26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T553,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win32_VKGameCenter_A_potentially_unwanted_application Sample 6b0c2c90c33a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b0c2c90c33a…. Malware family: Win32_VKGameCenter_A_potentially_unwanted_application. Threat score 100/100. 5/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd","keywords":["Malicious","Win32_VKGameCenter_A_potentially_unwanted_application","malware analysis","sandbox report","threat intelligence","6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd"],"about":{"@type":"SoftwareApplication","name":"6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd","applicationCategory":["peexe","executable"],"identifier":"6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win32_VKGameCenter_A_potentially_unwanted_application","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tf22,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "ExitThread"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadDescription"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemFirmwareTable"; Source: "sample.bin"), Found reference to API (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateHardLinkW"; Source: "sample.bin"), Found reference to API (Indicator: "BaseFlushAppcompatCache"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalDriveStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount64"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "BitBlt"; Source: "sample.bin"), Found reference to API (Indicator: "GetProductInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessMemoryInfo"; Source: "sample.bin"), Found reference to API (Indicator: "CreateCompatibleDC"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceExW"; Source: "sample.bin"), Found reference to API (Indicator: "AddAuditAccessObjectAce"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "AddAce"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThreadToken"; Source: "sample.bin"), Found reference to API (Indicator: "AddAccessDeniedObjectAce"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadDescription"; Source: "sample.bin"), Found reference to API (Indicator: "QueryDosDeviceW"; Source: "sample.bin"), Found reference to API (Indicator: "AddAccessAllowedObjectAce"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeAcl"; Source: "sample.bin"), Found reference to API (Indicator: "GetLogicalProcessorInformationEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "ZwQueryInformationProcess"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "sample.bin"), Found reference to API (Indicator: "OpenClipboard"; Source: "sample.bin"), Found reference to API (Indicator: "SeTakeOwnershipPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "sample.bin")28:T59e,Found string "Enter the e-mail and password that you supplied at registration on the %s website" (Indicator: "password"; Source: "sample.bin"), Found string "Enter password consisting of at least 6 letters, numbers and/or special characters." (Indicator: "password"; Source: "sample.bin"), Found string "Your password" (Indicator: "password"; Source: "sample.bin"), Found string "Enter login and password. Login can be E-mail or phone number." (Indicator: "password"; Source: "sample.bin"), Found string "Enter your email (%s) and password" (Indicator: "password"; Source: "sample.bin"), Found string "Enter your email or the login and password supplied at registration on the %s website" (Indicator: "password"; Source: "sample.bin"), Found string "Invalid login/password" (Indicator: "password"; Source: "sample.bin"), Found string "Forgotten password?" (Indicator: "password"; Source: "sample.bin"), Found string "PKCS #12 import failed due to incorrect password." (Indicator: "password"; Source: "sample.bin"), Found string "That password is too weak. Choose a stronger password." (Indicator: "password"; Source: "sample.bin"), Found string "Repeat password" (Indicator: "password"; Source: "sample.bin"), Found string "Enter your mobile phone number with country code. You will use this to log in to your account. This will help you access your account if you ever forget your password." (Indicator: "password"; Source: "sample.bin")29:T513,Heuristic match: " mail.ru", Pattern match: "http://stat.dl.mail.ru/stat2.php?stand=0", Pattern match: "https://games.mail.ru/pc/eula/", Pattern match: "https://games.mail.ru/eula/", Pattern match: "https://www.microsoft.com/windows", Pattern match: "https://games.mail.ru/gamecenter/license/", Pattern match: "https://tools.ietf.org/html/rfc8446#appendix-d.3", Pattern match: "http://stat.dl.mail.ru/stat.php?stand=0", Pattern match: "http://www.paratype.comhttp://www.paratype.com/help/designers/this", Pattern match: "http://passport.kongzhong.com/rules.jsp", Pattern match: "http://scripts.sil.org/ofl_web", Heuristic match: "my.co", Pattern match: "http://support.microsoft.com/kb/254950/", Pattern match: "http://games.mail.ru/gamecenter/install_error/", Heuristic match: " my.com", Pattern match: "http://stat.gc.my.com/stat2.php?stand=1", Heuristic match: "gamecenter my.com", Pattern match: "https://crbug.com/boringssl/226", Pattern match: "http://stat.gc.my.com/stat.php?stand=1", Heuristic match: "post to games mail.ru", Pattern match: "games.mail.ru/js/bc.js", Heuristic match: "e-mail %s is already registered in my.com", Pattern match: "https://g.co/chrome/symantecpkicerts", Heuristic match: "phone number %s is already registered in my.com", Pattern match: "https://games.mail.ru/"2a:T6c5,Observed email domain:"http://stat.dl.mail.ru/stat2.php?stand=0" [Source: sample.bin], Observed email domain:" " [Source: sample.bin], Observed email domain:" " [Source: sample.bin], Observed email domain:"durch einen klick auf weiter akzeptiere ich die lizenzvereinbarung und die endnutzer-lizenzvereinbarung" [Source: sample.bin], Observed email domain:"http://stat.dl.mail.ru/stat.php?stand=0" [Source: sample.bin], Observed email domain:" " [Source: sample.bin], Observed email domain:"by clicking "continue", i accept the terms of the license agreement and the user agreement" [Source: sample.bin], Observed email domain:"http://games.mail.ru/gamecenter/install_error/?" [Source: sample.bin], Observed email domain:"//games.mail.ru/js/bc.js" [Source: sample.bin], Observed email domain:"by clicking continue, i accept the terms of the license agreement and end user license agreement" [Source: sample.bin], Observed email domain:"please note that the service in the selected region is provided by mail.ru llc. by clicking "continue", you accept the terms of the license agreement and end user license agreement." [Source: sample.bin], Observed email domain:"https://games.mail.ru/" [Source: sample.bin]2b:T4e0,Found reference to API "The socket is already connected." