21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 24:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T488,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Ursu.Generic Sample 6f8c44ebae5a… — Score 50/100 — Hybrid Analysis","description":"Malicious verdict for sample 6f8c44ebae5a…. Malware family: Ursu.Generic. Threat score 50/100. 4/26 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570","keywords":["Malicious","Ursu.Generic","malware analysis","sandbox report","threat intelligence","6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570"],"about":{"@type":"SoftwareApplication","name":"GetHardwareID64.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570","additionalType":"Malicious sample"},"threatScore":50,"malwareFamily":"Ursu.Generic","antivirusDetections":{"malicious":4,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T93a,Pattern match: "HTTPS://HELLOACM.COM" Pattern match: "pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/LatestCRL.crl07" Pattern match: "http://pki-ocsp.symauth.com0" Pattern match: "pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.crl0" Pattern match: "9.fX/|4//" Heuristic match: "zhihua.lai@ranplan.co.uk" Pattern match: "http://dmd.metaservices.microsoft.com/dms/metadata.svc" Pattern match: "http://schemas.microsoft.com/windowsmetadata/services/2007/09/18/dms/DeviceMetadataService/GetDeviceMetadata" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?b9ed6cd1e78670ea HTTP/1.1Connection: Keep-AliveAccept: */*If-Modified-Since: Thu, 20 Apr 2017 16:02:20 GMTIf-None-Match: 04e707defb9d21:0User-Agent: Microsoft-CryptoAPI/6.1Hos" Heuristic match: "GET /msdownload/update/v3/static/trustedr/en/authrootstl.cab?21c91c9f9d5c0833 HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ctldl.windowsupdate.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCED141%2Fl2SWCyYX308B7Khio%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQe6LNDJdqx%2BJOp7hVgTeaGFJ%2FCQgQUljtT8Hkzl699g%2B8uK8zKt4YecmYCEBuN56dlW1Lzehhu%2FtdSD3U%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sv.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "GET /CRL/Omniroot2025.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: cdp1.public-trust.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAt%2BEJA8OEkP%2Bi9nmoehp7k%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSLIycRsoI3J6zPns4K1aQgAqaqHgQUZ50PIAkMzIo65YJGcmL88cyQ5UACEAG2Yem3HYLmNssdMr3TCFk%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Pattern match: "www.microsoft.com" Heuristic match: "ua.lai@ranplan.co.uk"23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/////////////////////////////////////////////////////////////////////////////////////3d3d3d3eIeId3d3d3d3d3d3d3eIiHd3d3h3d3d3d3d3d3d4dnh3d3d3eHd3d3d3d3iHeGZmeHeId3d4d3d3d3eHiIhmZmh3iIh3d3h3d3d3ZmZ3h2Z4d3iIiHd3eHd3d2ZmaIiHd3h3eIiId3d4d3d2Zmh3d3j/+Hd4iIiHd3iHeHZ4d3j/hn/4d3iIiId3eHeId3j/+GZo//h3eIiIh3d3d3////dveP///3d4iIh3d3//h4//////dn/4d3iIh3d4+GZn////+Gdo//h3eId3d3dvd/////d/eP+P/3d3d3d3eP//94////+GZo/4d3d3dnd4+GZo////dvZ4d3d3d3Zmd3dvZ/////j4d3d3d3d2ZmZ3eP/3Zn/4d3Z3d3d3dmZmZnd49ndnd3ZmZ3d3d3ZmZmZmd3aHd3ZmZmd3d3d3d3d3d3d3d3d3d3d3d//////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////7////wH///gAf//wAB/+QAAH/gAAAfwAAAB8AAAAHAAAAAQAAAAAAAAAAoAAAAOAAAAD4AAAA/gAAA/+AAA//4AA///wAz//+E4///5///////////////////////////////////////w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":50,"unified_at_epoch_ms":1790331444815,"unified_at":"2026-09-25T10:17:24.815Z","metadata":{"hashes":{"sha256":"6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570","sha1":"dd087c4f20df5c8791028bedf0fa070c90aab9ae","md5":"fd02dc9630299f2b3b8577