26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious AIT:Trojan.Nymeria Sample 67dd67f799c7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 67dd67f799c7…. Malware family: AIT:Trojan.Nymeria. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8","keywords":["Malicious","AIT:Trojan.Nymeria","malware analysis","sandbox report","threat intelligence","67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8"],"about":{"@type":"SoftwareApplication","name":"payload-Ostateczne_Przedsadowe_Wezwanie_do_Zaplaty.scr.dat","applicationCategory":["peexe","executable"],"identifier":"67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"AIT:Trojan.Nymeria","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T42e,Found API call GetLocalTime@KERNEL32.DLL (Target: "67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe", Stream UID: "00020663-00002672-47315-949-013186AE") which is directly followed by "cmp word ptr [esi], 0000h" and "je 01318826h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 0Ch +6 push esi +7 push edi +8 mov edi, edx +10 push edi +11 mov esi, ecx +13 call dword ptr [0135D23Ch] ;GetLocalTime +19 cmp word ptr [esi], 0000h +23 je 01318826h" ... at 00020663-00002672-47315-949-013186AE Found API call GetLocalTime@KERNEL32.DLL (Target: "67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe", Stream UID: "00020663-00002672-42836-949-013186AE") which is directly followed by "cmp word ptr [esi], 0000h" and "je 01318826h". See related instructions: "... +0 push ebp +1 mov ebp, esp +3 sub esp, 0Ch +6 push esi +7 push edi +8 mov edi, edx +10 push edi +11 mov esi, ecx +13 call dword ptr [0135D23Ch] ;GetLocalTime +19 cmp word ptr [esi], 0000h +23 je 01318826h" ... at 00020663-00002672-42836-949-013186AE28:T5ad,recv (Ordinal #16) send (Ordinal #19) recvfrom (Ordinal #17) WSAStartup (Ordinal #115) accept (Ordinal #1) listen (Ordinal #13) bind (Ordinal #2) closesocket (Ordinal #3) connect (Ordinal #4) sendto (Ordinal #20) socket (Ordinal #23) InternetReadFile InternetCloseHandle InternetOpenW InternetCrackUrlW HttpQueryInfoW InternetQueryOptionW HttpSendRequestW FtpOpenFileW FtpGetFileSize InternetOpenUrlW InternetConnectW InternetQueryDataAvailable IcmpSendEcho Sleep GetVersionExW LoadLibraryA GetProcAddress GetModuleHandleW OpenProcess VirtualAllocEx WriteProcessMemory ReadProcessMemory CreateFileW WriteFile TerminateProcess CreateToolhelp32Snapshot Process32FirstW Process32NextW GetFileAttributesW FindFirstFileW DeleteFileW CopyFileW CreateDirectoryW FindResourceW LockResource OutputDebugStringW GetTempPathW GetTempFileNameW DeviceIoControl CreateThread LoadLibraryExW FindResourceExW GetDriveTypeW GetFileSize GetComputerNameW CreateProcessW LoadLibraryW VirtualAlloc GetModuleFileNameW IsDebuggerPresent GetModuleHandleExW ExitThread GetCommandLineW UnhandledExceptionFilter GetStartupInfoW FindNextFileW FindWindowExW SetKeyboardState GetWindowThreadProcessId FindWindowW RegDeleteValueW RegDeleteKeyW RegEnumKeyExW RegCreateKeyExW GetUserNameW RegOpenKeyExW RegCloseKey OpenProcessToken CreateProcessAsUserW CreateProcessWithLogonW ShellExecuteExW