26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T449,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 6b1e0f494ff9… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 6b1e0f494ff9…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24","keywords":["malware analysis","sandbox report","threat intelligence","6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24"],"about":{"@type":"SoftwareApplication","name":"urlref_httpswww.libreoffice.orgdonatereferrer_download_versiondir_26.8.1_versionfile_26.8.1_versionline_stable_ab_os_win_cpu_x86-64","applicationCategory":["html"],"identifier":"6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":0},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T60f,Pattern match: "https://fr.libreoffice.org/faire-un-don/", Pattern match: "https://pt-br.libreoffice.org/fazer-uma-doa%c3%a7%c3%a3o/", Pattern match: "https://extensions.libreoffice.org/en-us", Pattern match: "https://zh-tw.libreoffice.org/%e6%8d%90%e6%ac%be/", Pattern match: "https://hy.libreoffice.org/%d5%b6%d5%be%d5%ab%d6%80%d5%a1%d5%a2%d5%a5%d6%80%d5%a5%d5%ac/", Pattern match: "https://www.libreoffice.org/donate/", Pattern match: "sl.libreoffice.org/donirajte/", Pattern match: "https://wiki.documentfoundation.org/odf", Pattern match: "https://kk.libreoffice.org/%d0%b4%d0%b5%d0%bc%d0%b5%d1%83%d1%88%d1%96%d0%bb%d1%96%d0%ba-%d0%b5%d1%82%d1%83/", Pattern match: "https://es.libreoffice.org/colabora/", Pattern match: "https://uk.libreoffice.org/%d0%bf%d0%be%d0%b6%d0%b5%d1%80%d1%82%d0%b2%d1%83%d0%b2%d0%b0%d1%82%d0%b8/", Pattern match: "https://www.paypal.com/cgi-bin/webscr", Pattern match: "https://www.paypal.com/en_us/i/btn/btn_donatecc_lg.gif", Pattern match: "w.documentfoundation.org/get-in-touch/", Pattern match: "https://cy.libreoffice.org/rhowch/", Pattern match: "https://wiki.documentfoundation.org/special:mylanguage/trademark_policy", Pattern match: "https://nl.libreoffice.org/doneer/", Pattern match: "https://eo.libreoffice.org/donaci/", Pattern match: "https://www.libreoffice.org/imprint/", Pattern match: "https://www.documentfoundation.org/professional-support/", Pattern match: "https://www.spi-inc.org/donations/", Pattern match: "https://fi.libreoffice.org/donate/", Pattern match: "https://be.libreoffice.org/donate/"28:T9bf,Found HTTPS url "https://fr.libreoffice.org", Found HTTPS url "https://fi.libreoffice.org", Found HTTPS url "https://pt", Found HTTPS url "https://extensions.libreoffice.org", Found HTTPS url "https://www.documentfoundatio", Found HTTPS url "https://zh", Found HTTPS url "https://fosstodon.org", Found HTTPS url "https://bsky.app", Found HTTPS url "https://www.reddit.com", Found HTTPS url "https://www.youtube.com", Found HTTPS url "https://www.facebook.com", Found HTTPS url "https://floss.fund", Found HTTPS url "https://ww", Found HTTPS url "https://hy.libreoffice.org", Found HTTPS url "https://www.libreoffice.org", Found HTTPS url "https://it.libreoffice.org", Found HTTPS url "https://nl.libreoffice.org", Found HTTPS url "https://da.libreoffice.org", Found HTTPS url "https://ia.libreoffice.org", Found HTTPS url "https://ca.libreoffice.org", Found HTTPS url "https://kab.libreoffice.org", Found HTTPS url "https://sk.libreoffice.org", Found HTTPS url "https://pl.libreoffice.org", Found HTTPS url "https://cs.libreoffice.org", Found HTTPS url "https://vi.libreoffice.org", Found HTTPS url "https://de.libreoffice.org", Found HTTPS url "https://ga.libreoffice.org", Found HTTPS url "https://el.libreoffice.org", Found HTTPS url "https://wiki.documentfoundation.org", Found HTTPS url "https://www.freewear.org", Found HTTPS url "https://documentfoundation.myspreadshop.de", Found HTTPS url "https://books.libreoffice.org", Found HTTPS url "https://kk.libreoffice.org", Found HTTPS url "https://es.libreoffice.org", Found HTTPS url "https://uk.libreoffice.org", Found HTTPS url "https://www.paypal.com", Found HTTPS url "https://www.documentfoundation.org", Found HTTPS url "https://whatcanidoforlibreoffice.org", Found HTTPS url "https://cy.libreoffice.org", Found HTTPS url "https://js.stripe.com", Found HTTPS url "https://eo.libreoffice.org", Found HTTPS url "https://creativecommons.org", Found HTTPS url "https://hu.libreoffice.org", Found HTTPS url "https://tr.libreoffice.org", Found HTTPS url "https://id.libreoffice.org", Found HTTPS url "https://af.libreoffice.org", Found HTTPS url "https://sv.libreoffice.org", Found HTTPS url "https://blog.documentfoundation.org", Found HTTPS url "https://www.spi", Found HTTPS url "https://be.libreoffice.org", Found HTTPS url "https://he.libreoffice.org", Found HTTPS url "https://fa.libreoffice.org", Found HTTPS url "https://ka.libreoffice.org", Found HTTPS url "https://ja.libreoffice.org", Found HTTPS url "https://ko.libreoffice.org"1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793050318702,"unified_at":"2026-10-26T21:31:58.702Z","metadata":{"hashes":{"sha256":"6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24","sha1":"582ae0a333c5afee4a611849648101edfca1569b","md5":"d79118aba5b06d1f6450724eb8e4bf17"},"file_info":{"file_name":"urlref_httpswww.libreoffice.orgdonatereferrer_download_versiondir_26.8.1_versionfile_26.8.1_versionline_stable_ab_os_win_cpu_x86-64","file_type":["html"],"file_type_id":"html","file_size":30366,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793050312000,"last_seen":1793050312000,"last_multi_scan":1793050312000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":5},"sandbox_signatures":{"informative_count":6,"suspicious_count":0,"malicious_count":0,"total":6},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve operating system version"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"youtube.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"paypal.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver how much fun you may have with us!

You can also request an orienting interview with TDF mentor Ilmari Lauhakangas, mentioning which area you are interested in.

\n\n

Bank transfers, and additional information for US residents

Owner: The Document Foundation
\nPurpose: Donation
\nAccount: 29523932
\nBank Code: 66190000
\nIBAN: DE36 6619 0000 0029 5239 32, BIC: GENODE61KA1
\nAddress of recipient: The Document Foundation, Winterfeldtstra\" (Indicator: \"ver \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-327","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"facebook.com\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"paypal\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 6b1e0f494ff9… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 6b1e0f494ff9…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24"}],["$","meta","4",{"property":"og:title","content":"Sample 6b1e0f494ff9… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 6b1e0f494ff9…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6b1e0f494ff956ba8a60e124228385b7d4c48b9593242f7e8a160eda66da0f24"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 6b1e0f494ff9… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 6b1e0f494ff9…. Threat score 0/100. 0/26 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]