f7fbacb1b1","sha512":"de4b57ce7807b8d200a7fe580abde3ec95ddff892618862e3d1e3c905715b919577a342f35f828368750f77c5e8b23c6ddf8884c3cc69760142befb62b05e808","ssdeep":"98304:/wLWV3/F1OXFBg9IOOZXosoxptQtHwaA+iXs47dsDqYHeEvy+S1BL:R3/TOX49I/4sQqtHwUiXFd+qYfG","ssdeep_chunks":["98304:/wLWV3/","98304:wLWV3/F","98304:LWV3/F1","98304:WV3/F1O","98304:V3/F1OX","98304:3/F1OXF","98304:/F1OXFB","98304:F1OXFBg","98304:1OXFBg9","98304:OXFBg9I","98304:XFBg9IO","98304:FBg9IOO","98304:Bg9IOOZ","98304:g9IOOZX","98304:9IOOZXo","98304:IOOZXos","98304:OOZXoso","98304:OZXosox","98304:ZXosoxp","98304:Xosoxpt","98304:osoxptQ","98304:soxptQt","98304:oxptQtH","98304:xptQtHw","98304:ptQtHwa","98304:tQtHwaA","98304:QtHwaA+","98304:tHwaA+i","98304:HwaA+iX","98304:waA+iXs","98304:aA+iXs4","98304:A+iXs47","98304:+iXs47d","98304:iXs47ds","98304:Xs47dsD","98304:s47dsDq","98304:47dsDqY","98304:7dsDqYH","98304:dsDqYHe","98304:sDqYHeE","98304:DqYHeEv","98304:qYHeEvy","98304:YHeEvy+","98304:HeEvy+S","98304:eEvy+S1","98304:Evy+S1B","98304:vy+S1BL","196608:/wLWV3/","196608:wLWV3/F","196608:LWV3/F1","196608:WV3/F1O","196608:V3/F1OX","196608:3/F1OXF","196608:/F1OXFB","196608:F1OXFBg","196608:1OXFBg9","196608:OXFBg9I","196608:XFBg9IO","196608:FBg9IOO","196608:Bg9IOOZ","196608:g9IOOZX","196608:9IOOZXo","196608:IOOZXos","196608:OOZXoso","196608:OZXosox","196608:ZXosoxp","196608:Xosoxpt","196608:osoxptQ","196608:soxptQt","196608:oxptQtH","196608:xptQtHw","196608:ptQtHwa","196608:tQtHwaA","196608:QtHwaA+","196608:tHwaA+i","196608:HwaA+iX","196608:waA+iXs","196608:aA+iXs4","196608:A+iXs47","196608:+iXs47d","196608:iXs47ds","196608:Xs47dsD","196608:s47dsDq","196608:47dsDqY","196608:7dsDqYH","196608:dsDqYHe","196608:sDqYHeE","196608:DqYHeEv","196608:qYHeEvy","196608:YHeEvy+","196608:HeEvy+S","196608:eEvy+S1","196608:Evy+S1B","196608:vy+S1BL","98304:R3/TOX4","98304:3/TOX49","98304:/TOX49I","98304:TOX49I/","98304:OX49I/4","98304:X49I/4s","98304:49I/4sQ","98304:9I/4sQq","98304:I/4sQqt","98304:/4sQqtH","98304:4sQqtHw","98304:sQqtHwU","98304:QqtHwUi","98304:qtHwUiX","98304:tHwUiXF","98304:HwUiXFd","98304:wUiXFd+","98304:UiXFd+q","98304:iXFd+qY","98304:XFd+qYf","98304:Fd+qYfG"],"imphash":"e41db0dfea2106e7f239d5446445b737"},"file_info":{"file_name":"GetHardwareID64.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":4856832,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1518127205000,"last_seen":1661473024000,"last_multi_scan":1661473024000}},"detections":{"summary":{"verdict":"malicious","score":50,"tags":null},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":9,"malicious_count":1,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wacatac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.723084","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Ursu.723084 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Ursu.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".data\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".idata\" is zero\n Raw size of \".didata\" is zero\n Raw size of \".edata\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".UPX0\" is zero\n Raw size of \".pdata\" is zero\n Raw size of \".UPX1\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00012965-00001892-00000046-57220259","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00012965-00001892-00000046-57220259","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_ba5641d1849f93bc\\comctl32.