ShellExecuteW29:T604,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQYSURBVFhH7VdLV1NXGPWHdU6tWivyUPAZ0Ra7Fi6LUKCAEPK+AYwBLBIM4RECISC1tZXaqS3EDhy1IzujEyDJzX3lgbvfuTePC9w0Qbtg0qy110lOkvvtb3+vc06c+P913Ao43R70WxxHCouNA/mtwe7k8OfbTbz54y/C2/8UX3R61OftX5nDBQIO1xB+XY9+ENY3XmMj+js2XmtYp/e/0R6D0bP3EGByJEUZ6ZSClCK/B7T/KQbY/zxmQ0pl1HAXFLDYXOrmUeIAgUw2qxJYW3uFl7+8qQhrP79CNpNWEY1GDZFX4KPbU2Bgnw0VyOYIMOM1PUuo7Q2jrm8R9eYFXLCGcNEeQiMXROPgHC57ZnDFO62S/HtzEylZLBu2QxG47liFyfUUJm4FTUPLuOmJ4JZ3CZ+PLaJ5fAG3fSF86Z/XERA+TAEWj12dAi3eH9Ay+j3uPHqGu48JvlW0+p/iXmAFbbPLaA9G0LEQLhBIy0IuCSVtlbVVD6ZA1cCocQgYAUHSYsNk7Zh8gS7/T+gK/Iju2ef4iozf8YfRPBnEjQk/TL5JNE35igQksawCzPi5R1xpArwgFQiYgy9xf+4FmkZCOOuYwMe2EXzieojTgx6ceTCMs95BnBvjdARyCpDnaimydZ8KzHjjXF9lBFqffIfT1nFUWUZx0uHFKY6MDz3Apw+H8NmoW/Xk/GOnjkCyrALMePPzltIEkjoFqsxjmtdOMl7wmoyPuVH9rQvnJxyofWLbkwOKokCmUJRqZMz4vxMQiyE4ac9Jzrz2kOQjJDl5XT3uRI3Pjjq/FRcCA8UqkMpXQQUEikl4iqbjmWGd5Mxrkrx20o76KQsuTpvRQJIW+oAoHKqNH2hErArYLMhXgT7RqsddqCHJ60jy+gAZn+mnZLqPy6GeQ/UBfWjKEtAnWm1e8ukBNMz24VKwF1cWunEt3LmHQCpXAZUMs7IE9ImmSj5j1rye78HVxW9wbakTpuX2AgGZcoAloFEDYnsSfcfzPOLxOBLx2MFZsD8E+kRrmO0nr5nk3bga7sL1SAdurLSjafVegYAilS5DRabQEsFEIo5YLIZ4bKcEAV0n1CfapXkmOXlNkpsiX5PxNtxcbcWtZ3d1BHhD7/NtWaQkZZ5vb29jZ2fbmIAoaQeF6ZnlikYxq4CpQESdhjIZKDWORUFAkk+Q4R2NAMEwBxJJrQrYbGcPPQzEZFEBFnOWD4KQBE/7LO7M662tLRUlCcR4GexMgN0U0ooAIA1kaS8lIkPArkJ77wi7BPod+x4pvMtoSZbv/7IkQSBFkmScJ8/jFHsW/zyYGoYKMALHeCTj0Ntvfe97wQCdKW1ON5zuYdhdw7DaOZjL3DNa2zqLh9LC6TR/UTj6NXdDOXrDeRWO+3J4zPb/AaAaFo3YT2OaAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790435677862,"unified_at":"2026-09-26T15:14:37.862Z","metadata":{"hashes":{"sha256":"67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8","sha1":"bf427fe3605560b471013dde5382a486d82e77c0","md5":"6c6c970d3433ce8d3adba7266af657d2","sha512":"5d2e4d05ff328657923ed0cda3ab1d149cf0d405659ae9526e44d45d1fd4cd909ca85ee6f5336f19cec0b0955df1f50bfbbc9bfcf7d668efef26400471858eb2","ssdeep":"24576:94lavt0LkLL9IMixoEgeadQvY+8juJPmN7kB91tyMLI11NjhoyAWq9MmCS:Ukwkn9IMHeadpjq5LtyMLI1CyraPCS","ssdeep_chunks":["24576:94lavt0","24576:4lavt0L","24576:lavt0Lk","24576:avt0LkL","24576:vt0LkLL","24576:t0LkLL9","24576:0LkLL9I","24576:LkLL9IM","24576:kLL9IMi","24576:LL9IMix","24576:L9IMixo","24576:9IMixoE","24576:IMixoEg","24576:MixoEge","24576:ixoEgea","24576:xoEgead","24576:oEgeadQ","24576:EgeadQv","24576:geadQvY","24576:eadQvY+","24576:adQvY+8","24576:dQvY+8j","24576:QvY+8ju","24576:vY+8juJ","24576:Y+8juJP","24576:+8juJPm","24576:8juJPmN","24576:juJPmN7","24576:uJPmN7k","24576:JPmN7kB","24576:PmN7kB9","24576:mN7kB91","24576:N7kB91t","24576:7kB91ty","24576:kB91tyM","24576:B91tyML","24576:91tyMLI","24576:1tyMLI1","24576:tyMLI11","24576:yMLI11N","24576:MLI11Nj","24576:LI11Njh","24576:I11Njho","24576:11Njhoy","24576:1NjhoyA","24576:NjhoyAW","24576:jhoyAWq","24576:hoyAWq9","24576:oyAWq9M","24576:yAWq9Mm","24576:AWq9MmC","24576:Wq9MmCS","49152:94lavt0","49152:4lavt0L","49152:lavt0Lk","49152:avt0LkL","49152:vt0LkLL","49152:t0LkLL9","49152:0LkLL9I","49152:LkLL9IM","49152:kLL9IMi","49152:LL9IMix","49152:L9IMixo","49152:9IMixoE","49152:IMixoEg","49152:MixoEge","49152:ixoEgea","49152:xoEgead","49152:oEgeadQ","49152:EgeadQv","49152:geadQvY","49152:eadQvY+","49152:adQvY+8","49152:dQvY+8j","49152:QvY+8ju","49152:vY+8juJ","49152:Y+8juJP","49152:+8juJPm","49152:8juJPmN","49152:juJPmN7","49152:uJPmN7k","49152:JPmN7kB","49152:PmN7kB9","49152:mN7kB91","49152:N7kB91t","49152:7kB91ty","49152:kB91tyM","49152:B91tyML","49152:91tyMLI","49152:1tyMLI1","49152:tyMLI11","49152:yMLI11N","49152:MLI11Nj","49152:LI11Njh","49152:I11Njho","49152:11Njhoy","49152:1NjhoyA","49152:NjhoyAW","49152:jhoyAWq","49152:hoyAWq9","49152:oyAWq9M","49152:yAWq9Mm","49152:AWq9MmC","49152:Wq9MmCS","24576:Ukwkn9I","24576:kwkn9IM","24576:wkn9IMH","24576:kn9IMHe","24576:n9IMHea","24576:9IMHead","24576:IMHeadp","24576:MHeadpj","24576:Headpjq","24576:eadpjq5","24576:adpjq5L","24576:dpjq5Lt","24576:pjq5Lty","24576:jq5LtyM","24576:q5LtyML","24576:5LtyMLI","24576:LtyMLI1","24576:tyMLI1C","24576:yMLI1Cy","24576:MLI1Cyr","24576:LI1Cyra","24576:I1CyraP","24576:1CyraPC","24576:CyraPCS"],"imphash":"3af2a6ca5114d6c368eeaaacc55ab46d"},"file_info":{"file_name":"payload-Ostateczne_Przedsadowe_Wezwanie_do_Zaplaty.scr.dat","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1619968,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297330000,"last_seen":1678498039000,"last_multi_scan":1678498039000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":21,"malicious_count":8,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Gen.