26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T491,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6f0b4e9fa00a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6f0b4e9fa00a…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc"],"about":{"@type":"SoftwareApplication","name":"firefox.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":22,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6b3,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\System32\rsaenh.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\75790ba48ebfa82fae7da9a114bc9886\System.Core.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\sortdefault.nlp" "" touched file "C:\Users\O19RRKi\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\System32\en-US\propsys.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEZGZmTMAAAAAAAAAAAAAERERmZkzMxAAAAAAAAAAARERmZmZMzNJAAAAAAAAARERmZMzMzMzMxAAAAAAABERmTMzMzMzMzM7AAAAAAERGZMzMzMzMzMzu7AAAAAREZMzMzMzMzMzMzM7AAAAERkzMzMzRAATO7MzMYAAARETMzMzREAAAEuzMzMQAAERkzMzMRREREREM7szEAABETM5mREzEURERDu7MzAAmZkzmZEzMzMzZERLu7swAJmZMxmTM2MziGREQzu7OwCZmTMRk2ZmZmZkRES7uzsAOZkzERZmZmZmZkREu7u3ADmZMxEWZmZmZmZmRLu7sQE5mZkzO7ZmZmZmZmS7O7EAOZmZkzM2bu5mZmZke7uxADmZmZkzOGbu7mZmZku4sAAzmZmZMx+IeI7u5mZLu7AAA5mZmTMZmXiIiO5mi7uwAAM5mZMzGIiIiIiO5ru7sAAJk5MzM3iIiIiIfme7sbAAAZkzNzk4iP+IiHdvu2MAAACZRGZ5OI//+IiHZrcwAAAAsARGiIP///+Ih0hjAAAAAAAARmiP/////4b2MAAAAAAAAARniP////iGYAAAAAAAAAAABGj///+GYAAAAAAAAAAAAAAARmZmAAAAAAAAD/AAB//AAAH/gAAA/wAAAH8AAAB/AAAAfwAAAH4AAAA8AAAAHAAAABgAAAAYAAAAGAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAAAgAAAAMAAAAHAAAABwAAAA8AAAAPgAAAH4AAAH/4AAH//gAD//+AH/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791060373611,"unified_at":"2026-10-03T20:46:13.611Z","metadata":{"hashes":{"sha256":"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc","sha1":"498a38e1196f3091777f69957e273cee8760a557","md5":"58284d741ed273587e91d59b75d1bfbe","sha512":"9fb6c3d0b4047e791e6f0372540fcccfc502d408c98dbc30cf62d081f9d0ebc7bc9d4e6c12f014de0018f82e9003d36a3883cca78246a22ae1d6922174d02e9b","ssdeep":"6144:SjTeww7ml2Q0VwovZVxYg249t+G1l1g5IXdLFmdQ4W4:eVw7AuXxG4t11l1guXdkdT","ssdeep_chunks":["6144:SjTeww7","6144:jTeww7m","6144:Teww7ml","6144:eww7ml2","6144:ww7ml2Q","6144:w7ml2Q0","6144:7ml2Q0V","6144:ml2Q0Vw","6144:l2Q0Vwo","6144:2Q0Vwov","6144:Q0VwovZ","6144:0VwovZV","6144:VwovZVx","6144:wovZVxY","6144:ovZVxYg","6144:vZVxYg2","6144:ZVxYg24","6144:VxYg249","6144:xYg249t","6144:Yg249t+","6144:g249t+G","6144:249t+G1","6144:49t+G1l","6144:9t+G1l1","6144:t+G1l1g","6144:+G1l1g5","6144:G1l1g5I","6144:1l1g5IX","6144:l1g5IXd","6144:1g5IXdL","6144:g5IXdLF","6144:5IXdLFm","6144:IXdLFmd","6144:XdLFmdQ","6144:dLFmdQ4","6144:LFmdQ4W","6144:FmdQ4W4","12288:SjTeww7","12288:jTeww7m","12288:Teww7ml","12288:eww7ml2","12288:ww7ml2Q","12288:w7ml2Q0","12288:7ml2Q0V","12288:ml2Q0Vw","12288:l2Q0Vwo","12288:2Q0Vwov","12288:Q0VwovZ","12288:0VwovZV","12288:VwovZVx","12288:wovZVxY","12288:ovZVxYg","12288:vZVxYg2","12288:ZVxYg24","12288:VxYg249","12288:xYg249t","12288:Yg249t+","12288:g249t+G","12288:249t+G1","12288:49t+G1l","12288:9t+G1l1","12288:t+G1l1g","12288:+G1l1g5","12288:G1l1g5I","12288:1l1g5IX","12288:l1g5IXd","12288:1g5IXdL","12288:g5IXdLF","12288:5IXdLFm","12288:IXdLFmd","12288:XdLFmdQ","12288:dLFmdQ4","12288:LFmdQ4W","12288:FmdQ4W4","6144:eVw7AuX","6144:Vw7AuXx","6144:w7AuXxG","6144:7AuXxG4","6144:AuXxG4t","6144:uXxG4t1","6144:XxG4t11","6144:xG4t11l","6144:G4t11l1","6144:4t11l1g","6144:t11l1gu","6144:11l1guX","6144:1l1guXd","6144:l1guXdk","6144:1guXdkd","6144:guXdkdT"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"firefox.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":253952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1518941440000,"last_seen":1623145247000,"last_multi_scan":1623145247000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":22,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":13,"malicious_count":6,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.JigsawLocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/MSIL.Lobzik","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Generic.MSIL.Ransomware.Jigsaw.DAA8EF0A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Jigsaw.A3.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.Jigsaw.