26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 660f3c7e7a4f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 660f3c7e7a4f…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a"],"about":{"@type":"SoftwareApplication","name":"f0f09c0c29c0c16e7d7ce831c0472f5a.zip","applicationCategory":["peexe","executable"],"identifier":"660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T651,Found API call GetVersion@KERNEL32.DLL (Target: "f0f09c0c29c0c16e7d7ce831c0472f5a.exe"; Stream UID: "00014351-00003200-52574-5-00429D0C") which is directly followed by "cmp edx, 05h" and "jne 00429D2Bh". See related instructions: "... +0 call 00422584h ;GetVersion +5 mov edx, eax +7 and edx, 000000FFh +13 and eax, 0000FF00h +18 shr eax, 08h +21 cmp edx, 05h +24 jne 00429D2Bh" ... at 00014351-00003200-52574-5-00429D0C Found API call GetVersion@KERNEL32.DLL (Target: "f0f09c0c29c0c16e7d7ce831c0472f5a.exe"; Stream UID: "00014351-00003200-52574-9-00428620") which is directly followed by "cmp byte ptr [004D0B58h], 00h" and "je 0042869Eh". See related instructions: "... +19 call 00422584h ;GetVersion +24 and eax, 000000FFh +29 cmp eax, 06h +32 setnb byte ptr [004D0B58h] +39 cmp byte ptr [004D0B58h], 00h +46 je 0042869Eh" ... at 00014351-00003200-52574-9-00428620 Found API call GetVersion@KERNEL32.DLL (Target: "f0f09c0c29c0c16e7d7ce831c0472f5a.exe"; Stream UID: "00014351-00003200-52574-3358-004933D8") which is directly followed by "cmp al, 04h" and "jc 004935F8h". See related instructions: "... +152 call 00426FF4h +157 call 0042B50Ch ;GetVersion +162 cmp al, 04h +164 jc 004935F8h" ... at 00014351-00003200-52574-3358-004933D8 Found API call GetVersion@KERNEL32.DLL (Target: "f0f09c0c29c0c16e7d7ce831c0472f5a.exe"; Stream UID: "00014351-00003200-52574-3741-004CAC18") which is directly followed by "cmp al, 04h" and "setnb byte ptr [004D3248h]". See related instructions: "... +26 call 0042B50Ch ;GetVersion +31 cmp al, 04h +33 setnb byte ptr [004D3248h]" ... at 00014351-00003200-52574-3741-004CAC1828:T541,"\Sessions\1\BaseNamedObjects\28082017" "Local\c:!users!mp3fm93!appdata!local!microsoft!windows!history!history.ie5!" "Local\c:!users!mp3fm93!appdata!roaming!microsoft!windows!cookies!" "Local\c:!users!mp3fm93!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "Local\!IETld!Mutex" "28082017" "Local\_!MSFTHISTORY!_" "Local\c:!users!mp3fm93!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!mp3fm93!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mp3fm93!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mp3fm93!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!mp3fm93!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex"29:T42b,"" touched file "%WINDIR%\Fonts\staticcache.dat" "" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\system32\wshom.ocx" "" touched file "%APPDATA%\Microsoft\Windows\zxLVHZxE" "" touched file "%WINDIR%\system32\OLEACCRC.DLL" "" touched file "%WINDIR%\system32\en-US\urlmon.dll.mui" "" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "" touched file "%WINDIR%\System32\msxml3r.dll" "" touched file "%APPDATA%\Microsoft\Windows\Cookies" "" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "" touched file "%APPDATA%\Microsoft\Windows\IETldCache\index.dat" "" touched file "%WINDIR%\System32\en-US\ieframe.dll.mui" "" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "" touched file "%APPDATA%\Microsoft\Windows\zxLVHZxE"2a:Ta3d,"" wrote bytes "7739eb7679a8ef76be72ef76d62def761de2ea7605a2ef76c868ee7657d1f576bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x74A21000" (part of module "WSHIP6.DLL") "" wrote bytes "4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000" to virtual address "0x76FE1000" (part of module "NSI.DLL") "" wrote bytes "92e6ea7679a8ef76be72ef76d62def761de2ea7605a2ef76bee3ea76616fef766841ed760050ed7600000000ad3709778b2d0977b641097700000000" to virtual address "0x744F1000" (part of module "WSHTCPIP.DLL") "" wrote bytes "c4ca367580bb3675aa6e37759fbb367508bb367546ce367561383775de2f3775d0d9367500000000177975754f9175757f6f7575f4f7757511f77575f2837575857e757500000000" to virtual address "0x69B11000" (part of module "MSIMG32.DLL") "iexplore.exe" wrote bytes "e9e89afcf8" to virtual address "0x7550E30C" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9b943f2f8" to virtual address "0x75523B9B" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9fda405f9" to virtual address "0x755F4731" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e9652b03f9" to virtual address "0x7550ADF9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e98b8e05f9" to virtual address "0x755F5DEE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e937f20ef9" to virtual address "0x7555E963" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e99ac3c9f8" to virtual address "0x759B2694" (part of module "COMDLG32.DLL") "iexplore.exe" wrote bytes "e99d9af3f8" to virtual address "0x755F3E59" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e96ff10ef9" to virtual address "0x7555E9C9" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9ee7eeaf8" to virtual address "0x757A6143" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "e9c20a10f9" to virtual address "0x7554D274" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e9efb971fa" to virtual address "0x73F3388E" (part of module "COMCTL32.DLL") "iexplore.exe" wrote bytes "e9e9f00ef9" to virtual address "0x7555E9ED" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e955a5f3f8" to virtual address "0x755F3EAE" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "e99cf30ef9" to virtual address "0x7555E869" (part of module "USER32.DLL") "iexplore.exe" wrote bytes "e92e0d10f9" to virtual address "0x7554CF42" (part of module "USER32.DLL")2b:T57f,Found malicious artifacts related to "186.202.157.79" (ASN: , Owner: ): ... URL: http://simoneodontologia.com.br/images/data/0d0ab176950465ade89656c0569af7d1 (AV positives: 11/65 scanned on 08/28/2017 07:54:14) URL: http://livros.me/secure.rpaypals.com.account/ppl/srHiGQ1/login.php (AV positives: 7/65 scanned on 08/28/2017 07:21:13) URL: http://www.simoneodontologia.com.br/images/data/91b1fea42b0c3f477ceef08e8c9ed75a (AV positives: 10/65 scanned on 08/28/2017 06:54:43) URL: http://simoneodontologia.com.br/images/data/a21abb40eb6c97db6531af9ff521e3fa (AV positives: 10/65 scanned on 08/28/2017 06:54:16) URL: http://simoneodontologia.com.br/images/data/e0c0ce403c09e2351e123888022dd930 (AV positives: 11/65 scanned on 08/28/2017 05:55:09) File SHA256: 6906440330c6ec2ced8b76cc08aeacbe51323178afc9cc1556e97c16fa2a3943 (AV positives: 24/64 scanned on 07/16/2017 23:56:54) File SHA256: 911dcf4fc7ed0c04c8d8ca9b65561a0cde4b753dba1838f24ca6fb5da0d1d787 (AV positives: 24/64 scanned on 07/16/2017 23:55:01) File SHA256: eef16d311a2714086511e77ef438494134cce89afe11ca0b7999437f5b44688c (AV positives: 7/59 scanned on 06/24/2017 09:30:05) File SHA256: 5c483ef224942839f899c2f3afa13101923e214a00ddaf66491c118888b03141 (AV positives: 52/62 scanned on 06/24/2017 03:46:49) File SHA256: 37529535b9c834d15f8582765157274a65d9ac85805930947797a604071d49e0 (AV positives: 6/60 scanned on 04/19/2017 19:46:45)2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==2e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAIiwAAAAAAAAAAAAAAAAAAiIu7M7sAAAAAAAAAAAAAD4iLM7uzMwAAAAAAAAAAAA+IszcAC7uzBmYAAAAAAAAPiLMwAAAHd2ZmZmYAAAAAD4izMAAEZmZu7mZmRAAAAA+IszAERGbu6IjuZmRAAAAIiLOwQEZu7oiI7uZmQEAACIizswRmbu6IiO7mZmQAAAiLu7NGZm7u5mZu5mZmAAAIi7uzRmZm5kAARuZmZkAAAIu7u3ZmbmAAAABuZmZgBgCLu7u2Zm5gAAAARmZEQAcACLuLt2ZmQAAAAAQAAAAHAAC7e7tmZkZmZmZmZEQACAAAi3i7dkZmZmZmZmZmZAcAAAM3i7dEZmZmZmZmZmQAAAAAN4u7ZEZmZmZmZmZkAAAAAAd4u3YARERmZmZmZAAAAAAEeIu3QAAAAGZmZmQEAAAAAGeIuzcAAAZmZmZkAAAAAABmeIu3ePiGZmZmYEAAAAAARmeIu2ZmZmZmZkQAAAAAAAZ2eIu3d3d3d3YAAAAAAAAAd3eIu4iId3dkYANwAAAAAAeIiIu4iIiGBgALMAAAAAAAR4j4u4iHQEAACzAAAAAAAABHeIe7cEAAAAAwAAAAAAAAAAAAi7MwAAADMAAAAAAAAAAAAAi7uzNzMzAAAAAAAAAAAAAACLu7O7MAAAAAAAAAAAAAAAAAAAAADH////gB///wAH//8BwR//A/AB/wPAAH8DAAAfAgAADwAAAAcAAAAHAAAAA4AA8AGAAfgBwAP8AeAAAAHgAAAB8AAAAfAAAAHwAAAB8AP4AfAB8AP4AAAD+AAAB/wAAA/+AAAM/wAAHP+AADz/4AD+//gA/P//8AD///wB/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790441449955,"unified_at":"2026-09-26T16:50:49.955Z","metadata":{"hashes":{"sha256":"660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a","sha1":"2485c2e2f10aa2541b6aa099b6709ddfebc8f8d1","md5":"f0f09c0c29c0c16e7d7ce831c0472f5a","sha512":"568ca022ab11aab39a6d80d677b0585b1489c191872db95e7935ee63419059a158beadd908b8d44e6b00369d0453bfe4634f7a4398bbd99f4e108514cd415219","ssdeep":"6144:2JN7TIKaDicWGZ39OBxHdKt2NFnEmsco6q+l/J6C8tcIl:yVMKhfGZ3ib4cVEmK6q+l/gC82y","ssdeep_chunks":["6144:2JN7TIK","6144:JN7TIKa","6144:N7TIKaD","6144:7TIKaDi","6144:TIKaDic","6144:IKaDicW","6144:KaDicWG","6144:aDicWGZ","6144:DicWGZ3","6144:icWGZ39","6144:cWGZ39O","6144:WGZ39OB","6144:GZ39OBx","6144:Z39OBxH","6144:39OBxHd","6144:9OBxHdK","6144:OBxHdKt","6144:BxHdKt2","6144:xHdKt2N","6144:HdKt2NF","6144:dKt2NFn","6144:Kt2NFnE","6144:t2NFnEm","6144:2NFnEms","6144:NFnEmsc","6144:FnEmsco","6144:nEmsco6","6144:Emsco6q","6144:msco6q+","6144:sco6q+l","6144:co6q+l/","6144:o6q+l/J","6144:6q+l/J6","6144:q+l/J6C","6144:+l/J6C8","6144:l/J6C8t","6144:/J6C8tc","6144:J6C8tcI","6144:6C8tcIl","12288:2JN7TIK","12288:JN7TIKa","12288:N7TIKaD","12288:7TIKaDi","12288:TIKaDic","12288:IKaDicW","12288:KaDicWG","12288:aDicWGZ","12288:DicWGZ3","12288:icWGZ39","12288:cWGZ39O","12288:WGZ39OB","12288:GZ39OBx","12288:Z39OBxH","12288:39OBxHd","12288:9OBxHdK","12288:OBxHdKt","12288:BxHdKt2","12288:xHdKt2N","12288:HdKt2NF","12288:dKt2NFn","12288:Kt2NFnE","12288:t2NFnEm","12288:2NFnEms","12288:NFnEmsc","12288:FnEmsco","12288:nEmsco6","12288:Emsco6q","12288:msco6q+","12288:sco6q+l","12288:co6q+l/","12288:o6q+l/J","12288:6q+l/J6","12288:q+l/J6C","12288:+l/J6C8","12288:l/J6C8t","12288:/J6C8tc","12288:J6C8tcI","12288:6C8tcIl","6144:yVMKhfG","6144:VMKhfGZ","6144:MKhfGZ3","6144:KhfGZ3i","6144:hfGZ3ib","6144:fGZ3ib4","6144:GZ3ib4c","6144:Z3ib4cV","6144:3ib4cVE","6144:ib4cVEm","6144:b4cVEmK","6144:4cVEmK6","6144:cVEmK6q","6144:VEmK6q+","6144:EmK6q+l","6144:mK6q+l/","6144:K6q+l/g","6144:6q+l/gC","6144:q+l/gC8","6144:+l/gC82","6144:l/gC82y"],"imphash":"bf06d5320ebc0a7b538be87cdc925cb1"},"file_info":{"file_name":"f0f09c0c29c0c16e7d7ce831c0472f5a.zip","file_type":["peexe","executable"],"file_type_id":"exe","file_size":266752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1503913165000,"last_seen":1632283169000,"last_multi_scan":1632283169000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":22,"suspicious_count":18,"malicious_count":6,"total":46},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Banker]/Win32.BestaFera","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.igoss","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.AgentWDCR.INY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Heur.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.FDJV-1038","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.AgentWDCR.INY (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Banker.ADKT trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 004fec331 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Win32.BestaFera.wae","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.zv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.eiwtde","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Generic-L","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Banker/W32.BestaFera.266752","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Ater.AO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Bankfraud","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00014351-00003200-52574-1532-00432FF8\n GetLocalTime@KERNEL32.DLL at 00014351-00003200-52574-3743-00432FA8","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00014351-00003200-52574-5-00429D0C\n GetVersion@KERNEL32.DLL at 00014351-00003200-52574-9-00428620\n GetVersionExW@KERNEL32.DLL at 00014351-00003200-52574-3727-0043653C\n