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1245861","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.465","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"AIT:Trojan.Nymeria.465 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.UUM trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0055e3991 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Fsysna.ckjv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericR-ESN!6C6C970D3433","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Autoit.diqsub","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Autoit.GA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Autoit.Paket","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.AutoItGen.Win32.60","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"AIT:Trojan.Nymeria","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00020663-00002672-47315-488-012F40DA\n GetLocalTime@KERNEL32.DLL at 00020663-00002672-47315-421-012EE08F\n GetLocalTime@KERNEL32.DLL at 00020663-00002672-47315-949-013186AE\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020663-00002672-47315-894-01303B93\n GetLocalTime@KERNEL32.DLL at 00020663-00002672-42836-421-012EE08F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020663-00002672-42836-488-012F40DA\n GetLocalTime@KERNEL32.DLL at 00020663-00002672-42836-949-013186AE\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00020663-00002672-42836-894-01303B93","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mivrosof.mooo.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"RegisterHotKey@USER32.DLL at 00020663-00002672-47315-1190-012ECC12\n UnregisterHotKey@USER32.DLL at 00020663-00002672-47315-1058-012D45A7\n UnregisterHotKey@USER32.DLL at 00020663-00002672-42836-1058-012D45A7\n RegisterHotKey@USER32.DLL at 00020663-00002672-42836-1190-012ECC12","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\autC9A.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\td132ccwa2.gec\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00020663-00002672-47315-421-012EE08F\n GetUserNameW@ADVAPI32.DLL at 00020663-00002672-42836-421-012EE08F","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"td132ccwa2.gec\" has type \"data\"\n \"autC9A.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00020663-00002672-47315-16-012F8E3C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020663-00002672-47315-1296-012F8E19\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020663-00002672-42836-16-012F8E3C\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00020663-00002672-42836-1296-012F8E19","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.96745244182","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00020663-00002672-47315-1203-012EE47B\n GetVersionExW@KERNEL32.DLL at 00020663-00002672-42836-1203-012EE47B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Makes a branch decision directly after calling an API that is environment