26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49c,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 588cdbd3ee35… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 588cdbd3ee35…. Malware family: Trojan.Generic. Threat score 100/100. 13/27 AV engines flagged this file. 3 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/588cdbd3ee3594525eb62fa7bab148f6d7ab000737fc0c311a5588dc96794acc","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","588cdbd3ee3594525eb62fa7bab148f6d7ab000737fc0c311a5588dc96794acc"],"about":{"@type":"SoftwareApplication","name":"bounty-42340431287123069","applicationCategory":["peexe","64bits","executable"],"identifier":"588cdbd3ee3594525eb62fa7bab148f6d7ab000737fc0c311a5588dc96794acc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T520,Assembly shows XOR instruction xor rcx rsp in Stream UID: 51614-474-0000000140002093 Assembly shows XOR instruction xor ecx esp in Stream UID: 51614-474-0000000140002093 Assembly shows XOR instruction xor rcx rsp in Stream UID: 51614-529-00000001400088D8 Assembly shows XOR instruction xor ecx esp in Stream UID: 51614-529-00000001400088D8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 51614-700-0000000140014F95 Assembly shows XOR instruction xor ecx esp in Stream UID: 51614-700-0000000140014F95 Assembly shows XOR instruction xor qword ptr [rbp+10h] rax in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor dword ptr [rbp+10h] eax in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor rax qword ptr [rbp+20h] in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor eax dword ptr [rbp+20h] in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor rax qword ptr [rbp+10h] in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor eax dword ptr [rbp+10h] in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor rax rcx in Stream UID: 51614-851-000000014000D096 Assembly shows XOR instruction xor eax ecx in Stream UID: 51614-851-000000014000D09628:Td87,Contains base64 string in header "POST" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (Windows NT 6.0; WOW64; rv:31.0) Gecko/20100603 Firefox/18.0 Infopath.1553652112Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "/Anyboard/skin/board" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (Windows NT 6.0; WOW64; rv:31.0) Gecko/20100603 Firefox/18.0 Infopath.1553652112Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "Infopath" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (Windows NT 6.0; WOW64; rv:31.0) Gecko/20100603 Firefox/18.0 Infopath.1553652112Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "type" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (Windows NT 6.0; WOW64; rv:31.0) Gecko/20100603 Firefox/18.0 Infopath.1553652112Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "form" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (Windows NT 6.0; WOW64; rv:31.0) Gecko/20100603 Firefox/18.0 Infopath.1553652112Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "POST" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "/Anyboard/skin/board" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "MSIE" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "Infopath" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "Host" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "type" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0" Contains base64 string in header "form" in header "POST /Anyboard/skin/board.php HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112)Host: www.jinjinpig.co.krContent-type: application/x-www-form-urlencodedContent-length: 0"29:Tc65," "504F5354202F416E79626F6172642F736B696E2F626F6172642E70687020485454502F312E310A557365722D4167656E743A204D6F7A696C6C612F342E3020202857696E646F7773204E5420362E303B20574F5736343B2072763A33312E3029204765636B6F2F32303130303630332046697265666F782F31382E3020496E666F706174682E313535333635323131320A486F73743A207777772E6A696E6A696E7069672E636F2E6B720A436F6E74656E742D747970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A436F6E74656E742D6C656E6774683A20300A" HTTP/1.1 302 Found Date: Wed 15 Apr 2026 07:47:35 GMT Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/0.9.7m DAV/2 PHP/4.4.6 Location: http://www.anyhost.co.kr/error.html Content-Length: 348 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A....... "POST /Anyboard/skin/board.php HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.0; WOW64; Trident/4.0; Infopath.1553652112) Host: www.jinjinpig.co.kr Content-type: application/x-www-form-urlencoded Content-length: 0" with payload::==> "504F5354202F416E79626F6172642F736B696E2F626F6172642E70687020485454502F312E310A557365722D4167656E743A204D6F7A696C6C612F342E30202028636F6D70617469626C653B204D53494520382E303B2057696E646F7773204E5420352E303B20574F5736343B2054726964656E742F342E303B20496E666F706174682E31353533363532313132290A486F73743A207777772E6A696E6A696E7069672E636F2E6B720A436F6E74656E742D747970653A206170706C69636174696F6E2F782D7777772D666F726D2D75726C656E636F6465640A436F6E74656E742D6C656E6774683A20300A" HTTP/1.1 302 Found Date: Wed 15 Apr 2026 07:48:19 GMT Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/0.9.7m DAV/2 PHP/4.4.6 Location: http://www.anyhost.co.kr/error.html Content-Length: 348 Content-Type: text/html; charset=iso-8859-1 with response body ==>3C21444F43545950452048544D4C205055424C494320222D2F2F494554462F2F4454442048544D4C20322E302F2F454E223E0A3C68746D6C3E3C686561643E0A.......38:T5d9,"