24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Jaik.Generic Sample 5831e614d79f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5831e614d79f…. Malware family: Jaik.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","keywords":["Malicious","Jaik.Generic","malware analysis","sandbox report","threat intelligence","5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d"],"about":{"@type":"SoftwareApplication","name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","applicationCategory":["peexe","executable"],"identifier":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Jaik.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5b1,The input sample is signed with a certificate issued by "EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA" (SHA1: E0:AB:05:94:20:72:54:93:05:60:62:02:36:70:F7:CD:2E:FC:66:66; see report for more information) The input sample is signed with a certificate issued by "CN=thawte Primary Root CA, OU="c 2006 thawte Inc. - For authorized use only", OU=Certification Services Division, O="thawte Inc.", C=US" (SHA1: 91:C6:D6:EE:3E:8A:C8:63:84:E5:48:C2:99:29:5C:75:6C:81:7B:81; see report for more information) The input sample is signed with a certificate issued by "EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA" (SHA1: 1F:A4:90:D1:D4:95:79:42:CD:23:54:5F:6E:82:3D:00:00:79:6E:A2; see report for more information) The input sample is signed with a certificate issued by "CN=thawte Primary Root CA, OU="c 2006 thawte Inc. - For authorized use only", OU=Certification Services Division, O="thawte Inc.", C=US" (SHA1: 80:8D:62:64:2B:7D:1C:4A:9A:83:FD:66:7F:7A:2A:9D:24:3F:B1:C7; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Code Signing CA - G2, O="Thawte Inc.", C=US" (SHA1: 11:24:E3:1F:55:38:AB:B6:56:DF:BD:45:E6:42:01:B0:70:12:00:BD; see report for more information)26:T534,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\SysWOW64\shdocvw.dll" ".exe" touched file "C:\Windows\SysWOW64\en-US\shdocvw.dll.mui" ".exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db" ".exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk"27:T52b,Pattern match: "http://www.winimage.com/zLibDll" Heuristic match: "ad.naver.com" Pattern match: "https://www.verisign.com/rpa" Pattern match: "www.crosscert.com/rpa" Pattern match: "SVRSecure-G3-crl.verisign.com/SVRSecureG3.crl0E" Pattern match: "https://www.crosscert.com/rpa0" Pattern match: "http://ocsp.verisign.com0@" Pattern match: "SVRSecure-G3-aia.verisign.com/SVRSecureG3.cer0n" Pattern match: "http://logo.verisign.com/vslogo1.gif0" Pattern match: "http://ocsp.verisign.com0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa04" Pattern match: "http://crl.verisign.com/pca3-g5.crl0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.verisign.com/cps0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "https://www.thawte.com/cps0" Pattern match: "http://crl.thawte.com/ThawtePremiumServerCA.crl0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://th.symcb.com/th.crl0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://th.symcd.com0&" Pattern match: "http://th.symcb.com/th.crt0" Heuristic match: "ocsp.thawte.com"28:Taa4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHwklEQVR42u2Xe1BU5xnGz+6yGEPaNE4NGqOoiZNepmlrbZvamKROMjZNsSYCdezYTlNNrVWMRqKS2gGjEgUBEblkVAQKihcgwRgRmgTEaLAIyZSEi9yE3S4Le9+ze+5P37PnaIPBgObfnpln9szuft/7+57vPe/3Hob5/3XT9dkPGVgXkH5FesEA6/Iw9P/OjB5S91haFobuXzPofnp0ffwUgzEBhmMZsH8h/Y2UQsowwrfPCA/JfSulk1JISaStDNyvkDYa4N5g1PQyaa0RtlXGWwO0EJ3t9wyE1xhIOaRKUi2pgfThGPqA9BbpqK5/kApNkArMmg6RcszgU80EYUDLaE70PMPAs5oG7mWglJLeI10i/YsBmr9cykf6/8+QTpMIRjlpgHLURHOFQSkOh3IwHFJmODxrjFBjjQ6wngAO0uAqPXiTpjEBLpMukup0kGod4gSjQYwbYKNqHQ16l9Q4SiA1SK0B8tkIiOcehHB2FrjT08BVToJQHg6xgsa/o4+ne6XMeJsObKIJSmjguVsAqKsrCYN0mIIWLgR7OBqe/U/Ak/5dsHvvBXeAgVimO3iSVl5i1jRugFcJ4Ji6Sg1A3X/VXqmeJqZViRWTIB77PoRTseCrdyBYkw1/1W74j60Dm/sEAhnTwGZHIJBnhHgkDCidENL4AbZQsJP6Shv1vaVcEGlFXD6DYMG3ETy9GtzlwxD7myE5+iEO9UJoex/cW4nwZS6E47XpcCSYEdxnvgOAzQRwQneAAsvnKfhZE4SKSPAlc8FVrQTXVAT+WhMk1oXrl+SyQmiuAlu5Ha7spXBsfxTePZEIUkAxn4IfJuWPByBBe45DWdyg2m4CVzwRfMUCiBeSIbVXQRrqgBRwQxb5GwAyH4TstkHobUKg4RC8pWvg2PkDODaEI5BCwXNJObfzFFSqmWyCSBnOl8+HULcJUtdZKK5uKLwfishBCbig+O2a1Hv6TgUT+q8gcKkY7sKX4NzxI/h2PIAgQQjp460Db1LwYjWDJ0J+dyGkK7sh9VbTCvu04JIIJUgB7Z9CsTRqUu8DzpArEuuEaGsH/0klAmeS4d77OIbjw8G+Pg4A50uUbG+Q9QcfgFz+c8qDrRSgDor3Gq0wQFazkLyDlICNEJsKINSngns/DdylQrK/MfSb+h9FlbMbYkcNvCcS4EiZDzYtClLaBKq2ppEAa9ZtwKZNCXekfYmr4CKbnfufB1ubAf5qPUS3VXOJ85JrAxC6LxDgQYiliyHtiIBnZdhIAHUiHyWS3XYNg7Z+8M5+CKwDosRDVGTQVNqnLEIQghCCHvp9iLbBEYJwbjFiOGkG3Ifi4K9JB9fZAMk3RE4EoNAYRSAQRxvkmq0QUufA8+f70HszgF0C+traYOvtwq6C9xDxdBqmLM7Cw7/Nx5xleTc0dUk25tB3krsLCtsXAuCKGPip+Dh3PQRH+nPwVaeRE+chuiwEIJMbPGSfDWLjEQSPLKdE/w4GbgYYkoGeT9tg6e4B7xpAZf1nmBWXgym/ycKMpbmYEXOAlINvPpeJqCVZNHk7EOwNAahFi6fq6d5pwvC2B+EtiEWQ8kJoqw0VKjlADgQ84Jsr4S9dD1fCPFhuBhgmgD4CGOjuw6B9kDLaje3FFzHp2QxExeZipq7JBPDw0gzILAFwOsBFrW/g6Ahnc+9GYP8sKsVPIXjyZfANhRAHWiH7nVQfCqhIxWJ47bfQNxrAtfYOWHr6IDqtqL3ciVmxeYiK+V/wmXF5uD8EkAmZIwBeB1BL9gVSDYEcJzcyGQRevweBvfMQKPwT+MYyekJa4KtMhiN5PuyrZ6J38cSRAE5KwoHOLvisnfi4uQ2PLH8T05ceoMB5oeDTn8/GtCX7yYEMzCEAKfg5gDq9dNNhJZcTRIERfNZdCO65H+yeR+EvWAHf8a1wpy6CI34G1YSHMPDXR0YCqFXd0tMFd38Hol8pw+ToLMyOyw3ZPyU6E5HPptLeZyLiFymYvYS24PMA5/QuqEqvoGXqca22XwYEtoXDmzwbzqS5cKydiqEVd+EqOfDR+h+PBPAQAEuqax1EZPQ+SsC8G8GNjyXhVPUHaPrkMpif/h2Ri97QcuB6EqrNx9ukU9R8HFdbMDPkIuoB88NoO8xgd30D3i2T4XjxbrLe9MUKeL0OUBogu6IF9/4yIwSgWm76WRKyis5AcbcCnn/j7X/W4+tPbqeKRwABHYBaL/kUqcQE+YhZk96ICrlh4HYZ4KUzpjeOwfnHmdEB/PqpllXegnueSaPky8GEJ3dic3o5pMFWBIfbwVExUZyteKemHrKHAPxaHVCKqPs9RA0Itef8HkNIoaCbqS2PN8BHXZYt/kveB9RJVPtF0rkrFkxYmErbkIUptO+2rlbwljZ4LO1grW3g7O1Q1Krm6gDofFDHShlmiLtppYn0GNL7AEsBPesM6Ith0L6IVk6tfsvKMQA4Cu4WaFvpc8GaYjDfS8TcP+SFXFHBWFGGz9KJ4H86wQ12QrBfhezUAPwvGuFfQSsmiz3L6AVm1dfQ+cf7MO5XMXUStbVwBLVgQ14eL7x6FMxPtiEm8Tg+bLWGfvcMdBNADzgSb+2CaNcABh6jV7h5uhaYYY2dirqYqNsDCLVVuP1LHfuVX0bXxW+84+N4W1LSVwb4Lwt/8GS7/2zhAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791208797820,"unified_at":"2026-10-05T13:59:57.820Z","metadata":{"hashes":{"sha256":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","sha1":"af633f81e3b251395799077283252045a3e0fc80","md5":"fa6ee9e969df5ca4524daa77c172a1a7","sha512":"0b521d735fc100cb1fef700278df35e30264a8723fb592ac7ba0efc06214ffce8bd1566b5f9c8cc0c4e5c91411c29b531d646720997566cd1488d68f8bb18c10","ssdeep":"3072:1Rl5xpIJewd7s0N3igZeCjZiKlZED6jUBf9kXZRZTBfgCA858lf2nXu:175xpGXZ3ZeCjIKliD6KuZ/TBrAW8lD","ssdeep_chunks":["3072:1Rl5xpI","3072:Rl5xpIJ","3072:l5xpIJe","3072:5xpIJew","3072:xpIJewd","3072:pIJewd7","3072:IJewd7s","3072:Jewd7s0","3072:ewd7s0N","3072:wd7s0N3","3072:d7s0N3i","3072:7s0N3ig","3072:s0N3igZ","3072:0N3igZe","3072:N3igZeC","3072:3igZeCj","3072:igZeCjZ","3072:gZeCjZi","3072:ZeCjZiK","3072:eCjZiKl","3072:CjZiKlZ","3072:jZiKlZE","3072:ZiKlZED","3072:iKlZED6","3072:KlZED6j","3072:lZED6jU","3072:ZED6jUB","3072:ED6jUBf","3072:D6jUBf9","3072:6jUBf9k","3072:jUBf9kX","3072:UBf9kXZ","3072:Bf9kXZR","3072:f9kXZRZ","3072:9kXZRZT","3072:kXZRZTB","3072:XZRZTBf","3072:ZRZTBfg","3072:RZTBfgC","3072:ZTBfgCA","3072:TBfgCA8","3072:BfgCA85","3072:fgCA858","3072:gCA858l","3072:CA858lf","3072:A858lf2","3072:858lf2n","3072:58lf2nX","3072:8lf2nXu","6144:1Rl5xpI","6144:Rl5xpIJ","6144:l5xpIJe","6144:5xpIJew","6144:xpIJewd","6144:pIJewd7","6144:IJewd7s","6144:Jewd7s0","6144:ewd7s0N","6144:wd7s0N3","6144:d7s0N3i","6144:7s0N3ig","6144:s0N3igZ","6144:0N3igZe","6144:N3igZeC","6144:3igZeCj","6144:igZeCjZ","6144:gZeCjZi","6144:ZeCjZiK","6144:eCjZiKl","6144:CjZiKlZ","6144:jZiKlZE","6144:ZiKlZED","6144:iKlZED6","6144:KlZED6j","6144:lZED6jU","6144:ZED6jUB","6144:ED6jUBf","6144:D6jUBf9","6144:6jUBf9k","6144:jUBf9kX","6144:UBf9kXZ","6144:Bf9kXZR","6144:f9kXZRZ","6144:9kXZRZT","6144:kXZRZTB","6144:XZRZTBf","6144:ZRZTBfg","6144:RZTBfgC","6144:ZTBfgCA","6144:TBfgCA8","6144:BfgCA85","6144:fgCA858","6144:gCA858l","6144:CA858lf","6144:A858lf2","6144:858lf2n","6144:58lf2nX","6144:8lf2nXu","3072:175xpGX","3072:75xpGXZ","3072:5xpGXZ3","3072:xpGXZ3Z","3072:pGXZ3Ze","3072:GXZ3ZeC","3072:XZ3ZeCj","3072:Z3ZeCjI","3072:3ZeCjIK","3072:ZeCjIKl","3072:eCjIKli","3072:CjIKliD","3072:jIKliD6","3072:IKliD6K","3072:KliD6Ku","3072:liD6KuZ","3072:iD6KuZ/","3072:D6KuZ/T","3072:6KuZ/TB","3072:KuZ/TBr","3072:uZ/TBrA","3072:Z/TBrAW","3072:/TBrAW8","3072:TBrAW8l","3072:BrAW8lD"],"imphash":"3301cb3286914c2fe95c03960c53b7dd"},"file_info":{"file_name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","file_type":["peexe","executable"],"file_type_id":"exe","file_size":181232,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1635586669000,"last_seen":1635664272000,"last_multi_scan":1635664272000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["duuzer","targeted","wanacrypt0r","wannacry","wcry"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":14,"suspicious_count":7,"malicious_count":5,"total":26},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Backdoor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.41149","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.41149 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/NukeSped.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Backdoor/Escad.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 004d4c4f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.WildPositron.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXHJ-NM!FA6EE9E969DF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.WildPositron.fodmpx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AOSP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Backdoor.Duuzer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.FakeInstaller.181232","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.WildPositron","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.589177","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Jaik.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Creates a resource fork (ADS) file (often used to hide data)"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Queries volume information of an entire harddrive"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00003016-00000046-6686898\n \".exe\" queries volume information of \"%USERPROFILE%\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe\" at 00000000-00003016-00000046-6767500","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00003016-00000046-6686898","origin":"API Call","mitre_attack_id":"T1120","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\5831E614D79F3259FD48CFD5CD3C7E8E2C00491107D2C7D327970945AFCB577D.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\5831E614D79F3259FD48CFD5CD3C7E8E2C00491107D2C7D327970945AFCB577D.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.thawte.