GetVersion@KERNEL32.DLL at 00014351-00003200-52574-3358-004933D8\n GetVersionExW@KERNEL32.DLL at 00014351-00003200-52574-5162-0042C090\n GetVersion@KERNEL32.DLL at 00014351-00003200-52574-3741-004CAC18","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultUILanguage@KERNEL32.DLL at 00014351-00003200-52574-80-004293E0\n GetUserDefaultUILanguage@KERNEL32.DLL at 00014351-00003200-52574-81-00429384","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00014351-00003200-52574-2263-00431758","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\f0f09c0c29c0c16e7d7ce831c0472f5a.exe\" at 00014351-00003200-0000010C-39990202","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\"; Value: \"00000000010000004800000043003A005C00500072006F006700720061006D002000460069006C00650073005C0049006E007400650072006E006500740020004500780070006C006F007200650072003B000000\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"musiknova.siteseguro.ws\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"186.202.157.79:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$28","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /SubLoad.dll HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0\nHost: musiknova.siteseguro.ws\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00016016-00002916)\n Launches browser \"iexplore.exe\" (UID: 00016050-00002876)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"iexplore.exe\" (UID: 00016016-00002916) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"DDEMLMom\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"iexplore.exe\" with commandline \"-nohome\" (UID: 00016016-00002916)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:2916 CREDAT:79873\" (UID: 00016050-00002876)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"GET /SubLoad.dll HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0\nHost: musiknova.siteseguro.ws\"","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"frameiconcache.dat\" has type \"data\"\n \"{BAD7AC94-8C16-11E7-989D-0A00278A626A}.dat\" has type \"Composite Document File V2 Document Cannot read section info\"\n \"RecoveryStore.{BAD7AC93-8C16-11E7-989D-0A00278A626A}.dat\" has type \"Composite Document File V2 Document Cannot read section info\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"musiknova.siteseguro.ws\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"f0f09c0c29c0c16e7d7ce831c0472f5a.exe.bin\" was detected as \"PECompact 2.0x Heuristic Mode -> Jeremy Collake\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.9989317581","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"4/63 reputation engines marked \"http://musiknova.siteseguro.ws\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00014351-00003200-52574-697-0042C774\n FindResourceW@KERNEL32.DLL at 00014351-00003200-52574-2427-0044F6D0\n FindResourceW@KERNEL32.DLL at 00014351-00003200-52574-2439-00454658\n FreeResource@KERNEL32.DLL at 00014351-00003200-52574-5854-004546C4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"iexplore.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"iexplore.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"rasman\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"iexplore.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_CONFIG\" (0X1) access rights\n \"iexplore.exe\" called \"OpenService\" to access the \"WSearch\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"General","name":"Sent a control code to a service","description":"\"iexplore.