26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T481,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7abf401381b8… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 7abf401381b8…. Malware family: Trojan.Generic. Threat score 85/100. 26/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d"],"about":{"@type":"SoftwareApplication","name":"Fax.exe","applicationCategory":["peexe","executable"],"identifier":"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":26,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T105a,"m5b1e9gv5MI8Zirbl4i3h14XjpeFagdcx47psrePQneI5c7mZG+Od3fXhYvV3n/X54Lne9xM9OHNYWbpf4Wc18WGGQUWFcYZBQYZhHLsRZYaFdYaHvTFlhTKFaYVPzTqEMUu4yhYW9TmJmKSnZ0QKmTgz7oVgpFpcpThZkKRaQKf9/XoSF2ExOLhaJlE4I+vtfLVaFhUpMKU4+vc59hYVO2q0M+71YDNnOvdQpKVhDNk4uXvr7vYVO1Cn/q0VOIE7SNkp2Kf+2Yy6F2Gl2Jk92T+AmT05w5ftflSLGwA7h5XF2ueZOVoVOAuu9YBspKTpGwL1bTno6wGflTl/haOUWF63lTne91ikpKUwpTkw4afsXOXVZT05jS8h2sxeFAkzmTlW3gikpD5fnTl2zGE5De09D0k5DjhZ54Sn/9045TlpMLk5wEbzAktOFRIVOD7tMD4N15bXIi05Jzh2jKVRRTANOF2gpoHboEykKVKtOSeUPJs5QKX6qdnUJTAFPaoDnTikpaL1aoSkpDtqUFylU789Uqk7l+xeVIjoVgcpghU4XQa1ptU9hTkwpDPuQWK1oTpFiKoXYra1pBLNONcrPzLUhzkC7TvoCMhHl+pXGTsBo5WRDVrT66LVPz099vYfOGyJORYZjdvNMxb2eTEZOY052X/ThTDhorU5pFZBpFaFpFU5kaRWXDPuXWMYM+2TOT6FYQ0x3ZkPj4U4yr097+18Ou8AC6w+xzmwWTgnlFpC7ZgIhzkwpORWhnGVOS2ZCKU1OWmFORHZ3zmARu7Oh/rGNRm4TaCn/sM5LTGsOaRaQvLNfj0ECRI1OSOtKSJVM0SJGWTrGj2q8XxfjToWFrUwpra1D7n2tQ+ORjkRZThxeKf+KZA9ukHahTikCzuFoTDh1TIVORL1RwikpzU5d8aGWKSm3u0ay/qWO3qFYaAxI2U9KDtCQabOhKWL/9I8Tj8eRTkwiOgZM0VlPBL26zsvlRHvPOpEPPCnWkX9u1IXYvZyOCfpgGglZj0xDj" (Indicator: "qemu") "GYa1gnSW5syAXfaOMv94HA/bOzC5f0HtpN3RLXXX+pWBA4J/8Kj/370BxhzfY2fDZOnFNO6IhsXNXC5eW5xExMcvTSQkzVlrqG7YfR4L+8XHfQ4NZrC0bzdUSbQ8HDcw7tvsV+rkTn3WGf9JwmbMC2PgQaGme7j6uHWrUrid6lNfY8H/QKzemQCTRlQ2hlLN0OSEu/vGE1Or1aSB1YR9OyKEcIojBykpaIhSVX4OlYtnc/utasMKVgh0QCOXyL2AHS0ckAAPi0sQutYlLITJMd1jdz08aIqY3tIJhkgBkW4325f9CIoCju9AAcpAZyFcvpTqeMLKA1ikv+H9eJ+N04mHq4bDDxcmSI/SXy4LgRy3fQata4C4EQnUTyT1D4c4T3J8VJrmFrEe+R9M1I8YHJhlCzJttg1tpXfgzXG4QSlDFXrn8KxoskC1CvUsj/6kdXnB3RxohZsWWv5TUkvkxZ4PQZ/2y7hLpozUI8BABdYnwWJfOgC07nnUSN6MHtc/izvsW9rjDnUfqR9Dxwzz22HcJxgVvj8DTQ9+RxkRNmjpiHXSef3qu0CMvF63RUPaPVw56kMjGY7VhgkaFWNIE7evHY7e6YqzlDC4TFD+N1gNACyDvRfVbLss9uu42lHtn/gN125uVboX/fABRzdqR67NxTGNEeuseJwW67J6VPUO+AxtiuoJcB4kMoxL/Y9LY2nMk7swtL2tBOzSF6RB35n5JVc2wNM6HKHGBPJ1/RfOlbeLhWn7+0RkQ3MLbFAJyuh/IAbA3noa3sqAIH48C2+gKD2c6tNTTMps3Xjwa2+SKIhjIw0Ze6n/hlGVkA+nyBFozZLJExOrl05R3rl0yomD+xnwoESmR+3/RPltl3fCxjFv0CijV3h3ebPEHFqx6Yh/ZBL9IZh0Xx9IKFPSz4d4OPzm+9gPDUUlzmDKgtwuoZxY7LVKRvvUlLZOPh2Wm1e8fOvL0v4cn9NepcxXtxMXVSAIig1Dgxa/RSWfR3xuiKO4P68+WVhyDN18btX" (Indicator: "vbox") "svTStbFsihv4qfXeV3meiMJekfhT5Pz4z/3i1bKj6JCr0rr0tp+2SeVRU+DBCQQX5PLmjvTClq/38+TJRTbucCOU4pFmTls5AMUqOsNprexL5Npm9pvkz+T0uoTEzvVomUCPr7Vl8tVg6ennxkvSFlf0heRr3ujb0+BVhDrDZOTfr7vc+Jbp6tRuw2ik8p/7Y/93Y8Nv0/SzxC+18f4+x6E28FauFo72LlD9wSqnYmoQ6zzzTzrxy/OzVPjknlZNrZa6NdhBI/GEP+XZCDPwPfxsa92SAeLHGR2E5Qa772Jb9I+6F+RpVJDsBY4Wi9h95MQ4RYPlU1PkyjxB7Zvk9ml71gnk7h7mah324pDq29SW9Icdpe2TgCcE9ZXK29EveBTu9+In/v4c5faAK9pv9J3vC95I5Mdq7o3mi9Cc5Oni9+9LVdiUzY9+9iHpruTb/f+uIIui5Yr9u9W8y8WNfu5fveDDG+Til+GxXPnoxPEE55jk63jE6t545ODyVvHEy8Tt6+Tk67dwLHOft//iz5v0wTvTZuTx5V9Ma9bjuL7Re9l15itR5l706afmOu3XrWKnjeet7lZmm5b1e9gv5MI8Zirbl4i3h14XjpeFagdcx47psrePQneI5c7mZG+Od3fXhYvV3n/X54Lne9xM9OHNYWbpf4Wc18WGGQUWFcYZBQYZhHLsRZYaFdYaHvTFlhTKFaYVPzTqEMUu4yhYW9TmJmKSnZ0QKmTgz7oVgpFpcpThZkKRaQKf9/XoSF2ExOLhaJlE4I+vtfLVaFhUpMKU4+vc59hYVO2q0M+71YDNnOvdQpKVhDNk4uXvr7vYVO1Cn/q0VOIE7SNkp2Kf+2Yy6F2Gl2Jk92T+AmT05w5ftflSLGwA7h5XF2ueZOVoVOAuu9YBspKTpGwL1bTno6wGflTl/haOUWF63lTne91ikpKUwpTkw4afsXOXVZT05jS8h2sxeFAkzmTlW3gikpD5fnTl2zGE5De09D0k5DjhZ54Sn/9045TlpMLk5wE" (Indicator: "qemu") "skC1CvUsj/6kdXnB3RxohZsWWv5TUkvkxZ4PQZ/2y7hLpozUI8BABdYnwWJfOgC07nnUSN6MHtc/izvsW9rjDnUfqR9Dxwzz22HcJxgVvj8DTQ9+RxkRNmjpiHXSef3qu0CMvF63RUPaPVw56kMjGY7VhgkaFWNIE7evHY7e6YqzlDC4TFD+N1gNACyDvRfVbLss9uu42lHtn/gN125uVboX/fABRzdqR67NxTGNEeuseJwW67J6VPUO+AxtiuoJcB4kMoxL/Y9LY2nMk7swtL2tBOzSF6RB35n5JVc2wNM6HKHGBPJ1/RfOlbeLhWn7+0RkQ3MLbFAJyuh/IAbA3noa3sqAIH48C2+gKD2c6tNTTMps3Xjwa2+SKIhjIw0Ze6n/hlGVkA+nyBFozZLJExOrl05R3rl0yomD+xnwoESmR+3/RPltl3fCxjFv0CijV3h3ebPEHFqx6Yh/ZBL9IZh0Xx9IKFPSz4d4OPzm+9gPDUUlzmDKgtwuoZxY7LVKRvvUlLZOPh2Wm1e8fOvL0v4cn9NepcxXtxMXVSAIig1Dgxa/RSWfR3xuiKO4P68+WVhyDN18btXpMGdVKKRbLW2SbftPPImiyldxWz9iyLEnG5rs2N4/YTFpgXxWEKHZe3WKD0nMisLBe4KHgaMa01SPtEEKmJBrZ7LRG5ffOgdGSIs95UZ/AsRHwWbtl38FA0GKbNJI8ZZMKYjPYKT3GXCEbr1cV4Nix8PS9BjCx7mDTMhCiW3nC8ypAOR+2jxxxbkWsnSW012q38FH7NYgBTX6b706GucArgbsh6EPOsWcr1XLfWyCj3kqfHsXT30RJUzEUh7zQEWCfkOMbYnl38BXDmt5z/0rOwVQiDxCzTw9WdV0CufFQAfV+HbeFsoDO6C5qLquvrHkDMWIOKLIgMSXZkl3K2hiEBENbnQmz4xIIw30ot4q2v5Tlqu2vlCzU0GlFpwcVrIcJAh8Wq6hkzoQtsrEuPrdF8OdCDNKsXtTQZzfzXARSosiIUBwB17" (Indicator: "vbox")28:T4df,"svchost.exe" wrote bytes "70D98C77" to virtual address "0x75006080" "svchost.exe" wrote bytes "70460B7520150B75" to virtual address "0x767074E4" (part of module "SHELL32.DLL") "svchost.exe" wrote bytes "6046027400A702749084027480A60274D0460274E089027490390274E07E037460480274E0BE0274D0380274" to virtual address "0x748AE000" (part of module "DNSAPI.DLL") "svchost.exe" wrote bytes "80445277D0D85177" to virtual address "0x7541D094" (part of module "KERNELBASE.DLL") "svchost.exe" wrote bytes "9010D175700ED175F041D5754070D5755004D775C055D575A0ACCD7590D0CE75709FCD75E0F6D675" to virtual address "0x778261E0" (part of module "COMBASE.DLL") "svchost.exe" wrote bytes "5025227460252274" to virtual address "0x778261C0" (part of module "COMBASE.DLL") "svchost.exe" wrote bytes "B0393577" to virtual address "0x706A218C" (part of module "WINHTTP.DLL") "svchost.exe" wrote bytes "10F9517700EA517710B95177" to virtual address "0x7782610C" (part of module "COMBASE.DLL") "svchost.exe" wrote bytes "70D98C77" to virtual address "0x74F200D8" "svchost.exe" wrote bytes "207F3C76D0A8F47510BF09765005097650FC147680101476806F087680B6F47580B80476E0CF15762003FC75B0FB1476E0C7637690A3F475" to virtual address "0x7541D1E8" (part of module "KERNELBASE.DLL")29:T51b,"svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-3415856703-3035846784-2657674405-1001\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")2a:Tc64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAjgSURBVFhHtVdpUJXnFeZXO3Vaa9wNuAMuIK4h00wT04pA1Fgz2plMRk21rdofjVHBhdVMG5GOtRGlcBHRaowCDlVRQ0B2LyguqKhlsCIg+3L3feHpc74LqY6W65/CnDnv8n3v8zznnPf93uvjM8RfVNQOdHV1oqujA50d7R5rb0fHYLvTM9bd2YluPtfb043e7m700CvjXd0oKSnBUBg+c3/0E/z2DT9sGuGLtWMnYP2oCdjCtvTTl32EusRkPIxLRs2f9uFm4j7UxSShLi4JNfFf4vbeZNyN24+7iR67p1gy7u/dj/uxSbheXom+Pg1KSocg8ekb41E68y2UBSxARcBCFAcuRNW893Ar4mOUh0aicvoilC5kP+zXuPHuhyidthDqgLehDl+NG7SKsFWoDHhLsYqAUFzzZzswFNVTF+FyTjZu3bqJ/n73/yaxbuRYFAQuQhHBC/0XoHjqfNRGfwGrxQqbwYj6wxm4tulzOO12mDQa1KtOoPzNEBj0Gujb2tB6/QYuTQpBwbS5KPKfj2/95yn+6sR5JJCDr0+fJIF+uIXEq9LxyejxuOQfirxpc3CeL1+cPBd3SKCtTI3y322BvqUdZRu2QFf3CJdCw+F0OJBPQH1fLyojP8b56fORT8DzU+fiIt/PD5iHK9PoJ4Tgcm4OviEBh8PlIeF2oaS4+MWaWDViFLKnBiN3aghyptBPDEbVrnj03H2IZ+fy0VVTi6INm9H54BFOTwyCiwud8l8IU28vWmtuQ/3nAzjnF4LsycE4O4VrTJ7DteYgxzcYl8/lIJcknE6nQkDMRRLFJc+R+OinY3ByYgiypszCqSlBOOUXjMroBOg7OlF39CTOhIahcP0f0P3gIbLfXgw3FzvmG8R0aFGxKw5nw1Yq753g+/+ggFOKzcY34+bgyrlzOP/PPJSWleLylUu4pq5EJ3eMu5+RGCzMFcNHIY2qVb6zkOEXBNWEGSjbmYCGq+VQvTkT6ZNn4cK638PM/Hc9foLa42dwYtwMpqAPuRGrkTaJ7zAy6X6z6Gfj75NmQzUpGMfHz0bRxXwUFRQgPS0ViV/EY1fUdmyL2oZ0VRqetTRj8eLF8IkYPgJ/9ZuOIxNm4iuCfzUuAFkL3sOJiFVIZf+I7wxkBL2D3DUbkfmzpTg0JgApvoHIXbkOaSzaQySTwncPjZ/BdiAOjZ6OlDHTcch3JqoLC3FdXY0LjMLZ48eQmamCKiUFqWmHkX32NP742Vb4TPvBMEQOH42lw0cinNGIHDYav/zxSMVvnBWCpKXLkBT+AfZHLEdSmLTpw1dgH/0+ziVHck7mI5fRL8f+sOX4SzjHf7EM92tq0PysFQ/v1qHm+k2oK6+hpKgQ6tIKVKmrsHnT5qEPqW1bt6Kp4QnaWlrQ/LQZLY1P0cQ0tNI/48Id3CGtza1oqKjEzYMpaFJfR0drFzrbutDGGtLyEOpisXYzXe3tbWhpbUMT32tsfEJ7jB07tg9NYGd0tOd47enhidbrMU0vdDotenq70afVQMPaaFv/KRqOHkdr+lHojHoYjQbo9Abo9XoYjEb2zTCYLDCZzGyzz7aR7eioqKEJ7ImJg1arhVanU7yGSjQE9YzplXGDToOm1avRnJcPSytVE1Sn10IvcwLIw8xsNsFsscFktcJkMcFqtcDCdlxs3NAEdu3arYD1afqg0+oVRTod1ZGEnuO9HJexp7/ZgKeqTHQ8a4HWSDCDgcolEkaeqGaCW0jCDBuBhYyVfQtP2ri4eC8R2LOHaqhUjIr0DL1O28c+AQREzzGCPE5KRtPeL1GdmUXFBo9ikwlGAlkV9WaG30DlNtgGwCUK8d4I7CYBCaWeiiWUOqoz0EtbzzybTEaYmN+eUjXuvL8ELYfTqYzqqNZEE9VGs0e9jAuolaG32eywO+yIi/cSgd0xMdALINWYGDKTFJCBoaWZ2TcadJwzwtDHU9FnGDR3amEmMSvzLPmWkItiCblN+nYbrDQbP2x2h817BGJj9ih5NDGfSgULmChiX1QaRBnJWW02FI2diHvcBUazFVaO2Rhus4AOKHcQ0Gqz8mNm48fJCYfT4T0CsYyAFJCJeTQO5lWIkIQUkVJQJNH87XeoXrwEhYEL4GB4LQPKzSQh5Cw0O1XLR8lFYAe92+VCfELC0EUYwwiIQgEzKnmUSpb8UqGEVaqbKouWRKL3di0qVqzBgyMqjllgt1ngUEItwC7YndJ2wOlywul2k4ATiV4JxMbCTkALc2qTShZgLm6SNHBcgJrKylES+Svm3AI9T7o8/2A0XVMrObZTrZPALoI56D3KGQV+kuVu8FoELJLLgTwKiFSxkJIcS2S+C1uBTjUBpbI53ltfj5yZ8/Ag67gC6CCQ0+WgABvBHcqdwOmivQ6BWJ5UDoZSike2kLQlnzbF7Gjk7ebKh2tg58J25tTEdDVWV6Fk+x5k/HAcMvyDcCxwPi5/sh4F6zfiytoNOLNqLbob/o1+kkhMTBy6BmK5T+12Li5bh7mUtlSvVLGTPvvnS9FMwDupWbj62W4Ux+7Ffd4hG6ur0c/nWwrKkBexEmffiUD5wa+g7exgWmxoeVSvRCLBGwE5KBxSOASz0buYRwmn5Pfe19nI/WAFajNO8fjVKIXVz7BKvpW2XL+cbl7h3DDyi6j+WxpKonejYGccWmrvw9DW4T0CCgEuKAVjl0Ki8rb6BjRW3UJmSCh0/DHicnsumy4XK3sAmHcu5RasFBu9mFzN+zkuxJprbsHY9JQEvGzDhIR45oqKmN9+Ll6VnoHKVBUubPkcN3noyJby3HY9AMpzAkjgwUvo9x4ecKUIxfPfaw0kkKFcIJ1UV37gIMr3HcC9vIvIWrp8IMRMC0HlmUESg78BFLDnQF8ixHnvBBgB2UY27vvUdyPxr+IypMx/H0bedAaBBFxRrfz4+K9KmefEy5F4bswrAXlAFnHzRCs/dhLno3lB4VXLA/7y4nx4AFBpfU/A05S5F/1rEEh4hQLJ9+BCzwEOjr0q7ANkXojI69SA3NuF5f/LZP3/AH9Qe/N0KHtJAAAAAElFTkSuQmCC2b:Tc64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAjgSURBVFhHtVdpUJXnFeZXO3Vaa9wNuAMuIK4h00wT04pA1Fgz2plMRk21rdofjVHBhdVMG5GOtRGlcBHRaowCDlVRQ0B2LyguqKhlsCIg+3L3feHpc74LqY6W65/CnDnv8n3v8zznnPf93uvjM8RfVNQOdHV1oqujA50d7R5rb0fHYLvTM9bd2YluPtfb043e7m700CvjXd0oKSnBUBg+c3/0E/z2DT9sGuGLtWMnYP2oCdjCtvTTl32EusRkPIxLRs2f9uFm4j7UxSShLi4JNfFf4vbeZNyN24+7iR67p1gy7u/dj/uxSbheXom+Pg1KSocg8ekb41E68y2UBSxARcBCFAcuRNW893Ar4mOUh0aicvoilC5kP+zXuPHuhyidthDqgLehDl+NG7SKsFWoDHhLsYqAUFzzZzswFNVTF+FyTjZu3bqJ/n73/yaxbuRYFAQuQhHBC/0XoHjqfNRGfwGrxQqbwYj6wxm4tulzOO12mDQa1KtOoPzNEBj0Gujb2tB6/QYuTQpBwbS5KPKfj2/95yn+6sR5JJCDr0+fJIF+uIXEq9LxyejxuOQfirxpc3CeL1+cPBd3SKCtTI3y322BvqUdZRu2QFf3CJdCw+F0OJBPQH1fLyojP8b56fORT8DzU+fiIt/PD5iHK9PoJ4Tgcm4OviEBh8PlIeF2oaS4+MWaWDViFLKnBiN3aghyptBPDEbVrnj03H2IZ+fy0VVTi6INm9H54BFOTwyCiwud8l8IU28vWmtuQ/3nAzjnF4LsycE4O4VrTJ7DteYgxzcYl8/lIJcknE6nQkDMRRLFJc+R+OinY3ByYgiypszCqSlBOOUXjMroBOg7OlF39CTOhIahcP0f0P3gIbLfXgw3FzvmG8R0aFGxKw5nw1Yq753g+/+ggFOKzcY34+bgyrlzOP/PPJSWleLylUu4pq5EJ3eMu5+RGCzMFcNHIY2qVb6zkOEXBNWEGSjbmYCGq+VQvTkT6ZNn4cK638PM/Hc9foLa42dwYtwMpqAPuRGrkTaJ7zAy6X6z6Gfj75NmQzUpGMfHz0bRxXwUFRQgPS0ViV/EY1fUdmyL2oZ0VRqetTRj8eLF8IkYPgJ/9ZuOIxNm4iuCfzUuAFkL3sOJiFVIZf+I7wxkBL2D3DUbkfmzpTg0JgApvoHIXbkOaSzaQySTwncPjZ/BdiAOjZ6OlDHTcch3JqoLC3FdXY0LjMLZ48eQmamCKiUFqWmHkX32NP742Vb4TPvBMEQOH42lw0cinNGIHDYav/zxSMVvnBWCpKXLkBT+AfZHLEdSmLTpw1dgH/0+ziVHck7mI5fRL8f+sOX4SzjHf7EM92tq0PysFQ/v1qHm+k2oK6+hpKgQ6tIKVKmrsHnT5qEPqW1bt6Kp4QnaWlrQ/LQZLY1P0cQ0tNI/48Id3CGtza1oqKjEzYMpaFJfR0drFzrbutDGGtLyEOpisXYzXe3tbWhpbUMT32tsfEJ7jB07tg9NYGd0tOd47enhidbrMU0vdDotenq70afVQMPaaFv/KRqOHkdr+lHojHoYjQbo9Abo9XoYjEb2zTCYLDCZzGyzz7aR7eioqKEJ7ImJg1arhVanU7yGSjQE9YzplXGDToOm1avRnJcPSytVE1Sn10IvcwLIw8xsNsFsscFktcJkMcFqtcDCdlxs3NAEdu3arYD1afqg0+oVRTod1ZGEnuO9HJexp7/ZgKeqTHQ8a4HWSDCDgcolEkaeqGaCW0jCDBuBhYyVfQtP2ri4eC8R2LOHaqhUjIr0DL1O28c+AQREzzGCPE5KRtPeL1GdmUXFBo9ikwlGAlkV9WaG30DlNtgGwCUK8d4I7CYBCaWeiiWUOqoz0EtbzzybTEaYmN+eUjXuvL8ELYfTqYzqqNZEE9VGs0e9jAuolaG32eywO+yIi/cSgd0xMdALINWYGDKTFJCBoaWZ2TcadJwzwtDHU9FnGDR3amEmMSvzLPmWkItiCblN+nYbrDQbP2x2h817BGJj9ih5NDGfSgULmChiX1QaRBnJWW02FI2diHvcBUazFVaO2Rhus4AOKHcQ0Gqz8mNm48fJCYfT4T0CsYyAFJCJeTQO5lWIkIQUkVJQJNH87XeoXrwEhYEL4GB4LQPKzSQh5Cw0O1XLR8lFYAe92+VCfELC0EUYwwiIQgEzKnmUSpb8UqGEVaqbKouWRKL3di0qVqzBgyMqjllgt1ngUEItwC7YndJ2wOlywul2k4ATiV4JxMbCTkALc2qTShZgLm6SNHBcgJrKylES+Svm3AI9T7o8/2A0XVMrObZTrZPALoI56D3KGQV+kuVu8FoELJLLgTwKiFSxkJIcS2S+C1uBTjUBpbI53ltfj5yZ8/Ag67gC6CCQ0+WgABvBHcqdwOmivQ6BWJ5UDoZSike2kLQlnzbF7Gjk7ebKh2tg58J25tTEdDVWV6Fk+x5k/HAcMvyDcCxwPi5/sh4F6zfiytoNOLNqLbob/o1+kkhMTBy6BmK5T+12Li5bh7mUtlSvVLGTPvvnS9FMwDupWbj62W4Ux+7Ffd4hG6ur0c/nWwrKkBexEmffiUD5wa+g7exgWmxoeVSvRCLBGwE5KBxSOASz0buYRwmn5Pfe19nI/WAFajNO8fjVKIXVz7BKvpW2XL+cbl7h3DDyi6j+WxpKonejYGccWmrvw9DW4T0CCgEuKAVjl0Ki8rb6BjRW3UJmSCh0/DHicnsumy4XK3sAmHcu5RasFBu9mFzN+zkuxJprbsHY9JQEvGzDhIR45oqKmN9+Ll6VnoHKVBUubPkcN3noyJby3HY9AMpzAkjgwUvo9x4ecKUIxfPfaw0kkKFcIJ1UV37gIMr3HcC9vIvIWrp8IMRMC0HlmUESg78BFLDnQF8ixHnvBBgB2UY27vvUdyPxr+IypMx/H0bedAaBBFxRrfz4+K9KmefEy5F4bswrAXlAFnHzRCs/dhLno3lB4VXLA/7y4nx4AFBpfU/A05S5F/1rEEh4hQLJ9+BCzwEOjr0q7ANkXojI69SA3NuF5f/LZP3/AH9Qe/N0KHtJAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790555975900,"unified_at":"2026-09-28T00:39:35.900Z","metadata":{"hashes":{"sha256":"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d","sha1":"b1680e9152896aea17f5e59bcd381c45acc08deb","md5":"71a42eaac6f432c8dc04465c065e48e1","sha512":"59c3fa49c88fe3e4016bbde3b19c5814318f906f5340d2028261aa45ea7c486283c4da6915dcb764b5cc9d354646b74eedab7646157566cc878d795ad761fd60","ssdeep":"3072:iJYD91unTvHBbm/+8h5Goj339Bi6VYV0g0/LbNUhQOFprxKq:GQ914vHBbm/eoTtIkYwLBUhQGr7","ssdeep_chunks":["3072:iJYD91u","3072:JYD91un","3072:YD91unT","3072:D91unTv","3072:91unTvH","3072:1unTvHB","3072:unTvHBb","3072:nTvHBbm","3072:TvHBbm/","3072:vHBbm/+","3072:HBbm/+8","3072:Bbm/+8h","3072:bm/+8h5","3072:m/+8h5G","3072:/+8h5Go","3072:+8h5Goj","3072:8h5Goj3","3072:h5Goj33","3072:5Goj339","3072:Goj339B","3072:oj339Bi","3072:j339Bi6","3072:339Bi6V","3072:39Bi6VY","3072:9Bi6VYV","3072:Bi6VYV0","3072:i6VYV0g","3072:6VYV0g0","3072:VYV0g0/","3072:YV0g0/L","3072:V0g0/Lb","3072:0g0/LbN","3072:g0/LbNU","3072:0/LbNUh","3072:/LbNUhQ","3072:LbNUhQO","3072:bNUhQOF","3072:NUhQOFp","3072:UhQOFpr","3072:hQOFprx","3072:QOFprxK","3072:OFprxKq","6144:iJYD91u","6144:JYD91un","6144:YD91unT","6144:D91unTv","6144:91unTvH","6144:1unTvHB","6144:unTvHBb","6144:nTvHBbm","6144:TvHBbm/","6144:vHBbm/+","6144:HBbm/+8","6144:Bbm/+8h","6144:bm/+8h5","6144:m/+8h5G","6144:/+8h5Go","6144:+8h5Goj","6144:8h5Goj3","6144:h5Goj33","6144:5Goj339","6144:Goj339B","6144:oj339Bi","6144:j339Bi6","6144:339Bi6V","6144:39Bi6VY","6144:9Bi6VYV","6144:Bi6VYV0","6144:i6VYV0g","6144:6VYV0g0","6144:VYV0g0/","6144:YV0g0/L","6144:V0g0/Lb","6144:0g0/LbN","6144:g0/LbNU","6144:0/LbNUh","6144:/LbNUhQ","6144:LbNUhQO","6144:bNUhQOF","6144:NUhQOFp","6144:UhQOFpr","6144:hQOFprx","6144:QOFprxK","6144:OFprxKq","3072:GQ914vH","3072:Q914vHB","3072:914vHBb","3072:14vHBbm","3072:4vHBbm/","3072:vHBbm/e","3072:HBbm/eo","3072:Bbm/eoT","3072:bm/eoTt","3072:m/eoTtI","3072:/eoTtIk","3072:eoTtIkY","3072:oTtIkYw","3072:TtIkYwL","3072:tIkYwLB","3072:IkYwLBU","3072:kYwLBUh","3072:YwLBUhQ","3072:wLBUhQG","3072:LBUhQGr","3072:BUhQGr7"],"imphash":"595cc1e9ae32629bd692cf803cc7794d"},"file_info":{"file_name":"Fax.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":128732,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1523005788000,"last_seen":1677371761000,"last_multi_scan":1677371761000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":26,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":19,"malicious_count":12,"total":39},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.kYLC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.MDA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.Zbot.K","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2523374","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-1313169","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Criakl.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.KGED-4418","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2523374 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Agent.BEL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 004ba21e1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Spy.Win32.Agent.cwjr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.wv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MlwGen.efhejx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DwnLdr-MQO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2523390","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_RUCKGUV.X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_RUCKGUV.X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject2.CKQX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.552179","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"559126a10e316d2909a6d131"},{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 69315 does not match actual CRC 165211","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"559126a10e316d2909a6d131"},{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LockResource","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"559126a10e316d2909a6d131"},{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/55 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"559126a10e316d2909a6d131"},{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"audileon.com.mx\"\n \"google.com\"\n \"stun.noc.ams-ix.