26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T510,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.MSILheracles.Generic Sample 5722bae97daf… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5722bae97daf…. Malware family: Application.MSILheracles.Generic. Threat score 100/100. 18/28 AV engines flagged this file. 4 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2","keywords":["Malicious","Application.MSILheracles.Generic","malware analysis","sandbox report","threat intelligence","5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2"],"about":{"@type":"SoftwareApplication","name":"5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Application.MSILheracles.Generic","antivirusDetections":{"malicious":18,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T10ef,Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "5722bae97daf54f30f3fcca10ced0c88ec0e64f5c1de3152c332e6178b64acf2.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00004764.00000000.131597.003A2000.00000002.mdmp")28:T634,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to decrypt/decode data Matched sigs: Contains ability to perform AES decryption (Dotnet String) Matched sigs: Contains ability to encrypt data using RSA (Dotnet String) Matched sigs: Contains ability to decrypt data using RSA (Dotnet String) Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: Calls an API typically used to decrypt data Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Contains ability to perform crypto operations Matched sigs: Contains ability to perform asymmetric crypto operations Matched sigs: Contains ability to perform symmetric crypto operations Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Contains ability to perform CryptoStream operations (Dotnet) Matched sigs: Contains symmetric decryption functionality in .NET code Matched sigs: Dotnet file contains encryption/decryption functions29:T775,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004764.00000000.131597.02A00000.00000004.mdmp\")\n Found string \"ring=\"data source=.\\SQLEXPRESS;Integrated Security=SSPI;AttachDBFilename=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004764.00000001.132387.02A00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69cec2b552457a736a0f1217"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"Win32API|System Information Functions|GetUserName\" (Indicator: \"GetUserName\"; Source: \"00000000-00004764.00000001.132387.07260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69cec2b552457a736a0f1217"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"