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"WSearch\"\n \"iexplore.exe\" called \"ControlService\" and sent control code \"0XDC\" to the service \"WSearch\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 660)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":7,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00014351-00003200-52574-3115-004ABE80\n GetKeyboardState@USER32.DLL at 00014351-00003200-52574-3122-004B02D0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n VirtualAlloc\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2a","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY Unsupported/Fake Windows NT Version 5.0\" (SID: 2016879, Rev: 4, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"4/63 reputation engines marked \"http://musiknova.siteseguro.ws\" as malicious (6% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/60 Antivirus vendors marked sample as malicious (81% detection rate)\n 20/40 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/60 Antivirus vendors marked sample as malicious (81% detection rate)\n 20/40 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 660)\n \"\" wrote 52 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 660)\n \"\" wrote 4 bytes to a remote process \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\" (Handle: 660)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2b","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Accesses potentially sensitive information from local browsers"}],"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation date"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":24,"imported_dlls_count":93,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":59,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59a3e2d97ca3e134b02c03b4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"TrojanSpy.Banker","contacted_countries":["BRA"],"submit_name":"f0f09c0c29c0c16e7d7ce831c0472f5a.zip","analysis_start_time":"2017-08-28T10:30:16+00:00","indicators_count":{"informative":22,"suspicious":21,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"186.202.157.79","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}],"dns_resolutions":[{"domain":"musiknova.siteseguro.ws","address":"186.202.157.79","country":"Brazil","registrar_name":"GoDaddy.com","registrar_organization":"Domains By Proxy, LLC","registrar_name_servers":"ns1.locaweb.com.br","registrar_creation_date":"2005-03-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}],"http_requests":[{"host":"musiknova.siteseguro.ws","host_ip":"186.202.157.79:80","url":"/SubLoad.dll","method":"GET","response_code":"404","response_phrase":"Not Found","header":"GET /SubLoad.dll HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0\nHost: musiknova.siteseguro.ws","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}],"processes":[{"pid":3200,"ppid":0,"name":"f0f09c0c29c0c16e7d7ce831c0472f5a.exe","command_line":"","sha256":"660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a","normalized_path":"C:\\f0f09c0c29c0c16e7d7ce831c0472f5a.exe","uid":"00014351-00003200","icon":"$2c"},{"pid":2916,"ppid":3200,"name":"iexplore.exe","command_line":"-nohome","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00014351-00003200","uid":"00016016-00002916","icon":"$2d"},{"pid":2876,"ppid":2916,"name":"iexplore.exe","command_line":"SCODEF:2916 CREDAT:79873","sha256":"e285feeca968b3ca22017a64363eea5e69ccd519696671df523291b089597875","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00016016-00002916","uid":"00016050-00002876","icon":"$2e"}],"all_imported_dlls":["msxml3.dll","WSHTCPIP.DLL","ieproxy.dll","propsys.dll","uxtheme.dll","scrrun.dll","IEShims.dll","user32.dll","psapi.dll","wininet.dll","devobj.dll","mlang.dll","rpcss.dll","nlaapi.dll","dhcpcsvc6.dll","ole32.dll","msvcrt.dll","oleaccrc.dll","setupapi.dll","comdlg32.dll","SensApi.dll","netprofm.dll","dhcpcsvc.dll","ieframe.dll","sspicli.dll","linkinfo.dll","KernelBase.dll","mpr.dll","shlwapi.dll","iertutil.dll","msado15.dll","mswsock.dll","wship6.dll","IPHLPAPI.DLL","clbcatq.dll","sechost.dll","msimg32.dll","crypt32.dll","ntmarta.dll","msxml3r.dll","msdart.dll","winhttp.dll","ntdll.dll","rpcrt4.dll","msasn1.dll","NapiNSP.dll","pnrpnsp.dll","ieui.dll","xmllite.dll","dui70.dll","advapi32.dll","sxs.dll","webio.dll","rsaenh.dll","sqmapi.dll","rasapi32.dll","userenv.dll","version.dll","ws2_32.dll","credssp.dll","ExplorerFrame.dll","shell32.dll","gdi32.dll","apphelp.dll","nsi.dll","winnsi.dll","normaliz.dll","rasman.dll","winrnr.dll","url.dll","cryptbase.dll","cfgmgr32.dll","cryptsp.dll","dnsapi.dll","npmproxy.dll","lpk.dll","imm32.dll","oleacc.dll","urlmon.dll","profapi.dll","RpcRtRemote.dll","duser.dll","kernel32.dll","oleaut32.dll","comctl32.dll","msctf.dll","wshqos.dll","usp10.dll","Wldap32.dll","rasadhlp.dll","FWPUCLNT.DLL","rtutils.dll","dwmapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"RecoveryStore.