24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T440,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 589ec4c5fc50… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 589ec4c5fc50…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227","keywords":["Clean","malware analysis","sandbox report","threat intelligence","589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227"],"about":{"@type":"SoftwareApplication","name":"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227","applicationCategory":["pedll","executable"],"identifier":"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T433,Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "00000000-00004084.00000000.84714.00441000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00004084.00000000.84714.00441000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004084.00000000.84714.00441000.00000020.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004084.00000000.84714.00441000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004084.00000000.84714.00441000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004084.00000000.84714.00441000.00000020.mdmp")26:Tf18,Found string - This file contains BrowserCaps rules that are merged with the ones from ASP.NET to override certain values that we don't like. --> Later versions of Opera use a connection string that looks like Chrome but includes OPR/ --> Microsoft Edge (Project Spartan) uses a UA string that looks like Chrome but includes Edge/ --> The BrowserCaps name; Source: "589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227") Found string - eckOn||p.each(["radio","checkbox"],function(){p.valHooks[this]={get:function(a){return a.getAttribute("value")===null?"on":a.value}}}) p.each(["radio","checkbox"],function(){p.valHooks[this]=p.extend(p.valHooks[this],{set:function(a,b){if(p.isArray(b))return a.checked=p.inArray(p(a).val() b)>=0}})});var V=/^(?:textarea|input|select)$/i W=/^([^\.]*|)(?:\.(.+)|)$/ X=/(?:^|\s)hover(\.\S+|)\b/ Y=/^key/ Z=/^(?:mouse|contextmenu)|click/ $=/^(?:focusinfocus|focusoutblur)$/ _=function(a){return p.event.special.hover?a:a.replace(X,"mouseenter$1 mouseleave$1")};p.event={add:function(a,c,d,e,f){var g h i j k l m n o q r;if(a.nodeType===3||a.nodeType===8||!c||!d||!(g=p._data(a)))return;d.handler&&(o=d,d=o.handler,f=o.selector) d.guid||(d.guid=p.guid++) i=g.events i||(g.events=i={}) h=g.handle h||(g.handle=h=function(a){return typeof p!="undefined"&&(!a||p.event.triggered!==a.type)?p.event.dispatch.apply(h.elem,arguments):b} h.elem=a) c=p.trim(_(c)).split(" ");for(j=0;j=0}})});var V=/^(?:textarea|input|select)$/i,W=/^([^\.]*|)(?:\.(.+)|)$/,X=/(?:^|\s)hover(\.\S+|)\b/,Y=/^key/,Z=/^(?:mouse|contextmenu)|click/,$=/^(?:focusinfocus|focusoutblur)$/,_=function(a){return p.event.special.hover?a:a.replace(X,"mouseenter$1 mouseleave$1")};p.event={add:function(a,c,d,e,f){var g,h,i,j,k,l,m,n,o,q,r;if(a.nodeType===3||a.nodeType===8||!c||!d||!(g=p._data(a)))return;d.handler&&(o=d,d=o.handler,f=o.selector),d.guid||(d.guid=p.guid++),i=g.events,i||(g.events=i={}),h=g.handle,h||(g.handle=h=function(a){return typeof p!="undefined"&&(!a||p.event.triggered!==a.type)?p.event.dispatch.apply(h.elem,arguments):b},h.elem=a),c=p.trim(_(c)).split(" ");for(j=0;j\" (Indicator: \"text/javascript\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: C1:39:73:5A:5D:68:FE:77:85:5A:A3:0A:B2:05:F8:0B:C6:38:AC:EF; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 3B:DA:32:3E:55:2D:B1:FD:E5:F4:FB:EE:75:D6:D5:B2:B1:87:EE:DC; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 3C:AF:9B:A2:DB:55:70:CA:F7:69:42:FF:99:10:1B:99:38:88:E2:57; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"regsvr32.exe\" trying to touch file \"C:\\Windows\\AppPatch\\sysmain.sdb\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\REGSVR32.EXE.LOCAL\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\\comctl32.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\System32\\regsvr32.exe\"\n \"regsvr32.exe\" trying to touch file \"C:\\Windows\\AppPatch\\AcGenral.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"regsvr32.exe\" touched file \"C:\\Windows\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\REGSVR32.EXE.LOCAL\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\REGSVR32.EXE.CONFIG\"\n \"regsvr32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \".ctor\" in \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Bind\" in \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"get_LocalEndPoint\" in \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\"","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net.Sockets\" in \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\"\n Observed namespace \"System.Net\" in \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set the value of an HTTP request header","description":"file/memory contains long string with (Indicator: \".setRequestHeader\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-623","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"Found reference to API \"GetRequestStream\" (Indicator: \"GetRequestStream\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \" socket \"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")\n file/memory contains long string with (Indicator: \" connect \"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.0.0.0\"\n \"14.