21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Virus.Sality Sample 6fb2f3356694… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6fb2f3356694…. Malware family: Virus.Sality. Threat score 100/100. 23/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e","keywords":["Malicious","Virus.Sality","malware analysis","sandbox report","threat intelligence","6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e"],"about":{"@type":"SoftwareApplication","name":"89828eec51d6fe22768c9364dcbb49b9.exe","applicationCategory":["peexe","executable"],"identifier":"6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Virus.Sality","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T5b2,RegCreateKeyExW RegCloseKey CreateProcessWithLogonW RegDeleteKeyW SetSecurityDescriptorDacl OpenProcessToken RegOpenKeyExW GetUserNameW RegEnumKeyExW CreateProcessAsUserW RegDeleteValueW GetDriveTypeW GetFileAttributesW UnhandledExceptionFilter GetTempPathW DeviceIoControl CopyFileW WriteProcessMemory OutputDebugStringW GetModuleFileNameW IsDebuggerPresent LoadLibraryExW CreateThread ExitThread TerminateProcess CreateToolhelp32Snapshot LoadLibraryW GetVersionExW GetTickCount LoadLibraryA GetFileSize OpenProcess GetStartupInfoW ReadProcessMemory CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetComputerNameW WriteFile FindNextFileW FindFirstFileW CreateFileW VirtualAllocEx Process32NextW LockResource GetCommandLineW Process32FirstW GetModuleHandleW FindResourceW CreateProcessW Sleep VirtualAlloc EnumProcesses ShellExecuteW ShellExecuteExW SetKeyboardState FindWindowExW FindWindowW GetWindowThreadProcessId FtpGetFileSize InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetConnectW HttpQueryInfoW InternetCrackUrlW InternetCloseHandle HttpSendRequestW InternetOpenUrlW InternetReadFile FtpOpenFileW sendto (Ordinal #20) accept (Ordinal #1) WSAStartup (Ordinal #115) bind (Ordinal #2) recv (Ordinal #16) socket (Ordinal #23) connect (Ordinal #4) recvfrom (Ordinal #17) send (Ordinal #19) closesocket (Ordinal #3) listen (Ordinal #13)23:T492,"" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "ANTIVIRUSOVERRIDE"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "ANTIVIRUSDISABLENOTIFY"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "FIREWALLDISABLENOTIFY"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "FIREWALLOVERRIDE"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER"; Key: "UPDATESDISABLENOTIFY"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "ANTIVIRUSOVERRIDE"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "ANTIVIRUSDISABLENOTIFY"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "FIREWALLDISABLENOTIFY"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "FIREWALLOVERRIDE"; Value: "01000000") "" (Path: "HKLM\SOFTWARE\MICROSOFT\SECURITY CENTER\SVC"; Key: "UPDATESDISABLENOTIFY"; Value: "01000000")24:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A/////////////////////////4iIiHdwMzEAAAD///////93d3d/h3d4EXcx////////d3d3j/h3f3F3d///////////+P+Id3iBE4j/////////iH//h3d493eI////////AAL4//cAB4d4iP///////wAPePhxERdzd3f///////8AiA9xERARcAcA////////APh3WPcXdxEHcP///////3d4eP+FAFh3EXD///////8PiI//gQB3iHd3////////f4d4j4EXhwc3d////////3/3iIh5EVd3d3j///////9/d3dndxEAF3eI////////URAAAHcAAAAAd////////4cAcA+AB3AAADf/////////f/CPcAeHB3f3////////eP93+HAHeHePgP///////xiJmHEQAREVd3D///////9YdXeREAEREReA////////B4d3BQEXd3iP8P///////weHdwAHd4d4j4D///////93hwdAARFRVRdw////////B4d3BhEREREXUP///////wCHdABXd3d3jzD///////8AeHUAf4iIiPgA////////AAh3QFd3URWAAP///////3d3d0ARERFYEAD///////93d3dQeIiI9wAA////////d3cHdHh4hxAAAP///////3d3cAdxcRcXAAD///////////gP///wB///8Af//+AH///AA///gAH//wAA//8AAH/+AAB//gAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/wAAD/8AAA//AAAP/4AAH/+AAB//gAAf/4AAP//AAD//4AB//+AA///wAf///Af/w==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790673843465,"unified_at":"2026-09-29T09:24:03.465Z","metadata":{"hashes":{"sha256":"6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e","sha1":"562c87ba14fc74f230cd8f94b9821752d210a539","md5":"89828eec51d6fe22768c9364dcbb49b9","sha512":"42713dc2e016036014436242d9f16a1c38430ef06ab20c019052ced41b67ca321c90f81638f630a4184a8c338da1f2686bfb7b0fb6c55c77956c7b2ecfc893aa","ssdeep":"24576:6R/JkcoQricOIQxiZY1ian+7ylvcum86JvnSl:iJZoQrbTFZY1ia++Rcx8yk","ssdeep_chunks":["24576:6R/Jkco","24576:R/JkcoQ","24576:/JkcoQr","24576:JkcoQri","24576:kcoQric","24576:coQricO","24576:oQricOI","24576:QricOIQ","24576:ricOIQx","24576:icOIQxi","24576:cOIQxiZ","24576:OIQxiZY","24576:IQxiZY1","24576:QxiZY1i","24576:xiZY1ia","24576:iZY1ian","24576:ZY1ian+","24576:Y1ian+7","24576:1ian+7y","24576:ian+7yl","24576:an+7ylv","24576:n+7ylvc","24576:+7ylvcu","24576:7ylvcum","24576:ylvcum8","24576:lvcum86","24576:vcum86J","24576:cum86Jv","24576:um86Jvn","24576:m86JvnS","24576:86JvnSl","49152:6R/Jkco","49152:R/JkcoQ","49152:/JkcoQr","49152:JkcoQri","49152:kcoQric","49152:coQricO","49152:oQricOI","49152:QricOIQ","49152:ricOIQx","49152:icOIQxi","49152:cOIQxiZ","49152:OIQxiZY","49152:IQxiZY1","49152:QxiZY1i","49152:xiZY1ia","49152:iZY1ian","49152:ZY1ian+","49152:Y1ian+7","49152:1ian+7y","49152:ian+7yl","49152:an+7ylv","49152:n+7ylvc","49152:+7ylvcu","49152:7ylvcum","49152:ylvcum8","49152:lvcum86","49152:vcum86J","49152:cum86Jv","49152:um86Jvn","49152:m86JvnS","49152:86JvnSl","24576:iJZoQrb","24576:JZoQrbT","24576:ZoQrbTF","24576:oQrbTFZ","24576:QrbTFZY","24576:rbTFZY1","24576:bTFZY1i","24576:TFZY1ia","24576:FZY1ia+","24576:ZY1ia++","24576:Y1ia++R","24576:1ia++Rc","24576:ia++Rcx","24576:a++Rcx8","24576:++Rcx8y","24576:+Rcx8yk"],"imphash":"0d06c9b2132083e29bb92b2dd824bd6f"},"file_info":{"file_name":"89828eec51d6fe22768c9364dcbb49b9.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":910393,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1500299067000,"last_seen":1678215345000,"last_multi_scan":1678215345000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":16,"malicious_count":10,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win32/Kashu.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Virus/Win32.Sality.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"W32/Sality.AT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Win32.Sality.3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.DarkKomet-9982075-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Sality.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Sality.gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Win32.Sality.3 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Sality.NBA virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Virus/Sality.c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Virus ( f10001071 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Sality.sil","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W32/Sality.gen.z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Sality.beygb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Sality-D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Virus/W32.Sality.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"PE_SALITY.RL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"PE_SALITY.RL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Win32.Sality.BH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Sality.bakc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Virus.Sality.Win32.25","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Virus.Sality","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 31621-336-00417DAA\n SetUnhandledExceptionFilter@KERNEL32.dll at 31621-329-0041A208\n SetUnhandledExceptionFilter@KERNEL32.dll at 31621-3513-0041F250","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 31621-1540-00432A10\n GetSystemTimeAsFileTime@KERNEL32.dll at 31621-778-004148B3\n GetSystemTimeAsFileTime@KERNEL32.dll at 31621-1411-0041F5DE\n GetLocalTime@KERNEL32.dll at 31621-711-004720DB\n GetLocalTime@KERNEL32.dll at 31621-2175-0045DF23\n GetSystemTime@KERNEL32.DLL at 00014148-00002940-41172-1816-004D3C11\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00014148-00002940-41172-717-004148B5","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 31621-721-0041E364","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 31621-1202-0040E500\n GetVersionExW@KERNEL32.DLL at 00014148-00002940-41172-198-0040E500","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.dll at 31621-2169-0045D78F\n GetDiskFreeSpaceExW@KERNEL32.dll at 31621-2170-0045D86D\n GetDiskFreeSpaceW@KERNEL32.dll at 31621-2168-0045D619","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.dll (Target: \"6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe.bin\"; Stream UID: \"31621-1540-00432A10\")\n which is directly followed by \"cmp word ptr [esi], 0000h\" and \"je 00432B89h\". See related instructions: \"...