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/MSIL.Jigsaw.b","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.JigSaw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 700000121 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.MSIL.Lobzik.ar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDW-TQ!58284D741ED2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nano":{"name":"Nano","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.MsilFC.S6056063","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Jigsaw-K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_JIGSAW.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_JIGSAW.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.CGE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokada","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"PATH\"; Value: \"00000000010000005600000043003A005C00500072006F006700720061006D002000460069006C00650073005C00410064006F00620065005C005200650061006400650072002000310031002E0030005C005200650061006400650072005C000000\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\".jpg .jpeg .raw .tif .gif .png .bmp.3dm .max.accdb .db .dbf .mdb .pdb .sql.dwg .dxf.c .cpp .cs .h .php .asp .rb .java .jar .class .py .js.aaf .aep .aepx .plb .prel .prproj .aet .ppj .psd .indd .indl .indt .indb .inx .idml .pmd .xqx .xqx .ai .eps .ps .svg .swf .fla .as3 .as.txt .doc .dot .docx .docm .dotx .dotm .docb .rtf .wpd .wps .msg .pdf .xls .xlt .xlm .xlsx .xlsm .xltx .xltm .xlsb .xla .xlam .xll .xlw .ppt .pot .pps .pptx .pptm .potx .potm .ppam .ppsx .ppsm .sldx .sldm.wav .mp3 .aif .iff .m3u .m4u .mid .mpa .wma .ra .avi .mov .mp4 .3gp .mpeg .3g2 .asf .asx .flv .mpg .wmv .vob .m3u8 .mkv.dat .csv .efx .sdf .vcf .xml .ses.rar .zip .7zip .hwp .html .backup @\"\n \"%USERPROFILE%\\Desktop\\JigsawRansomware\\JigsawRansomware\\obj\\Release\\Firefox.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 6B680000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 6AB20000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AcroRd32.exe\" (UID: 00010295-00002400) was launched with new environment variables: \"MEOW=\"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AcroRd32.exe\" with commandline \"C:\\6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe\" (UID: 00010295-00002400)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$27","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"fbgwls245@naver.com\"\n Pattern match: \"http://btc.blockr.io/api/v1/\"\n Heuristic match: \"45@naver.com\"\n Pattern match: \"btc.blockr.io/api/v1/\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00009993-00002248-00000105-28400832","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .rsrc with unusual entropies 7.52249088419\n 7.17782720062","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"\\Device\\MountPointManager\", Handle: 664)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CHROME32.EXE\"; Value: \"%APPDATA%\\Google (x86)\\Chrome32.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"15.5.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions within a single string: .3dm\n .3g2\n .3gp\n .7z\n .7zip\n .csv\n .doc\n .dot\n .ppt\n .rtf\n .xls\n .accdb\n .ai\n .asf\n .asp\n .asx\n .avi\n .back\n .backup\n .bmp\n .class\n .cpp\n .cs\n .csv\n .dat\n .db\n .dbf\n .doc\n .docb\n .docm\n .docx\n .dot\n .dotm\n .dotx\n .dwg\n .dxf\n .eps\n .fla\n .flv\n .gif\n .html\n .hwp\n .indd\n .jar\n .java\n .jpe\n .jpeg\n .jpg\n .js\n .m3u\n .m4u\n .max\n .md\n .mdb\n .mid\n .mkv\n .mov\n .mp3\n .mp4\n .mpeg\n .mpg\n .msg\n .pdb\n .pdf\n .php\n .pl\n .png\n .pot\n .potm\n .potx\n .ppam\n .pps\n .ppsm\n .ppsx\n .ppt\n .pptm\n .pptx\n .ps\n .psd\n .py\n .rar\n .raw\n .rb\n .rtf\n .sdf\n .sldm\n .sldx\n .sql\n .svg\n .swf\n .tif\n .txt\n .vcf\n .vob\n .wav\n .wma\n .wmv\n .wpd\n .wps\n .xla\n .xlam\n .xlm\n .xls\n .xlsb\n .xlsm\n .xlsx\n .xlt\n .xltm\n .xltx\n .xlw\n .xml\n .zip","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\Google (x86)\\Chrome32.exe:Zone.Identifier\"\n \"\" created file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Adobe (x86)\\AcroRd32.