24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.Dropper Sample 6aa08b6fdb70… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6aa08b6fdb70…. Malware family: IL:Trojan.Dropper. Threat score 100/100. 13/28 AV engines flagged this file. 8 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11","keywords":["Malicious","IL:Trojan.Dropper","malware analysis","sandbox report","threat intelligence","6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11"],"about":{"@type":"SoftwareApplication","name":"6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.Dropper","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T98c,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00004756.00000000.264204.23981000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004756.00000000.264204.23981000.00000040.mdmp")26:T802,file/memory contains long string with (Indicator: "SHA384"; File: "libffi-8.dll") file/memory contains long string with (Indicator: "HMAC"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA384"; File: "_hashlib.pyd") file/memory contains long string with (Indicator: "SHA512"; File: "_hashlib.pyd") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00005980-00000BC0-3090129437") Found reference to "HMAC_Final" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_CTX_new" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_CTX_free" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_size" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "SHA512_Transform" (Indicator: "SHA512"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_Update" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "SHA384_Init" (Indicator: "SHA384"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_Init_ex" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "SHA512_Init" (Indicator: "SHA512"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "PKCS5_PBKDF2_HMAC" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_CTX_get_md" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to "HMAC_CTX_copy" (Indicator: "HMAC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin")27:T67b,"

to" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://www.npmjs.com/email-edit" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://www.npmjs.com/email-edit

you" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://registry.npmjs.org/" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://registry.npmjs.org/" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://registry.mycorp.com" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://github.com/npm/cli/edit/latest/docs/content/commands/npm-login.md" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://github.com/npm/cli/edit/latest/docs/content/commands/npm-stop.md" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/getweakrefcountgetweakrefsproxycallableproxytype" - Source: "00000000-00007012.00000001.265653.3435B000.00000004.mdmp") Found URL "https://ajax.googleapis.com/ajax/libs/angularjs/1.3.0-rc.3/angular.min.js" - Source: "00000000-00007012.00000001.265653.343A5000.00000004.mdmp") Found URL "http://barry.wooz.orgmime-version:" - Source: "00000000-00007012.00000001.265653.343BA000.00000004.mdmp") Found URL "http://barry.wooz.orgp534ameters=configdi" - Source: "00000000-00007012.00000001.265653.343BA000.00000004.mdmp") Found URL "https://ajax.googleapis.com/ajax/libs/angularjs/1.3.0-rc.3/angular.min.js" - Source: "00000000-00007012.00000001.265653.343BA000.00000004.mdmp") Found URL "https://sourceforge.net/projects/adodbapi>features:*" - Source: "00000000-00007012.00000001.265653.34407000.00000004.mdmp") Found URL "https://sourceforge.net/projects/adodbapi/" - Source: "00000000-00007012.00000001.265653.34407000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/tree/main/adodbapi." - Source: "00000000-00007012.00000001.265653.34407000.00000004.mdmp") Found URL "https://opensource.org/license/lgpl-2-1documentation-------------look" - Source: "00000000-00007012.00000001.265653.34407000.00000004.mdmp") Found URL "https://wiki.python.org/moin/databaseprogramming" - Source: "00000000-00007012.00000001.265653.34407000.00000004.mdmp") Found URL "https://github.com/mhammond/pywin32/issuesph" - Source: "00000000-00007012.00000001.265653.34407000.00000004.mdmp") Found URL "http://www.zzz.org/mailman/listinfo/pppor," - Source: "00000000-00007012.00000001.265653.34438000.00000004.mdmp") Found URL "http://www.zzz.org/mailman/listinfo/ppp--192.168.1.2.889.32614.987812255.500.21814--end" - Source: "00000000-00007012.00000001.265653.34438000.00000004.mdmp") Found URL "https://peps.python.org/pep-0205/create" - Source: "00000000-00007012.00000001.265653.34460000.00000004.mdmp") Found URL "https://docs.python.org/3/howto/mro.html.ptj4" - Source: "00000000-00007012.00000001.265653.34460000.00000004.mdmp") Found URL "https://github.com/python/importlib_metadata/wiki/development-methodologyfor" - Source: "00000000-00007012.00000001.265653.34460000.00000004.mdmp") Found URL "https://jrsoftware.org/ishelp/index.php?topic=setupcmdlinekernel32.dllsoftware\microsoft\windows" - Source: "00000000-00007500.00000001.266084.00A21000.00000020.mdmp")54:T4cb,Found string "+ncalrpc:[OLE9051C2BA6477DEC79B097C9F92D0]" (Indicator: "ncalrpc"; Source: "00000000-00001728.00000001.266265.03810000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001728.00000001.266265.03810000.00000004.mdmp") Found string "+ncalrpc:[OLE0EA379875638F43449725F322B17]" (Indicator: "ncalrpc"; Source: "00000000-00001728.00000001.266265.03810000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00005988.00000000.263900.9A140000.00000004.mdmp") Found string "+ncalrpc:[OLEAD6E0788D411D6335465789A754B]" (Indicator: "ncalrpc"; Source: "00000000-00005988.00000000.263900.9A140000.00000004.mdmp") Found string "B+ncalrpc:[OLE936B0DAFC00D09F3D58BCE7E5DF8]" (Indicator: "ncalrpc"; Source: "00000000-00005988.00000000.263900.9A140000.00000004.mdmp") Found string "+ncalrpc:[OLE936B0DAFC00D09F3D58BCE7E5DF8]" (Indicator: "ncalrpc"; Source: "00000000-00005988.00000000.263900.9A140000.00000004.mdmp") Found string "+ncalrpc:[OLE2D1572BD66BBC48A313D56917E65]" (Indicator: "ncalrpc"; Source: "00000000-00005988.00000000.263900.9A140000.00000004.mdmp")55:T608,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetDC" (Indicator: "GetDC"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001728.00000000.264344.01606000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001728.00000000.264344.01606000.00000004.mdmp")56:T43a,Found registry query API: "RegSaveKeyW" in file "6aa08b6fdb70023bdd14805657a5d4e36b5733b8b4c372c95ce2ec17668a0f11.bin" Found registry query API: "RegOpenKeyExW" in "00000000-00001728.00000000.264344.057C0000.00000004.mdmp, 00000000-00001728.00000001.266265.057C0000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00001728.00000000.264344.057C0000.00000004.mdmp, 00000000-00001728.00000001.266265.057C0000.00000004.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00001728.00000000.264344.057C0000.00000004.mdmp, 00000000-00001728.00000001.266265.057C0000.00000004.mdmp" Found registry query API: "function RegGetValueNames(const RootKey: HKEY; const SubKeyName: String; var Names: TArrayOfString): Boolean;" in "00000000-00001728.00000000.264344.057C0000.00000004.mdmp, 00000000-00001728.00000001.266265.057C0000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004756.00000000.264204.23981000.00000040.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004756.00000000.264204.23981000.00000040.mdmp"57:T897," BoB / BobSoft\"\n \"is-RFBNVPQ7BI.tmp\" was detected as \"VC8 -> Microsoft Corporation\"\n \"is-SBUTWKSNWM.tmp\" was detected as \"Microsoft Visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a380806d5455bae100a5a96"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"