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "The IP address or port number is invalid (e.g., cannot connect to the IP address 0 or the port 0)." (Indicator: " connect "; Source: "sample.bin"), Found reference to API "Could not create a connection to the proxy server. An error occurred either in resolving its name, or in connecting a socket to it. Note that this does NOT include failures during the actual "CONNECT" method of an HTTP proxy." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Returned when attempting to bind an address that is already in use." (Indicator: " bind "; Source: "sample.bin"), Found reference to API "We've hit the max socket limit for the socket pool while preconnecting. We don't bother trying to preconnect more sockets." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "The socket is not connected." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "Proxy Auth Requested without a valid Client Socket Handle." (Indicator: " socket "; Source: "sample.bin"), Found reference to API "No socket buffer space is available." (Indicator: " socket "; Source: "sample.bin")2c:T4f1,file/memory contains long string with (Indicator: "private key"; Source: "sample.bin"), Found string "The SSL client certificate has no private key." (Indicator: "private key"; Source: "sample.bin"), file/memory contains long string with (Indicator: "public key"; Source: "sample.bin"), Found string "The certificate didn't match the built-in public key pins for the host name. The pins are set in net/http/transport_security_state.cc and require that one of a set of public keys exist on the path from the leaf to the root." (Indicator: "public key"; Source: "sample.bin"), Found string "SSL peer's public key is invalid." (Indicator: "public key"; Source: "sample.bin"), Found string "Failure to export private key." (Indicator: "private key"; Source: "sample.bin"), Found string "There were no common signature algorithms between our client certificate private key and the server's preferences." (Indicator: "private key"; Source: "sample.bin"), Found string "The permission to use the SSL client certificate's private key was denied." (Indicator: "private key"; Source: "sample.bin"), Found string "An attempt to import a client certificate failed, as the user's key database lacked a corresponding private key." (Indicator: "private key"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793136776287,"unified_at":"2026-10-27T21:32:56.287Z","metadata":{"hashes":{"sha256":"6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd","sha1":"f9681c50a0fbf05ae0f71f8c310e20317c1c307f","md5":"fac03f5bde33381a9c902ca83faa5197"},"file_info":{"file_name":"6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd","file_type":["peexe","executable"],"file_type_id":"exe","file_size":31961216,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793136739000,"last_seen":1793136741000,"last_multi_scan":1793136741000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":45},"sandbox_signatures":{"informative_count":68,"suspicious_count":6,"malicious_count":0,"total":74},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Win32_VKGameCenter_A_potentially_unwanted_application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/VKGameCenter.A potentially unwanted application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"PUP.Win32.Gen.oa!s1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 006e37ce1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win32_VKGameCenter_A_potentially_unwanted_application","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"suspicious","value":"Contains ability to scan the ARP cache"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match - PE executable embedded in .rsrc section"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains ability to enumerate multimedia device resources (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Golden Ticket","attack_id":"T1558.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1558/001","identifiers":[{"type":"suspicious","value":"Able to forge Kerberos ticket"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Uses cURL to communicate over HTTPS"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to transfer data using curl"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Firmware","attack_id":"T1592.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1592/003","identifiers":[{"type":"informative","value":"Able to gather system firmware table (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1132.001","id":"yara-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1560","id":"yara-137","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PE executable embedded in .rsrc section","description":"YARA signature for embedded PE executable in .rsrc section matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.009","id":"yara-26","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-542","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: sample.bin, \"\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" in Source: sample.bin, \"Software\\Borland\\Locales\" in Source: sample.bin, \"\\SOFTWARE\\Microsoft\\Cryptography\" in Source: sample.bin, \"Software\\Embarcadero\\Locales\" in Source: sample.bin, \"Removed: SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ \" in Source: sample.bin, \"Software\\Borland\\Delphi\\Locales\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\" in Source: sample.bin, \"Unable to delete: SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ \" in Source: sample.bin, \"\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\Run\" in Source: sample.bin, \"Software\\CodeGear\\Locales\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"gamecenter@mail.ru.exe\", Pattern match: \"gamecenter@mail.ru.ini\"","origin":"sample.bin","mitre_attack_id":"T1114","id":"string-63","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \" InShellExecute=\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecute failed. Trying to use CreateProcess...