\n+0 push ebp\n+1 mov ebp, esp\n+3 sub esp, 0Ch\n+6 push ebx\n+7 mov ebx, dword ptr [ebp+14h]\n+10 push esi\n+11 mov esi, dword ptr [ebp+08h]\n+14 push edi\n+15 mov edi, dword ptr [ebp+0Ch]\n+18 push edi\n+19 call dword ptr [00482218h] ;GetLocalTime\n+25 cmp word ptr [esi], 0000h\n+29 je 00432B89h\" ... at 31621-1540-00432A10","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 31621-1676-00436B19\n GetProcessHeap@KERNEL32.dll at 31621-1672-00436BA9\n GetProcessHeap@KERNEL32.dll at 31621-1121-004238DA\n GetProcessHeap@KERNEL32.dll at 31621-1671-00436B91","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.dll at 31621-998-00401CB0\n RegisterHotKey@USER32.dll at 31621-2350-0046D536","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\00391CEB_Rar\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe\"\n \"\" created file \"%TEMP%\\00391CEB_Rar\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\uxJLpe1m\"\n \"uxJLpe1m\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.dll at 31621-711-004720DB","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ikhouvanirakezen.nl/logo.gif\"\n Pattern match: \"http://www.novedades2013.unlugar.com/logo.gif\"\n Pattern match: \"http://www.pushkarinternational.com/logo.gif\"\n Pattern match: \"http://ngaoschool.ac.th/logo.gif\"\n Pattern match: \"http://pedaisuchoa.com/logos.gif\"\n Pattern match: \"http://mendezmorales.com/logo.gif\"\n Pattern match: \"http://landmarkgroup.com.au/images/logos/logos.gif\"\n Pattern match: \"http://dsign-studio.com/images/button.gif\"\n Pattern match: \"http://barrymward.com/images/logo.gif\"\n Pattern match: \"http://www.greenbeach.de/logo.gif\"\n Pattern match: \"e.com/logo.gif\"\n Pattern match: \"http://nlcfoundation.org/images/xs.jpg\"\n Pattern match: \"http://natufarma.net/imagens/logof.gif\"\n Pattern match: \"http://68.168.222.206/logos.gif\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to block user input","description":"BlockInput@USER32.dll at 31621-2058-0045A370","origin":"Hybrid Analysis Technology","relevance":7,"id":"stream-26","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.39647656345","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://pedaisuchoa.com\" as malicious (1% detection rate)\n 6/65 reputation engines marked \"http://www.pushkarinternational.com\" as malicious (9% detection rate)\n 1/65 reputation engines marked \"http://ngaoschool.ac.th\" as malicious (1% detection rate)\n 1/64 reputation engines marked \"http://www.novedades2013.unlugar.com\" as malicious (1% detection rate)\n 2/66 reputation engines marked \"http://ikhouvanirakezen.nl\" as malicious (3% detection rate)\n 1/66 reputation engines marked \"http://mendezmorales.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 31621-1545-0043305F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"255.255.255.255\"\n \"5.255.255.255\"\n Heuristic match: \"http://68.168.222.206/logos.gif\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"InternetReadFile@WININET.dll at 31621-1732-004423DA\n InternetReadFile@WININET.dll at 31621-1731-004422FE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.dll at 31621-693-00433EE0\n CreateToolhelp32Snapshot@KERNEL32.dll at 31621-2412-004755C4","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.dll at 31621-2054-0045A10F\n OpenClipboard@USER32.dll at 31621-567-0046DC80","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.dll at 31621-584-00456391\n GetKeyboardState@USER32.dll at 31621-1782-004447E0\n GetKeyboardState@USER32.dll at 31621-1781-004445F4\n GetKeyboardState@USER32.dll at 31621-1899-0044C37A\n GetKeyboardState@USER32.dll at 31621-1958-00453C57\n GetKeyboardState@USER32.dll at 31621-1900-0044C514\n GetKeyboardState@USER32.dll at 31621-1780-004443FC","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 31621-1812-00446124\n SetSecurityDescriptorDacl@ADVAPI32.dll at 31621-1811-00445F35","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to impersonate another user on the local machine","description":"LogonUserW@ADVAPI32.dll at 31621-1677-00436CD7","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-46","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to lookup privileges","description":"GetSecurityDescriptorDacl@ADVAPI32.dll at 31621-1812-00446124\n GetSecurityDescriptorDacl@ADVAPI32.dll at 31621-1811-00445F35","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-43","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"mouse_event@USER32.dll at 31621-1547-0043333C\n mouse_event@USER32.dll at 31621-1890-0044BACC\n mouse_event@USER32.dll at 31621-1725-00441FD6\n keybd_event@USER32.dll at 31621-1573-00434418\n keybd_event@USER32.dll at 31621-1578-0043471D\n mouse_event@USER32.dll at 31621-1889-0044BA68","origin":"Hybrid Analysis Technology","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Creates a mutant that has been seen in the context of malware","description":"\"uxJLpe1m\"","origin":"Created Mutant","relevance":6,"id":"mutant-2","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$22","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%TEMP%\\00391CEB_Rar\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"6/65 reputation engines marked \"http://www.pushkarinternational.com\" as malicious (9% detection rate)","origin":"External System","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/56 Antivirus vendors marked sample as malicious (91% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/56 Antivirus vendors marked sample as malicious (91% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 31621-1520-00431BE8","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"System Security","name":"Modifies firewall settings","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"ENABLEFIREWALL\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DONOTALLOWEXCEPTIONS\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SHAREDACCESS\\PARAMETERS\\FIREWALLPOLICY\\STANDARDPROFILE\"; Key: \"DISABLENOTIFICATIONS\"; Value: \"01000000\")","origin":"Registry Access","relevance":9,"id":"registry-12","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"System Security","name":"Modifies security center notification settings","description":"$23","origin":"Registry Access","relevance":8,"id":"registry-11","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\"; Key: \"UACDISABLENOTIFY\"; Value: \"01000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"\" checked file \"C:\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe\\:Zone.Identifier:$DATA\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.dll at 31621-1549-004333BE","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":35,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"596cbe127ca3e12a1312f923","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Virus.Sality","submit_name":"89828eec51d6fe22768c9364dcbb49b9.exe","analysis_start_time":"2017-07-17T14:39:21+00:00","indicators_count":{"informative":14,"suspicious":21,"malicious":11},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}],"processes":[{"pid":2940,"ppid":0,"name":"6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe","command_line":"","sha256":"6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e","normalized_path":"C:\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe","uid":"00014148-00002940","icon":"$24"}],"all_imported_dlls":["nsi.dll","shlwapi.dll","winmm.dll","lpk.dll","sechost.dll","ole32.dll","crypt32.dll","comdlg32.dll","user32.dll","ntdll.dll","kernel32.dll","wsock32.dll","version.dll","comctl32.dll","mpr.dll","imm32.dll","advapi32.dll","msasn1.dll","uxtheme.dll","psapi.dll","gdi32.dll","KernelBase.dll","ws2_32.dll","msvcrt.dll","wininet.dll","shell32.dll","sspicli.dll","rpcrt4.dll","usp10.dll","urlmon.dll","oleaut32.dll","iertutil.dll","userenv.dll","profapi.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"path":"%TEMP%\\00391CEB_Rar","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"path":"C:\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"path":"C:\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"path":"%TEMP%\\00391CEB_Rar\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe\\:Zone.Identifier:$DATA","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"path":"%TEMP%\\00391CEB_Rar\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"path":"%TEMP%\\00391CEB_Rar\\6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e.exe","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SECURITY CENTER\\SVC\\","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"key":"HKCU\\SOFTWARE\\AKPWFFK\\-1451187260\\","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"key":"HKCU\\SOFTWARE\\AKPWFFK\\","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\uxJLpe1m","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]},{"name":"uxJLpe1m","sources":[{"report_type":"sandbox","report_id":"596cbe127ca3e12a1312f923"}]}]}},"report_ids":{"sandbox_job_ids":["596cbe127ca3e12a1312f923"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Virus.Sality Sample 6fb2f3356694… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 6fb2f3356694…. Malware family: Virus.Sality. Threat score 100/100. 23/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e"}],["$","meta","4",{"property":"og:title","content":"Malicious Virus.Sality Sample 6fb2f3356694… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 6fb2f3356694…. Malware family: Virus.Sality. Threat score 100/100. 23/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/6fb2f335669405e9c3b7582b524dac22ebff7e5fe1258f25914d7e0e750ca62e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Virus.Sality Sample 6fb2f3356694… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 6fb2f3356694…. Malware family: Virus.Sality. Threat score 100/100. 23/28 AV engines flagged this file. 10 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]