{BAD7AC93-8C16-11E7-989D-0A00278A626A}.dat","sha256":"4e5ed35e1b77fedffa7263038805d214e2141cda4ea424f1ddee34ab1604e603","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"{BAD7AC94-8C16-11E7-989D-0A00278A626A}.dat","sha256":"f4f3b27ee4c47435ba5e1645ff38a5e11edc32c17921256727fec37eec92776d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"frameiconcache.dat","sha256":"e279d96e3d217fbbec9e9210cce8d36215486b9c865d296703228f9ba903c64b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}],"files_written":[{"path":"C:\\f0f09c0c29c0c16e7d7ce831c0472f5a.exe","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\zxLVHZxE","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en-US\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"C:\\Users\\Mp3Fm93","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBttnIE.dll","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\ONBTTN~1.DLL","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\en-US\\IEFRAME.dll.mui","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Suggested Sites.url:favicon","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\Web Slice Gallery.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\4shared.com.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%TEMP%\\~DFD3D034E423031A9B.TMP","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{BAD7AC94-8C16-11E7-989D-0A00278A626A}.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\5pk.com.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\7k7k.com.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\17kuxun.com.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\27.cn.url","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%WINDIR%\\system32\\url.dll","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\frameiconcache.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%TEMP%\\~DFFF242F81CD36F2DF.TMP","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{BAD7AC93-8C16-11E7-989D-0A00278A626A}.dat","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\28082017","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Local\\c:!users!mp3fm93!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Local\\c:!users!mp3fm93!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Local\\c:!users!mp3fm93!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"28082017","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"Local\\c:!users!mp3fm93!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!mp3fm93!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!mp3fm93!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!mp3fm93!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!mp3fm93!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\ConnHashTable<2916>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59a3e2d97ca3e134b02c03b4"}]}]}},"report_ids":{"sandbox_job_ids":["59a3e2d97ca3e134b02c03b4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 660f3c7e7a4f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 660f3c7e7a4f…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 660f3c7e7a4f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 660f3c7e7a4f…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/660f3c7e7a4f263ad898a5fc97dae74ce56e177eafa56cc1069f544e486cde7a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 660f3c7e7a4f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 660f3c7e7a4f…. Malware family: Trojan.Generic. Threat score 100/100. 20/26 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]