\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\"), Found reference to API \"ShellExecute failed\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"ShellExecute failed. Trying to use CreateProcess...\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcess failed. Trying to use CreateProcess...\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"Login with Twitter\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \" Twitter\" (Indicator: \"twitter\"; Source: \"sample.bin\"), Found string \"Mit Twitter anmelden\" (Indicator: \"twitter\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \" GetLastError=\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT UUID FROM Win32_ComputerSystemProduct\" (Source: sample.bin, Indicator: \"select uuid from win32_computersystemproduct\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess failed. PID=\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"WinSecure: AdjustTokenPrivileges:\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"sample.bin\"), Found reference to API \"CreateWellKnownSid\" (Indicator: \"CreateWellKnownSid\"; Source: \"sample.bin\"), Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"AddAuditAccessObjectAce\" (Indicator: \"AddAuditAccessObjectAce\"; Source: \"sample.bin\"), Found reference to API \"AddAce\" (Indicator: \"AddAce\"; Source: \"sample.bin\"), Found reference to API \"AddAccessDeniedObjectAce\" (Indicator: \"AddAccessDeniedObjectAce\"; Source: \"sample.bin\"), Found reference to API \"AddAccessAllowedObjectAce\" (Indicator: \"AddAccessAllowedObjectAce\"; Source: \"sample.bin\"), Found reference to API \"InitializeAcl\" (Indicator: \"InitializeAcl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeTakeOwnershipPrivilege\" (Indicator: \"SeTakeOwnershipPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$28","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"SPDY server didn't respond to the PING message.\" (Indicator: \"ping\"; Source: \"sample.bin\"), Found string \"Route to server test\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"fe Route zum Server\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"Route to game server test\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"fe Route zum Spielserver\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"The IP address is unreachable. This usually means that there is no route to\nthe specified host or network.\" (Indicator: \"route\"; Source: \"sample.bin\"), Found string \"Resolving a hostname to an IP address list included the IPv4 address\n\"127.0.53.53\". This is a special IP address which ICANN has recommended to\nindicate there was a name collision, and alert admins to a potential\nproblem.\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"BitBlt error\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \" CreateCompatibleDC fails\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; Source: \"sample.bin\"), Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; Source: \"sample.bin\"), Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate multimedia device resources (API string)","description":"Found reference to API \"IMMDeviceEnumerator::GetDefaultAudioEndpoint not found\" (Indicator: \"IMMDeviceEnumerator\"; Source: \"sample.bin\"), Found reference to API \"Unable to IMMDeviceEnumerator::EnumAudioEndpoints\" (Indicator: \"IMMDeviceEnumerator\"; Source: \"sample.bin\"), Found reference to API \"Unable to IMMDeviceEnumerator::GetDefaultAudioEndpoint\" (Indicator: \"IMMDeviceEnumerator\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1546.015","id":"string-303","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"(GSSAPI) No Kerberos credentials were available during HTTP Authentication.\" (Indicator: \"kerberos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558","id":"string-868","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-730","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"data:text/html;base64,\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"The SSL server attempted to use a weak ephemeral Diffie-Hellman key.\" (Indicator: \"diffie-hellman\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\"), Found string \"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" Win32_ComputerSystemProduct\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-227","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"ZwQueryInformationProcess\" (Indicator: \"QueryInformationProcess\"; Source: \"sample.bin\"), Found reference to API \"EnumProcessModules\" (Indicator: \"EnumProcessModules\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Able to forge Kerberos ticket","description":"Found string \"The request was blocked by the URL blacklist configured by the domain\nadministrator.