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"202.39.254.231:443\"\n \"110.77.140.155:443\"\n \"90.80.152.49:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Shortcut\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{00021401-0000-0000-C000-000000000046}\")\n \".exe\" touched \"Computer\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \".exe\" touched \"UsersFiles\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\\SHELLFOLDER\")\n \".exe\" touched \"delegate folder that appears in Users Files Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\\SHELLFOLDER\")\n \".exe\" touched \"Shell File System Folder\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\\INPROCSERVER32\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$25","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk.bin\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Archive ctime=Sat Oct 30 07:50:00 2021 mtime=Sat Oct 30 07:50:00 2021 atime=Sat Oct 30 07:29:39 2021 length=181232 window=\"\n \"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Has Working directory Archive ctime=Sat Oct 30 07:50:00 2021 mtime=Sat Oct 30 07:50:00 2021 atime=Sat Oct 30 07:29:39 2021 length=181232 window=\"\n \"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.bin\" was detected as \"VC8 -> Microsoft Corporation\"\n \"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 202.39.254.231 on port 443 is sent without HTTP header\n TCP traffic to 110.77.140.155 on port 443 is sent without HTTP header\n TCP traffic to 90.80.152.49 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyW\n GetUserNameW\n GetDriveTypeW\n GetFileAttributesA\n FindNextFileA\n GetFileAttributesW\n UnhandledExceptionFilter\n GetTempPathA\n GetTempPathW\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n TerminateProcess\n CreateToolhelp32Snapshot\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n GetFileSize\n OpenProcess\n GetStartupInfoW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetComputerNameW\n GetFileSizeEx\n FindFirstFileA\n GetTempFileNameA\n FindFirstFileW\n CreateFileW\n CreateFileA\n Process32NextW\n GetCommandLineW\n Process32FirstW\n FindNextFileW\n GetModuleHandleW\n WriteFile\n CreateProcessW\n Sleep\n socket\n send\n WSAStartup\n connect\n closesocket","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"71111e027a3b1d02ab8b02007f950200fc8c0200729602006cc805001ecd1a027d261a02\" to virtual address \"0x755607E4\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"c0df6e771cf96d77ccf86d770d646f7700000000c0118a7500000000fc3e8a7500000000e0138a75000000009457eb7625e06e77c6e06e7700000000bc6aea7600000000cf318a75000000009319eb76000000002c328a7500000000\" to virtual address \"0x76961000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"7d07727781ed7077ae866f77c6e06e77effd71772d16707760147277478d6f77a8e26e7760896f7700000000ad37e6768b2de676b641e67600000000\" to virtual address \"0x739A1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"%USERPROFILE%\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe:Zone.Identifier\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/69 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/69 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"49/69 Antivirus vendors marked dropped file \"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe\" as malicious (classified as \"Gen:Variant.Jaik\" with 71% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate was explicitly revoked by its issuer. (0x800b010c)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the windows installation