aware","description":"$27","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1372-0130B78E\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1370-0130B8E7\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-892-012FA937\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-767-01307CF0\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1373-0130B7EF\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1368-0130B94E\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1366-0130B398\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1367-0130B850\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1371-0130B593\n GetProcessHeap@KERNEL32.DLL at 00020663-00002672-47315-1369-0130B982","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00020663-00002672-47315-812-012D31F2\n LockResource@KERNEL32.DLL at 00020663-00002672-42836-812-012D31F2","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Windows\\system32\\WerFault.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"67DD67F799C7C34B18ED0CC0B1C5C1DE29E5551E86D6A64F46F93E244103A2C8.EXE\", Value: \"C:\\67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"Found potential URL in binary/memory","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00020663-00002672-47315-228-01316F5B\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00020663-00002672-42836-228-01316F5B","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00020663-00002672-47315-1597-01314342\n GetAsyncKeyState@USER32.DLL at 00020663-00002672-47315-1578-01313569\n GetKeyboardState@USER32.DLL at 00020663-00002672-47315-1580-0131388D\n GetKeyboardState@USER32.DLL at 00020663-00002672-47315-1593-013145F9\n GetKeyboardState@USER32.DLL at 00020663-00002672-47315-1581-01314497\n GetKeyboardState@USER32.DLL at 00020663-00002672-47315-1599-013147DE\n GetKeyboardState@USER32.DLL at 00020663-00002672-42836-1581-01314497\n GetAsyncKeyState@USER32.DLL at 00020663-00002672-42836-1578-01313569\n GetKeyboardState@USER32.DLL at 00020663-00002672-42836-1599-013147DE\n GetKeyboardState@USER32.DLL at 00020663-00002672-42836-1597-01314342","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\autC9A.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\autC9A.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$28","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"40539f775858a077186aa077653ca1770000000000bfb5770000000056ccb577000000007ccab577000000003768b9756a2ca177d62da177000000002069b9750000000029a6b57700000000a48db97500000000f70eb57700000000\" to virtual address \"0x76971000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Possibly tries to hide a process launching it with different user credentials","description":"CreateProcessAsUserW@ADVAPI32.DLL at 00020663-00002672-47315-1379-0130B9F1\n CreateProcessWithLogonW@ADVAPI32.DLL at 00020663-00002672-47315-1384-0130BC90\n CreateProcessAsUserW@ADVAPI32.DLL at 00020663-00002672-42836-1379-0130B9F1\n CreateProcessWithLogonW@ADVAPI32.DLL at 00020663-00002672-42836-1384-0130BC90","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-42","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/56 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"C:\\Windows\\System32\\WerFault.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"YahLover_Worm\" matched file \"67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe.bin\" as \"YahLover\" based on indicators: \"42004900540052004f0054004100540045000000420049005400530048004900460054000000000042004900540058004f0052\" (Author: Kevin Falcoz)\n YARA signature \"YahLover\" matched file \"67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe.bin\" as \"YahLover\" based on indicators: \"42004900540052004f0054004100540045000000420049005400530048004900460054000000000042004900540058004f0052\" (Author: Kevin Falcoz)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API MessageBoxW@USER32.DLL at 00488937-00002144-15905-45-00D746D0\n