW@KERNEL32.dll at 41182-3442-0048B240","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$27","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"GlobalMgr.db\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.dll at 41182-3407-0048CD80\n OpenServiceW@ADVAPI32.dll at 41182-3406-0048CEE0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.9829058847","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"DES\" (Indicator: \"des\"; File: \"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"vmware\" (Indicator: \"vmware\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://masterconn11.qq.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceExW@KERNEL32.dll at 41182-2265-00405A20\n FindResourceW@KERNEL32.dll at 41182-2389-004272A0\n FindResourceW@KERNEL32.dll at 41182-2262-004055E0\n LockResource@KERNEL32.dll at 41182-2264-00405AB0\n FindResourceW@KERNEL32.dll at 41182-5394-004141C0\n FindResourceW@KERNEL32.dll at 41182-5051-004492F0\n FindResourceW@KERNEL32.dll at 41182-4883-0042CB80","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"\" called \"OpenService\" to access the \"gpsvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 41182-5342-00414A20\n InternetReadFile@WININET.dll at 41182-6473-0045120C","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"cf.3g.qq.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n \"113.105.95.120\"\n \"125.39.120.82\"\n \"183.62.104.184\"\n \"125.39.202.18\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 41182-3286-004B346A","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"System Destruction","name":"Tries to obtain a handle with write access to the physical drive","description":"\"\" attempted to obtain write access to \"PhysicalDrive0\"","origin":"API Call","relevance":10,"id":"api-58","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 41182-4320-00455B10\n SetSecurityDescriptorDacl@ADVAPI32.dll at 41182-4327-00457160\n SetSecurityDescriptorDacl@ADVAPI32.dll at 41182-5545-00408C20","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$29","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$2a","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe.bin\" has a section named \"qmnet\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 41182-3080-00497480\n DeviceIoControl@KERNEL32.dll at 41182-3711-00443B40\n DeviceIoControl@KERNEL32.dll at 41182-3710-004443E0\n DeviceIoControl@KERNEL32.dll at 41182-3081-004971A0\n DeviceIoControl@KERNEL32.dll at 41182-3079-00497D20\n DeviceIoControl@KERNEL32.dll at 41182-4325-00494C50\n DeviceIoControl@KERNEL32.dll at 41182-6869-00497C54\n DeviceIoControl@KERNEL32.dll at 41182-6412-00444362","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"malicious","category":"System Destruction","name":"Interacts with the primary disk partition (DR0)","description":"\"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x74080\n \"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x7c088\n \"\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","origin":"API Call","relevance":5,"id":"api-59","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"%SYSTEMROOT%\\system32\\ntoskrnl.exe\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Tries to hide a procedure lookup using single characters","description":"Found a lot of single characters ('A','A','A','?','G','e','t','P','l','a','t','f','o','r','m','C','o','r','e','@','C','o','r','e','@','U','t','i','l','@','@','Y','H','P','P','U','I','T','X','C','o','r','e','@','@','@','Z','l','l','l','a','a','a','a','M','e','d','W','P','t','c','h','D','o','m','i','n','w','w','S','S','h','o','M','e','d','a','l','W','a','l','l','T','i','m','e','h','o','M','e','d','a','l','W','a','l','l','V','e','r','s','i','o','n') being pushed to stack and GetProcAddress@KERNEL32.dll in the same context (relevant concatenated strings: 'Core@Core@Util@@YAHPAPAUITXCore@@@Z') at: 41182-4206-00463370","origin":"Hybrid Analysis Technology","relevance":9,"id":"stream-36","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":62,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":13,"files_deleted_count":0,"registry_keys_created_count":65,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":65,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59dfa1577ca3e13c8a296323","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["CHN"],"submit_name":"815dd180891f57da3a6208b6c3f97e7f","analysis_start_time":"2017-10-12T19:07:59+00:00","indicators_count":{"informative":20,"suspicious":23,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"112.90.77.202","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"address":"58.250.137.93","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}],"dns_resolutions":[{"domain":"cf.3g.qq.com","address":"203.205.146.22","country":"China","registrar_name":"HICHINA ZHICHENG TECHNOLOGY LTD.","registrar_organization":"Shenzhen Tencent Computer Systems Company Limited","registrar_creation_date":"1995-05-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"domain":"masterconn11.qq.com","address":"58.250.137.93","country":"China","registrar_name":"HICHINA ZHICHENG TECHNOLOGY LTD.","registrar_organization":"Shenzhen Tencent Computer Systems Company Limited","registrar_creation_date":"1995-05-04T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}],"processes":[{"pid":3560,"ppid":0,"name":"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe","command_line":"","sha256":"56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713","normalized_path":"C:\\56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713.exe","uid":"00041190-00003560","icon":"$2d"}],"all_imported_dlls":["imm32.dll","shell32.dll","wininet.dll","webio.dll","shlwapi.dll","urlmon.dll","winhttp.dll","ws2_32.dll","dnsapi.dll","crypt32.dll","comctl32.dll","usp10.dll","IPHLPAPI.DLL","wkscli.dll","dhcpcsvc.dll","schannel.dll","cryptbase.dll","lpk.dll","advapi32.dll","ole32.dll","nlaapi.dll","mswsock.dll","FWPUCLNT.DLL","rasadhlp.dll","sechost.dll","profapi.dll","pnrpnsp.dll","dwmapi.dll","WSHTCPIP.DLL","ncrypt.dll","bcrypt.dll","secur32.dll","gpapi.dll","user32.dll","version.dll","winrnr.dll","credssp.dll","userenv.dll","ntdll.dll","msctf.dll","oleaut32.dll","NapiNSP.dll","sspicli.dll","rpcrt4.dll","iertutil.dll","msvcrt.dll","winnsi.dll","msasn1.dll","GdiPlus.dll","netapi32.dll","wshqos.dll","cryptsp.dll","kernel32.dll","KernelBase.dll","netutils.dll","bcryptprimitives.dll","gdi32.dll","nsi.dll","srvcli.dll","uxtheme.dll","wship6.dll","rsaenh.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"GlobalMgr.db","sha256":"bc5401d824934ac5465fcf74e1c2c73dd2b179e1b070be0cc3ae8076542f44ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Tencent\\QQP3C4Mgr\\d3r.ini","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%APPDATA%\\Tencent","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%APPDATA%\\Tencent\\DeskUpdate","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%APPDATA%\\Tencent\\DeskUpdate\\GlobalMgr.db","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%WINDIR%\\system32\\en-US\\CRYPT32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"C:\\Tencent\\UninstTime.dat","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"path":"%ALLUSERSPROFILE%\\Application Data\\Tencent\\QQP3C4Mgr\\d2r.ini","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"59dfa1577ca3e13c8a296323"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["59dfa1577ca3e13c8a296323"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious TrojanDownloader/Popeng.a Sample 56f408465e43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 56f408465e43…. Malware family: TrojanDownloader/Popeng.a. Threat score 100/100. 1/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713"}],["$","meta","4",{"property":"og:title","content":"Malicious TrojanDownloader/Popeng.a Sample 56f408465e43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 56f408465e43…. Malware family: TrojanDownloader/Popeng.a. Threat score 100/100. 1/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/56f408465e43ae504ce28e9bcfd2bc1b8d519aa62fc2248cb9c305165d635713"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TrojanDownloader/Popeng.a Sample 56f408465e43… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 56f408465e43…. Malware family: TrojanDownloader/Popeng.a. Threat score 100/100. 1/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]