language"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["duuzer","targeted","wanacrypt0r","wannacry","wcry"],"sample_flags":["Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"617d10073824077d764686b3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Jaik","contacted_countries":["FRA","THA","TWN","USA"],"submit_name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","analysis_start_time":"2021-10-30T09:27:38+00:00","indicators_count":{"informative":14,"suspicious":13,"malicious":6},"tags":["Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"202.39.254.231","port":443,"protocol":"TCP","country":"Taiwan; Republic of China (ROC)","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"address":"110.77.140.155","port":443,"protocol":"TCP","country":"Thailand","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"address":"90.80.152.49","port":443,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}],"dns_resolutions":[{"domain":"ocsp.thawte.com","address":"23.49.139.27","ttl":257,"country":"United States","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Symantec Corporation","registrar_name_servers":"A4.NSTLD.COM","registrar_creation_date":"1996-02-10T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}],"processes":[{"pid":3016,"ppid":0,"name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe","command_line":"","sha256":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","normalized_path":"C:\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe","uid":"00000000-00003016","icon":"$28"}],"all_imported_dlls":["ntmarta.dll","shdocvw.dll","srvcli.dll","cscapi.dll","advapi32.dll","wow64cpu.dll","msvcrt.dll","sechost.dll","shell32.dll","winnsi.dll","imm32.dll","apphelp.dll","WSHTCPIP.DLL","gdi32.dll","lpk.dll","cryptbase.dll","oleaut32.dll","mswsock.dll","wow64win.dll","kernel32.dll","shlwapi.dll","user32.dll","ws2_32.dll","IPHLPAPI.DLL","clbcatq.dll","propsys.dll","devobj.dll","Wldap32.dll","slc.dll","sspicli.dll","ole32.dll","uxtheme.dll","ntdll.dll","wow64.dll","usp10.dll","api-ms-win-core-synch-l1-2-0.dll","comctl32.dll","setupapi.dll","KernelBase.dll","nsi.dll","profapi.dll","cfgmgr32.dll","linkinfo.dll","ntshrui.dll","rpcrt4.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe","sha256":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk","sha256":"972fa8a84fbea559bb157079a7b4c211f1c2e588a0dd9d90a859c0809a5c8353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"name":"5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk.bin","sha256":"972fa8a84fbea559bb157079a7b4c211f1c2e588a0dd9d90a859c0809a5c8353","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"C:\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"C:\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%USERPROFILE%\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000020.db","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d.exe.lnk","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"617d10073824077d764686b3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["617d10073824077d764686b3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Jaik.Generic Sample 5831e614d79f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5831e614d79f…. Malware family: Jaik.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d"}],["$","meta","4",{"property":"og:title","content":"Malicious Jaik.Generic Sample 5831e614d79f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5831e614d79f…. Malware family: Jaik.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5831e614d79f3259fd48cfd5cd3c7e8e2c00491107d2c7d327970945afcb577d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Jaik.Generic Sample 5831e614d79f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5831e614d79f…. Malware family: Jaik.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 5 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]