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$22","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00012965-00001892-00000033-57104345\n \"\" queried SystemProcessInformation at 00012965-00001892-00000033-57141248","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".UPX2 with unusual entropies 7.9714957471","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"fxu@3.gul\"\n Pattern match: \"zhihua.lai@ranplan.co.uk\"\n Pattern match: \"ua.lai@ranplan.co.uk\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.1.1.2\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570.exe.bin\" has an entrypoint in section \".UPX2\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n LoadLibraryA\n GetModuleHandleA\n GetModuleFileNameW\n GetVersionExW\n GetProcAddress","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/67 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":34,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"5c798670038838f527a0f4f2","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"GetHardwareID64.exe","analysis_start_time":"2019-03-01T19:22:24+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5c6f15e47ca3e17c5f4aa9b8","environment_id":100,"environment_description":"Windows 7 32 bit","state":"ERROR","error_type":"Cannot run a 64-bit native file on a 32-bit virtual machine","verdict":"undetected","submit_name":"GetHardwareID64.exe","analysis_start_time":"2019-02-21T21:19:32+00:00","indicators_count":{"informative":0,"suspicious":0,"malicious":0},"is_in_unified_schema":false},{"id":"5a7cb9557ca3e154af05cce3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":50,"malware_family":"Suspicious_GEN.F47V1019","submit_name":"GetHardwareID64.vmp.exe","analysis_start_time":"2018-02-08T22:49:12+00:00","indicators_count":{"informative":8,"suspicious":11,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}],"processes":[{"pid":1892,"ppid":0,"name":"6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570.exe","command_line":"","sha256":"6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570","normalized_path":"C:\\6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570.exe","uid":"00012965-00001892","icon":"$23"}],"all_imported_dlls":["KernelBase.dll","advapi32.dll","sechost.dll","netapi32.dll","netutils.dll","wkscli.dll","comctl32.dll","dhcpcsvc.dll","ws2_32.dll","oleaut32.dll","ole32.dll","msvcrt.dll","shlwapi.dll","wtsapi32.dll","kernel32.dll","rpcrt4.dll","lpk.dll","version.dll","msctf.dll","winsta.dll","IPHLPAPI.DLL","imm32.dll","cryptbase.dll","winnsi.dll","gdi32.dll","user32.dll","usp10.dll","shell32.dll","nsi.dll","ntdll.dll","srvcli.dll","uxtheme.dll","dwmapi.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"path":"%WINDIR%\\winsxs\\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_ba5641d1849f93bc\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a7cb9557ca3e154af05cce3"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a7cb9557ca3e154af05cce3"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Ursu.Generic Sample 6f8c44ebae5a… — Score 50/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6f8c44ebae5a…. Malware family: Ursu.Generic. Threat score 50/100. 4/26 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570"}],["$","meta","4",{"property":"og:title","content":"Malicious Ursu.Generic Sample 6f8c44ebae5a… — Score 50/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6f8c44ebae5a…. Malware family: Ursu.Generic. Threat score 50/100. 4/26 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6f8c44ebae5a7bc9144f7d3b337b4f14c9154160eb73f6b4ed77f666f7d7f570"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Ursu.Generic Sample 6f8c44ebae5a… — Score 50/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6f8c44ebae5a…. Malware family: Ursu.Generic. Threat score 50/100. 4/26 AV engines flagged this file. 1 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L24","11",{}]]