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.60.139.27:80\"\n \"209.133.57.138:80\"\n \"209.133.57.113:80\"\n \"69.73.179.87:80\"\n \"74.125.225.7:80\"\n \"77.234.235.48:443\"\n \"85.192.165.229:443\"\n \"184.24.34.145:80\"\n \"31.42.170.118:443\"\n \"184.29.222.95:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"svchost.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /css/proxy_v29.exe HTTP/1.1\nAccept: */*\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.3; Trident/7.0; .NET4.0E; .NET4.0C; .NET CLR 3.5.30729; .NET CLR 2.0.50727; .NET CLR 3.0.30729)\nHost: audileon.com.mx\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 75680000\n \"\" loaded module \"USER32.DLL\" at base 77510000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"proxy_v29[1].exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"csrss_2.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"WVTYHnjwAdOPQYW.exe\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceW@ADVAPI32.DLL at 00346343-00000652-41279-30-004029B0\n OpenServiceW@ADVAPI32.DLL at 00346343-00000652-45025-30-004029B0\n OpenServiceW@ADVAPI32.DLL at 00352828-00003552-52867-30-004029B0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"csrss_2.exe\" queried SystemProcessInformation at 00346343-00000652-778BA1F0-348985","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00276250-00003884-15096-49-00401290\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00276250-00003884-18626-51-00401290","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00276250-00003884-15096-5-004073C0\n GetProcessHeap@KERNEL32.DLL at 00276250-00003884-15096-4-004073F0\n GetProcessHeap@KERNEL32.DLL at 00276250-00003884-18626-4-004073C0\n GetProcessHeap@KERNEL32.DLL at 00276250-00003884-18626-24-004073F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$27","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LockResource@KERNEL32.DLL at 00276250-00003884-15096-49-00401290\n LockResource@KERNEL32.DLL at 00276250-00003884-18626-51-00401290\n FindResourceW@KERNEL32.DLL at 00346343-00000652-41279-10-004014C0\n FindResourceW@KERNEL32.DLL at 00346343-00000652-45025-10-004014C0\n FindResourceW@KERNEL32.DLL at 00352828-00003552-52867-10-004014C0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"proxy_v29[1].exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"csrss_2.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting a value in the registry","description":"\"svchost.exe\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"nhqvyrba.pbz.zk/pff/cebkl_i29.rkr\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00346343-00000652-41279-8-00402AE0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00346343-00000652-45025-8-00402AE0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00352828-00003552-52867-8-00402AE0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\"csrss_2.exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"svchost.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$29","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 71 instructions to foreign process \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (UID: 00330203-00003836)\n Wrote 172 instructions to foreign process \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (UID: 00330203-00003836)\n Wrote 322 instructions to foreign process \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (UID: 00330203-00003836)\n Wrote 24 instructions to foreign process \"csrss_2.exe\" (UID: 00346343-00000652)\n Wrote 42 instructions to foreign process \"csrss_2.exe\" (UID: 00346343-00000652)\n Wrote 73 instructions to foreign process \"csrss_2.exe\" (UID: 00346343-00000652)\n Wrote 33 instructions to foreign process \"csrss_2.exe\" (UID: 00346343-00000652)\n Wrote 72 