\" (Indicator: \"klist config\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558.001","id":"string-755","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1115","id":"string-188","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"Found string \"LIBCURL.DLL.SIG\" (Indicator: \"libcurl\"; Source: \"sample.bin\"), Found string \"LIBCURL.DLL\" (Indicator: \"libcurl\"; Source: \"sample.bin\"), Found string \"libcurl.dll\" (Indicator: \"libcurl\"; Source: \"sample.bin\"), Found string \"libcurl.dll.sig\" (Indicator: \"libcurl\"; Source: \"sample.bin\"), Found string \"curl_easy_setopt \" (Indicator: \"curl_easy_setopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-722","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"Unable to ConnectNamedPipe\" (Indicator: \"ConnectNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"CreateNamedPipe OK \" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"Unable to CreateNamedPipe \" (Indicator: \"CreateNamedPipe\"; Source: \"sample.bin\"), Found reference to API \"Unable to ConnectNamedPipe SetEvent\" (Indicator: \"ConnectNamedPipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://games.mail.ru\", Found HTTPS url \"https://www.microsoft.com\", Found HTTPS url \"https://tools.ietf.org\", Found HTTPS url \"https://crbug.com\", Found HTTPS url \"https://g.co\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to scan the ARP cache","description":"Found string \"ARP Job\" (Indicator: \"arp \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-363","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"Failed to set the socket's receive buffer size as requested, despite success\nreturn code from setsockopt.\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"Failed to set the socket's send buffer size as requested, despite success\nreturn code from setsockopt.\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1571","id":"string-419","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"Failed to set the socket's receive buffer size as requested, despite success\nreturn code from setsockopt.\" (Indicator: \"setsockopt\"; Source: \"sample.bin\"), Found reference to API \"Failed to set the socket's send buffer size as requested, despite success\nreturn code from setsockopt.\" (Indicator: \"setsockopt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1205.002","id":"string-879","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"CURL not initialized\" (Indicator: \"curl \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-576","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"127.0.53.53\" found in string \"Resolving a hostname to an IP address list included the IPv4 address\n\"127.0.53.53\". This is a special IP address which ICANN has recommended to\nindicate there was a name collision, and alert admins to a potential\nproblem.\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"Removed: SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ \" (Indicator: \"software\\microsoft\\windows nt\\currentversion\\image file execution options\"; in Source: \"sample.bin\"), Found string \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\\" (Indicator: \"software\\microsoft\\windows nt\\currentversion\\image file execution options\"; in Source: \"sample.bin\"), Found string \"Unable to delete: SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\ \" (Indicator: \"software\\microsoft\\windows nt\\currentversion\\image file execution options\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"Inj:Unable to CreateRemoteThread:\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\"), Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"Inj:Unable to CreateRemoteThread:\" (Indicator: \"CreateRemoteThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-79","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"Inj:Unable to WriteProcessMemory:\" (Indicator: \"WriteProcessMemory\"; Source: \"sample.bin\"), Found reference to API \"Inj:Unable to VirtualAllocEx:\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"Inj:Unable to VirtualAllocEx:\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"Inj:Unable to VirtualAllocEx:\" (Indicator: \"VirtualAllocEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system firmware table (API string)","description":"file/memory contains long string(Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1592.003","id":"string-902","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"GetSystemFirmwareTable\" (Indicator: \"GetSystemFirmwareTable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.001","id":"string-659","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\"), Found reference to API \"Inj:IsWow64Process:\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set up shortcut on desktop\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set Settings\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set url=\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\"), Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW failed\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW failed\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-324","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT UUID FROM Win32_ComputerSystemProduct\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"DbgHelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"CheckRemoteDebuggerPresent PID=\" (Indicator: \"CheckRemoteDebuggerPresent\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-30","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win32_VKGameCenter_A_potentially_unwanted_application Sample 6b0c2c90c33a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6b0c2c90c33a…. Malware family: Win32_VKGameCenter_A_potentially_unwanted_application. Threat score 100/100. 5/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd"}],["$","meta","4",{"property":"og:title","content":"Malicious Win32_VKGameCenter_A_potentially_unwanted_application Sample 6b0c2c90c33a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6b0c2c90c33a…. Malware family: Win32_VKGameCenter_A_potentially_unwanted_application. Threat score 100/100. 5/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6b0c2c90c33acc8ba31a13b31bdac70c9ecc4201e7ee57e9748ae620356a83bd"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win32_VKGameCenter_A_potentially_unwanted_application Sample 6b0c2c90c33a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6b0c2c90c33a…. Malware family: Win32_VKGameCenter_A_potentially_unwanted_application. Threat score 100/100. 5/27 AV engines flagged this file. 0 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]