Found reference to API UnRegisterTypeLibForUser@OLEAUT32.DLL at 00488937-00002144-15905-1548-00D813A6\n Found reference to API RegisterTypeLibForUser@OLEAUT32.DLL at 00488937-00002144-15905-1534-00D8137B\n Found reference to API DllGetClassObject@OLEAUT32.DLL at 00488937-00002144-15905-1529-00D81050\n Found reference to API MessageBoxW@USER32.DLL at 00488937-00002144-11198-18-00D746D0\n Found reference to API DllGetClassObject@OLEAUT32.DLL at 00488937-00002144-11198-1527-00D81050\n Found reference to API UnRegisterTypeLibForUser@OLEAUT32.DLL at 00488937-00002144-11198-1546-00D813A6\n Found reference to API RegisterTypeLibForUser@OLEAUT32.DLL at 00488937-00002144-11198-1532-00D8137B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 00488937-00002144-15905-1709-00D8EA85\n GetDiskFreeSpaceW@KERNEL32.DLL at 00488937-00002144-15905-1711-00D8EC11\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00488937-00002144-15905-1710-00D8EB4B\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00488937-00002144-11198-1708-00D8EA85\n GetDiskFreeSpaceExW@KERNEL32.DLL at 00488937-00002144-11198-1709-00D8EB4B\n GetDiskFreeSpaceW@KERNEL32.DLL at 00488937-00002144-11198-1710-00D8EC11","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"95.140.125.27:1512\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"USER32.DLL\" at base 778C0000\n \"\" loaded module \"NTDLL\" at base 77CB0000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\APPHELP.DLL\" at base 75D00000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00488937-00002144-11198-1951-00D97294\n OpenClipboard@USER32.DLL at 00488937-00002144-11198-1948-00D97099","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00488937-00002144-15905-1629-00D870AE\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-15905-1691-00D8D950\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-15905-1628-00D8702F\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-15905-1630-00D8713C\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-11198-1628-00D8713C\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-11198-1690-00D8D950\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-11198-1627-00D870AE\n DeviceIoControl@KERNEL32.DLL at 00488937-00002144-11198-1626-00D8702F","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 52 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 4 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 1024 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 524288 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 88064 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 111104 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)\n \"\" wrote 19456 bytes to a foreign process \"WerFault.exe\" (PID: 00002376)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 95.140.125.27 on port 1512","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00488937-00002144-15905-1647-00D882D0\n ExitWindowsEx@USER32.DLL at 00488937-00002144-11198-1645-00D882D0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"name":"Spyware/Leak","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":80,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"561cc96b0e316d1b2cbf00e6","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Injector.Autoit","contacted_countries":["SRB"],"submit_name":"payload-Ostateczne_Przedsadowe_Wezwanie_do_Zaplaty.scr.dat","analysis_start_time":"2015-10-13T04:10:49+00:00","indicators_count":{"informative":7,"suspicious":26,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"561cc96b0e316d1b2cbf00e4","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Injector.Autoit","contacted_countries":["SRB"],"submit_name":"payload-Ostateczne_Przedsadowe_Wezwanie_do_Zaplaty.scr.dat","analysis_start_time":"2015-10-13T04:09:33+00:00","indicators_count":{"informative":10,"suspicious":26,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"95.140.125.27","port":1512,"protocol":"TCP","country":"Serbia","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}],"dns_resolutions":[{"domain":"mivrosof.mooo.com","address":"95.140.125.27","country":"Serbia","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}],"processes":[{"pid":2672,"ppid":0,"name":"67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe","command_line":"","normalized_path":"","uid":"00020663-00002672","icon":"$29"}],"all_imported_dlls":["imm32.dll","rpcrt4.dll","winnsi.dll","profapi.dll","uxtheme.dll","shell32.dll","cryptbase.dll","kernel32.dll","KernelBase.dll","comctl32.dll","urlmon.dll","apphelp.dll","ole32.dll","userenv.dll","msctf.dll","ntdll.dll","ws2_32.dll","version.dll","user32.dll","shlwapi.dll","sechost.dll","comdlg32.dll","msvcrt.dll","winmm.dll","gdi32.dll","usp10.dll","msasn1.dll","IPHLPAPI.DLL","cfgmgr32.dll","dwmapi.dll","iertutil.dll","nsi.dll","lpk.dll","advapi32.dll","crypt32.dll","setupapi.dll","devobj.dll","wsock32.dll","wininet.dll","oleaut32.dll","psapi.dll","mpr.dll","KERNELBASE.dll","WINMM.dll","WSOCK32.dll","CRYPTBASE.dll","COMCTL32.dll","SHLWAPI.dll","WININET.dll","VERSION.dll","MSCTF.dll","drprov.dll","ntlanman.dll","WS2_32.dll","USP10.dll","PSAPI.DLL","CFGMGR32.dll","wkscli.dll","UxTheme.dll","CRYPT32.dll","NSI.dll","GDI32.dll","SETUPAPI.dll","COMDLG32.dll","RPCRT4.dll","davclnt.dll","IMM32.DLL","DEVOBJ.dll","LPK.dll","USERENV.dll","SspiCli.dll","SHELL32.dll","USER32.dll","MPR.dll","ADVAPI32.dll","MSASN1.dll","WINNSI.DLL","cscapi.dll","netutils.dll","OLEAUT32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"autC9A.tmp","sha256":"4c94c4f1133ea84045ceda5e40a9123c982627f06ad2c9d9ffa244fc6a0ca625","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}]},{"name":"td132ccwa2.gec","sha256":"4c94c4f1133ea84045ceda5e40a9123c982627f06ad2c9d9ffa244fc6a0ca625","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"name":"aut876D.tmp","sha256":"4c94c4f1133ea84045ceda5e40a9123c982627f06ad2c9d9ffa244fc6a0ca625","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}]},{"path":"C:\\67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8.exe","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"}]},{"path":"%TEMP%\\td132ccwa2.gec","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"path":"%WINDIR%\\system32\\WerFault.exe","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e6"},{"report_type":"sandbox","report_id":"561cc96b0e316d1b2cbf00e4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["561cc96b0e316d1b2cbf00e6","561cc96b0e316d1b2cbf00e4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious AIT:Trojan.Nymeria Sample 67dd67f799c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 67dd67f799c7…. Malware family: AIT:Trojan.Nymeria. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8"}],["$","meta","4",{"property":"og:title","content":"Malicious AIT:Trojan.Nymeria Sample 67dd67f799c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 67dd67f799c7…. Malware family: AIT:Trojan.Nymeria. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/67dd67f799c7c34b18ed0cc0b1c5c1de29e5551e86d6a64f46f93e244103a2c8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious AIT:Trojan.Nymeria Sample 67dd67f799c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 67dd67f799c7…. Malware family: AIT:Trojan.Nymeria. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]