instructions to foreign process \"csrss_2.exe\" (UID: 00346343-00000652)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"4/56 Antivirus vendors marked dropped file \"csrss_2.exe\" as malicious (classified as \"HW32.Packed\" with 7% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00004704 bytes of memory in \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (Protection: \"read/write\")\n \"\" allocated 00012288 bytes of memory in \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (Protection: \"execute/read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 4704 bytes to a foreign process \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (PID: 00003836)\n \"\" wrote 4 bytes to a foreign process \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (PID: 00003836)\n \"\" wrote 12288 bytes to a foreign process \"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d\" (PID: 00003836)\n \"\" wrote 4704 bytes to a foreign process \"svchost.exe\" (PID: 00003404)\n \"\" wrote 4 bytes to a foreign process \"svchost.exe\" (PID: 00003404)\n \"csrss_2.exe\" wrote 4704 bytes to a foreign process \"csrss_2.exe\" (PID: 00000652)\n \"csrss_2.exe\" wrote 4 bytes to a foreign process \"csrss_2.exe\" (PID: 00000652)\n \"csrss_2.exe\" wrote 1024 bytes to a foreign process \"csrss_2.exe\" (PID: 00000652)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 20 (or more) hosts in at least 7 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"173.194.46.68\" (ASN: 15169, Owner: Google Inc.): ...\nURL: http://goo.gl/5V7oU (AV positives: 1/50 scanned on 11/09/2013 11:26:55)\n URL: http://goo.gl/7EfwL (AV positives: 1/50 scanned on 11/09/2013 11:26:35)\n URL: http://goo.gl/TyZL8 (AV positives: 1/50 scanned on 11/09/2013 11:22:26)\n URL: http://goo.gl/uSIa0 (AV positives: 1/50 scanned on 11/07/2013 09:42:04)\n URL: http://goo.gl/A4o63 (AV positives: 1/50 scanned on 11/05/2013 21:48:06)\n File SHA256: dfd4d61f827bf844b782b60d133fe293eefe4c0c1d901687c223c1a098e11f5b (AV positives: 11/49 scanned on 09/18/2013 21:23:25)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"\"TCP traffic to 107.161.199.58 on port 4443, \"TCP traffic to 37.57.76.44 on port 4443\n \"TCP traffic to 208.123.129.153 on port 4443, \"TCP traffic to 212.37.81.96 on port 4443","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\", Value: \"01000000\")\n \"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-3415856703-3035846784-2657674405-1001\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":8,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00276250-00003884)\n Spawned process \"\" (UID: 00330203-00003836)\n Spawned process \"svchost.exe\" (UID: 00332750-00003404)\n Spawned process \"csrss_2.exe\" (UID: 00343562-00004000)\n Spawned process \"csrss_2.exe\" (UID: 00346343-00000652)\n Spawned process \"WVTYHnjwAdOPQYW.exe\" with commandline \"C:\\Users\\Payload\\AppData\\Roaming\\csrss_2.exe\" (UID: 00350875-00003080)\n Spawned process \"WVTYHnjwAdOPQYW.exe\" with commandline \"C:\\Users\\Payload\\AppData\\Roaming\\csrss_2.exe\" (UID: 00352828-00003552)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"csrss_14.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"csrss_14.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"csrss_14.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \"csrss_14.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"csrss_14.exe\" wrote 512 bytes starting with PE header signature to file \"C:\\Windows\\pWUpFcElwaXoXIM.exe\": 4d5a80000100000004001000ffff000040010000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":95,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":10,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":39,"dns_resolutions_count":4,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Sample Crashed","Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"55918f400e316d527b692b74","environment_id":3,"environment_description":"Windows 8.1 