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RSA algorithm (keys)","description":"YARA signature for RSA public and private key matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":3,"id":"yara-62","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access system credential hash file","description":"Found string \"resultantHash\" (Indicator: \"nthash\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1003.002","relevance":1,"id":"string-867","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueW\" in file \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in file \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\"\n Found registry query API: \"RegQueryValueW\" in \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"GZipStream\" (Indicator: \"GzipStream\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandle\" (Indicator: \"GetModuleHandle\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"password\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"k__BackingField\" (Indicator: \"\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")\n Found string \"k__BackingField\" (Indicator: \"\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"ping\"; File: \"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004084.00000000.84714.00441000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00004084-3038-30-0044175D\n GetModuleHandleA@KERNEL32.DLL at 00000000-00004084-3038-44-00442B04","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.DLL at 00000000-00004084-3038-52-00442519","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00004084-3038-27-00441467","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.DLL at 00000000-00004084-3038-20-004427D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetInformationProcess@NTDLL.DLL at 00000000-00004084-3038-36-00441A27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}]}],"intel_graph":{"map":{"File:589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227":{"type":"File","value":"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}},"chains":[{"id":"1560064255888145862","root":"File:589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}]}},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"6ad0090c1e53b0a0570bd2a7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","submit_name":"589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227","analysis_start_time":"2026-10-14T22:58:21+00:00","indicators_count":{"informative":99,"suspicious":5,"malicious":0},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad0090c1e53b0a0570bd2a7"}],"processes":[{"pid":3708,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00003708"},{"pid":4084,"ppid":0,"name":"regsvr32.exe","command_line":"/s \"C:\\589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227.dll\"","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","uid":"00000000-00004084","icon":"$30"}],"all_imported_dlls":["winmm.dll","sfc.dll","devobj.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","msvcrt.dll","lpk.dll","ntdll.dll","mpr.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","rpcrt4.dll","user32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","normaliz.dll","wininet.dll","gdi32.dll","ole32.dll","sspicli.dll","oleaut32.dll","version.dll","shell32.dll","sfc_os.dll","dwmapi.dll","advapi32.dll","usp10.dll","shlwapi.dll","setupapi.dll","cfgmgr32.dll","urlmon.dll","api-ms-win-downlevel-version-l1-1-0.dll","imm32.dll","kernel32.dll","uxtheme.dll","589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227.dll","mscoree.dll","KernelBase.dll","comctl32.dll","msacm32.dll","profapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rpcss.dll","cryptbase.dll","mscoreei.dll","userenv.dll","apphelp.dll","samcli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","iertutil.dll","sechost.dll","AcGenral.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ad0090c1e53b0a0570bd2a7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Clean Sample 589ec4c5fc50… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 589ec4c5fc50…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 589ec4c5fc50… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 589ec4c5fc50…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/589ec4c5fc502dc9f7762a2cae3aec262cd1c7009997fd2e349c299207eeb227"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 589ec4c5fc50… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 589ec4c5fc50…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]