24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fa,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VHO_Backdoor_Win32_Agent_gen Sample 76813f218da4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 76813f218da4…. Malware family: VHO_Backdoor_Win32_Agent_gen. Threat score 100/100. 2/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","keywords":["Malicious","VHO_Backdoor_Win32_Agent_gen","malware analysis","sandbox report","threat intelligence","76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727"],"about":{"@type":"SoftwareApplication","name":"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","applicationCategory":["peexe","64bits","executable"],"identifier":"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VHO_Backdoor_Win32_Agent_gen","antivirusDetections":{"malicious":2,"total":28},"behavioralIndicators":{"malicious":0,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1452,Found XOR loop in file "sample.bin" at offset 69142; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 71616; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 86396; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 163647; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 179712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 198420; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 282083; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 385494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 398792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 418244; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 503284; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 780268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 790267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 856245; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 903792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 933792; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1015648; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1047591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1139538; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1250547; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1351910; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1426015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5568; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 146016; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 148632; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 165259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 381516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 496521; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 522596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 613313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 708746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 744592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 777088; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 922952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 982787; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1005440; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1024200; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1040672; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1197256; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1228613; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332388; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1336852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1359575; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1388993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1426203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1490693; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 68930; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 79157; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 127880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 236126; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 302464; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 331024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 368867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 370059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 410587; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 557994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 788725; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 902484; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 951083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 976036; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1087210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1160058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1162931; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1264358; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1290866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1292268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1410410; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1427635; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1461595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1484491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1504460; code bytes = 803026:T1060,Found reference to API (Indicator: "DelayLoadFailureHook"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "RaiseException"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "TerminateProcess"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "Sleep"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "GetTickCount"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00002736.00000000.202126.960D3000.00000002.mdmp")27:T9b7,"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "")28:T10e5,"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "000604XX"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSLEEPLOOPWINDOWSIZE"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYSPINCOUNTTHRESHOLD"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYBASEYIELD"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTFACTORYIELD"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SMTDELAYMAXYIELD"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D0F1A5C6-FC43-48AE-99BF-EFB1C38BE9D1"; Value: "")29:T7c6,"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\windows\temp\VxSSL64.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\FLTLIB.DLL" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\WINDOWS\SYSTEM32\FLTLIB.DLL" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\Windows\System32\fltLib.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\MSVCP140.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\WINDOWS\SYSTEM32\MSVCP140.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\VCRUNTIME140.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\Windows\System32\vcruntime140.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\VCRUNTIME140_1.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\WINDOWS\SYSTEM32\VCRUNTIME140_1.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\Windows\System32\vcruntime140_1.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\Windows\System32\msvcp140.