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":85,"malware_family":"Artemis","contacted_countries":["AND","GBR","GTM","NLD","POL","RUS","SVK","UKR","USA"],"submit_name":"payslip.exe","analysis_start_time":"2015-06-29T13:32:45+00:00","indicators_count":{"informative":7,"suspicious":17,"malicious":13},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"55912f050e316d9f59e84e18","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"malicious","threat_score":79,"malware_family":"Luhe.Fiha","contacted_countries":["AND","POL","RUS","SRB","SVK","UKR","USA"],"submit_name":"Fax.exe","analysis_start_time":"2015-06-29T06:42:10+00:00","indicators_count":{"informative":5,"suspicious":14,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"559126a10e316d2909a6d131","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":9,"malware_family":"Luhe.Fiha","submit_name":"Fax.exe","analysis_start_time":"2015-06-29T06:06:21+00:00","indicators_count":{"informative":0,"suspicious":3,"malicious":1},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.60.139.27","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"209.133.57.138","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"209.133.57.113","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"69.73.179.87","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"74.125.225.7","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"91.200.16.56","port":3478,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"91.200.16.37","port":3479,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"77.234.235.48","port":443,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"85.192.165.229","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"184.24.34.145","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"31.42.170.118","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"184.29.222.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"176.103.203.166","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"181.189.152.131","port":443,"protocol":"TCP","country":"Guatemala","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"107.161.199.58","port":4443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"185.47.89.141","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"91.240.97.141","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"173.194.46.68","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"176.120.201.9","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"194.28.191.213","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"37.57.76.44","port":4443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"38.124.169.148","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"address":"208.123.129.153","port":4443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"84.16.55.122","port":443,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"91.187.75.75","port":443,"protocol":"TCP","country":"Andorra","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"212.37.81.96","port":4443,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"178.54.231.147","port":443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"176.197.100.182","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"74.125.134.127","port":19302,"protocol":"UDP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"67.219.166.113","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"209.193.83.218","port":4443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"67.206.96.30","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"67.207.228.144","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"178.219.10.23","port":443,"protocol":"TCP","country":"Serbia","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"194.28.190.84","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"83.168.164.18","port":443,"protocol":"TCP","country":"Slovakia (SLOVAK Republic)","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"75.98.158.55","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"67.206.97.238","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"address":"31.134.73.151","port":4443,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]}],"dns_resolutions":[{"domain":"google.com","address":"173.194.46.70","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"domain":"audileon.com.mx","address":"69.73.179.87","country":"United