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET POLICY PE EXE or DLL Windows file download HTTP\" (SID: 2018959, Rev: 3, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"40/67 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"40/67 Antivirus vendors marked sample as malicious (59% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"40/67 Antivirus vendors marked spawned process \"AcroRd32.exe\" (PID: 2400) as malicious (classified as \"Generic.MSIL.Ransomware.Jigsaw\" with 59% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%LOCALAPPDATA%\\Adobe (x86)\\AcroRd32.exe\" (Handle: 664)\n \"\" wrote 52 bytes to a remote process \"%LOCALAPPDATA%\\Adobe (x86)\\AcroRd32.exe\" (Handle: 664)\n \"\" wrote 4 bytes to a remote process \"%LOCALAPPDATA%\\Adobe (x86)\\AcroRd32.exe\" (Handle: 664)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":50,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"5a8932b57ca3e1212a3c9043","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.MSIL.Ransomware.Jigsaw","submit_name":"firefox.exe","analysis_start_time":"2018-02-18T09:01:13+00:00","indicators_count":{"informative":11,"suspicious":14,"malicious":7},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}],"processes":[{"pid":2248,"ppid":0,"name":"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe","command_line":"","sha256":"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc","normalized_path":"C:\\6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe","uid":"00009993-00002248","icon":"$28"},{"pid":2400,"ppid":2248,"name":"AcroRd32.exe","command_line":"C:\\6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe","sha256":"6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc","normalized_path":"%LOCALAPPDATA%\\Adobe (x86)\\AcroRd32.exe","parent_uid":"00009993-00002248","uid":"00010295-00002400"}],"all_imported_dlls":["msvcrt.dll","rpcrt4.dll","System.Core.ni.dll","msasn1.dll","sspicli.dll","setupapi.dll","devobj.dll","advapi32.dll","gdi32.dll","usp10.dll","msctf.dll","Wldap32.dll","kernel32.dll","propsys.dll","clbcatq.dll","apphelp.dll","RpcRtRemote.dll","ntdll.dll","shlwapi.dll","user32.dll","imm32.dll","cryptsp.dll","rsaenh.dll","System.Windows.Forms.ni.dll","shell32.dll","KernelBase.dll","sechost.dll","msvcr120_clr0400.dll","uxtheme.dll","profapi.dll","iertutil.dll","crypt32.dll","mscoreei.dll","ole32.dll","System.Drawing.ni.dll","cfgmgr32.dll","mscoree.dll","lpk.dll","clrjit.dll","nlssorting.dll","comctl32.dll","wininet.dll","oleaut32.dll","System.ni.dll","clr.dll","mscorlib.dll","mscorlib.ni.dll","cryptbase.dll","ntmarta.dll","urlmon.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"C:\\6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe.config","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"C:\\6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8990487b8c05ada1e1febe7dcb6c0410\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\24db7e31c7ba5b0e824e2f521c0914bc\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\250e8e6af918e7ca66787117bc8633e3\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%APPDATA%\\firefox install Folder","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\75790ba48ebfa82fae7da9a114bc9886\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\sortdefault.nlp","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%APPDATA%\\Google (x86)","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%APPDATA%\\Google (x86)\\Chrome32.exe","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"C:\\6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%APPDATA%\\Google (x86)\\Chrome32.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%LOCALAPPDATA%\\Adobe (x86)","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%LOCALAPPDATA%\\Adobe (x86)\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\System32\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a8932b57ca3e1212a3c9043"}]}]}},"report_ids":{"sandbox_job_ids":["5a8932b57ca3e1212a3c9043"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 6f0b4e9fa00a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6f0b4e9fa00a…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 6f0b4e9fa00a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6f0b4e9fa00a…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6f0b4e9fa00a9d597a4ed12c51d116a60cfb0c611dd41635580afffcc6e4f9bc"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 6f0b4e9fa00a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6f0b4e9fa00a…. Malware family: Trojan.Generic. Threat score 100/100. 22/26 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]