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\WINDOWS\system32\IMM32.DLL" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\Windows\System32\imm32.dll" "76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe" trying to touch file "C:\Windows\System32\sechost.dll"2a:T442," System Application PA Copyright (c) Microsoft Corporation --> Windows System Assessment Tool t.bm\"\n Heuristic match: \"(|z>.tp\"\n Heuristic match: \"f$.lb\"\n Heuristic match: \"md.ec\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"0LAes:\" (Indicator: \"aes\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002736.00000000.202126.960D3000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002736.00000000.202126.960D3000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002736.00000000.202126.960D3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002736.00000000.202126.960D3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002736.00000000.202126.960D3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00002736.00000000.202126.176A0000.00000004.mdmp, 00000000-00002736.00000000.202126.176B0000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00002736.00000000.202126.176A0000.00000004.mdmp, 00000000-00002736.00000000.202126.176B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002736.00000000.202126.960D3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"RoInitialize\" (Source: 76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe, API is part of module: COMBASE.DLL)\n Found string \"RoUninitialize\" (Source: 76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe, API is part of module: COMBASE.DLL)\n Found string \"WindowsCreateStringReference\" (Source: 76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe, API is part of module: COMBASE.DLL)\n Found string \"RoGetActivationFactory\" (Source: 76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe, API is part of module: COMBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".data\" has very low entropy (0.05)\n indicating potential NOP sled\n Section \".didat\" has very low entropy (0.05)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\" has section name fothk with entropy \"7.86740319721624\"\n \"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\" has section name .rsrc with entropy \"7.999397702655271\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\OQIVZA\\app.zip\" has high entropy 7.99841","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Drops compressed file on the system","description":"\"app.zip\" has type \"Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Jun 12 2026 17:54:32 uncompressed size 978944 method=deflate\"","origin":"Binary File","mitre_attack_id":"T1027.015","relevance":1,"id":"binary-84","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/27 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\" writes archive file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\OQIVZA\\app.zip\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops archive files","description":"\"app.zip\" has type \"Zip archive data made by v2.0 UNIX extract using at least v2.0 last modified Jun 12 2026 17:54:32 uncompressed size 978944 method=deflate\"- Location: [%TEMP%\\OQIVZA\\app.zip]- [targetUID: 00000000-00002736]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-43","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"UnhandledExceptionFilter\n GetModuleHandleW\n TerminateProcess\n Sleep\n GetTickCount","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe\" has a section named \"fothk\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]}],"intel_graph":{"map":{"File:3ed63a4053e66f5635ce356460207a7311295d3c2f9b63497e73dda04dac005e":{"type":"File","value":"3ed63a4053e66f5635ce356460207a7311295d3c2f9b63497e73dda04dac005e","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"},"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727":{"type":"File","value":"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]},"filetype":"PE32+ executable (GUI) x86-64, for MS Windows, 8 sections","filetype_short":"PE64","mime_type":"application/x-dosexec"},"File:ee710c2430567c7740026a3b4772c1c22516196285a58f976b91e2f6ae5dfab3":{"type":"File","value":"ee710c2430567c7740026a3b4772c1c22516196285a58f976b91e2f6ae5dfab3"}},"chains":[{"id":"1559146686857607201","root":"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","edges":[],"verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]}},{"id":"1559146686824052768","root":"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","to_key":"File:3ed63a4053e66f5635ce356460207a7311295d3c2f9b63497e73dda04dac005e"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","edges":[{"edge_kind":"extracted","from_key":"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","to_key":"File:3ed63a4053e66f5635ce356460207a7311295d3c2f9b63497e73dda04dac005e"},{"edge_kind":"extracted","from_key":"File:76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","to_key":"File:ee710c2430567c7740026a3b4772c1c22516196285a58f976b91e2f6ae5dfab3"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":24,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["windows-server-utility"],"sample_flags":["Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6accb27eb6ad1112810c90ee","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":41,"malware_family":"Trojan.Heur","submit_name":"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe","analysis_start_time":"2026-10-12T10:12:15+00:00","indicators_count":{"informative":56,"suspicious":10,"malicious":0},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}],"processes":[{"pid":2736,"ppid":0,"name":"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe","command_line":"","sha256":"76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727","normalized_path":"C:\\76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727.exe","uid":"00000000-00002736","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="},{"pid":4476,"ppid":2736,"name":"WerFault.exe","command_line":"-u -p 2736 -s 392","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00002736","uid":"00000000-00004476"},{"pid":5696,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 2736 -ip 2736","sha256":"0b7f2ca998ecf2a623e04f565354a09091e0a35c8442d7d9b6812b64b9121bc2","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00005696","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKUlEQVR4Xu2WS08TYRSGu+qdYql/QZfEvyVqVYq9ACJewPsFF01YmfR3iFoZ5Y5a66WKmvgzujmec775ZoZz+NJZYEoCkzxp08X7vO+ZTROJk+fYP41aBRq1qSFRgYT+8fDxPO/AT4IL9Pv9oXD0CrRaLWg2mwx9t7+fe/EXTj//g/yG0hLy7BeyB6WnxE8Ye4I8/gFjj4geFB/2YHx5b2CuKuCitETCUMrCQNoLpMUH36B4P0TmSOIXOHDldxQSvvDeVzhF3P3CjC52VY5EFXCdyi41Kx3SRZQufDbcIToDc1UBF+FprdBKuxEhcruDfILCLeTmR5UjiV0gXNk1LHQjwg4LR1mKzH+AkRvErsqRqAKuU8nTFiIrmUCKzO3CyPUdZlCuKuAiulRJSTi3w+Rnt322ID+zpXIksQsEQqQQSO3SbZZZctObkGsg9Q2VI1EFXKeKLs2TkFZaKQs3DCjN1dYhW11jpFCiCrigpfas+Wm70hey1Aiz1feQvYZMvWNkjiR2AVq5bymttFIS+mQqHmQmiVVG5khUAdcryNWNMFhqpbgyUyF86dVVSF95a7jcVkKJKuDCSjP+aQMhS63QSNPlN5C6RLxWOZL4BUjsS9O0MpC2IYXCdLnNQubiK0hdQCZWVI5EFXC9Aj6tkLKYhVa6AskJ4iUkzxukUKIKuDg7v25WlvevTLI0FEY5M+OpHEnsAv+Lo1GgXh3e3/J6FQucPMf++QdaW1M4YcDGqAAAAABJRU5ErkJggg=="}],"all_imported_dlls":["msvcrt.dll","ws2_32.dll","vcruntime140.dll","advapi32.dll","ole32.dll","combase.dll","fltLib.dll","imm32.dll","shlwapi.dll","sechost.dll","KernelBase.dll","ucrtbase.dll","rpcrt4.dll","user32.dll","gdi32.dll","gdi32full.dll","kernel32.dll","VxSSL64.dll","win32u.dll","msvcp_win.dll","msvcp140.dll","vcruntime140_1.dll","oleaut32.dll","ntdll.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"3ed63a4053e66f5635ce356460207a7311295d3c2f9b63497e73dda04dac005e","sha256":"3ed63a4053e66f5635ce356460207a7311295d3c2f9b63497e73dda04dac005e","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"app.zip","sha256":"ee710c2430567c7740026a3b4772c1c22516196285a58f976b91e2f6ae5dfab3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]}],"files_written":[{"path":"%TEMP%\\OQIVZA\\app.zip","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"name":"Local\\SM0:2736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]},{"name":"SM0:2736:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6accb27eb6ad1112810c90ee"}]}]}},"report_ids":{"sandbox_job_ids":["6accb27eb6ad1112810c90ee"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious VHO_Backdoor_Win32_Agent_gen Sample 76813f218da4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 76813f218da4…. Malware family: VHO_Backdoor_Win32_Agent_gen. Threat score 100/100. 2/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727"}],["$","meta","4",{"property":"og:title","content":"Malicious VHO_Backdoor_Win32_Agent_gen Sample 76813f218da4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 76813f218da4…. Malware family: VHO_Backdoor_Win32_Agent_gen. Threat score 100/100. 2/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/76813f218da40285358e43a39a17d2e2bde45953106fced074fc6a1c3ccb4727"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious VHO_Backdoor_Win32_Agent_gen Sample 76813f218da4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 76813f218da4…. Malware family: VHO_Backdoor_Win32_Agent_gen. Threat score 100/100. 2/28 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]