States","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"domain":"stun.noc.ams-ix.net","address":"91.200.16.56","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"domain":"stun2.l.google.com","address":"74.125.134.127","country":"United States","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]}],"http_requests":[{"host":"audileon.com.mx","host_ip":"69.73.179.87:80","url":"/css/proxy_v29.exe","method":"GET","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}],"processes":[{"pid":1256,"ppid":0,"name":"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d","command_line":"","normalized_path":"","uid":"00036691-00001256","icon":"$2a"},{"pid":3936,"ppid":0,"name":"7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d","command_line":"","normalized_path":"","uid":"00040349-00003936"},{"pid":2104,"ppid":0,"name":"svchost.exe","command_line":"","normalized_path":"","uid":"00040942-00002104"},{"pid":1432,"ppid":0,"name":"csrss_14.exe","command_line":"","normalized_path":"","uid":"00042388-00001432"},{"pid":3500,"ppid":0,"name":"csrss_14.exe","command_line":"","normalized_path":"","uid":"00043018-00003500"},{"pid":152,"ppid":0,"name":"pWUpFcElwaXoXIM.exe","command_line":"C:\\Users\\PSPUBWS\\AppData\\Roaming\\csrss_14.exe","normalized_path":"","uid":"00044380-00000152"},{"pid":2176,"ppid":0,"name":"pWUpFcElwaXoXIM.exe","command_line":"C:\\Users\\PSPUBWS\\AppData\\Roaming\\csrss_14.exe","normalized_path":"","uid":"00044971-00002176"},{"pid":632,"ppid":0,"name":"svchost.exe","command_line":"-k DcomLaunch","normalized_path":"","uid":"00045613-00000632","icon":"$2b"}],"all_imported_dlls":["Secur32.dll","IPHLPAPI.DLL","apphelp.dll","ntdll.dll","DNSAPI.dll","SHCORE.dll","crypt32.dll","WS2_32.dll","rasadhlp.dll","IMM32.DLL","combase.dll","winhttp.dll","CFGMGR32.dll","VERSION.dll","shell32.dll","OLEAUT32.dll","mswsock.dll","fwpuclnt.dll","SHLWAPI.dll","GDI32.dll","SspiCli.dll","msvcrt.dll","Urlmon.dll","Comctl32.dll","PSAPI.DLL","KERNELBASE.dll","ADVAPI32.dll","USER32.dll","uxtheme.dll","ondemandconnroutehelper.dll","sechost.dll","MSCTF.dll","SETUPAPI.dll","RPCRT4.dll","KERNEL32.DLL","iertutil.dll","msasn1.dll","sxs.dll","KernelBase.dll","Wldap32.dll","mscoreei.dll","kernel32.dll","user32.dll","usp10.dll","oleaut32.dll","samcli.dll","dhcpcsvc.dll","gdi32.dll","imm32.dll","comctl32.dll","rasman.dll","netapi32.dll","secur32.dll","cryptbase.dll","webio.dll","mscoree.dll","version.dll","sspicli.dll","ntmarta.dll","dnsapi.dll","rtutils.dll","WSHTCPIP.DLL","lpk.dll","SensApi.dll","normaliz.dll","pnrpnsp.dll","wkscli.dll","bcryptprimitives.dll","cryptnet.dll","ws2_32.dll","dwmapi.dll","profapi.dll","nsi.dll","nlaapi.dll","FWPUCLNT.DLL","ncrypt.dll","dhcpcsvc6.dll","msctf.dll","wininet.dll","netutils.dll","schannel.dll","rpcrt4.dll","rasapi32.dll","wship6.dll","clbcatq.dll","urlmon.dll","ole32.dll","winrnr.dll","bcrypt.dll","advapi32.dll","shlwapi.dll","winnsi.dll","NapiNSP.dll","cabinet.dll","srvcli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"csrss_2.exe","sha256":"e9fa4ad461668ef8b4855b79885c7eaaa73988e1838a094f734951922e6dc49c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"name":"proxy_v29[1].exe","sha256":"713a2df0f98449c600308f7675e722a3ea2dc94980d9510aadaad975f3f9284a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"},{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"WVTYHnjwAdOPQYW.exe","sha256":"61933aadab06cdc736a0c8395e0285ead4d89b114cfedc683472e8675c0ee1cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"name":"csrss_14.exe","sha256":"e9fa4ad461668ef8b4855b79885c7eaaa73988e1838a094f734951922e6dc49c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"pWUpFcElwaXoXIM.exe","sha256":"e9fa4ad461668ef8b4855b79885c7eaaa73988e1838a094f734951922e6dc49c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"Tar1C2E.tmp","sha256":"0c9b1e81dda3771f6e8ac8fa37d5593c4119f0d2abd8dffa505ce5b5c99ae07a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"Cab1C2D.tmp","sha256":"f444e8fe5d00c53f6dbad900a83bc86fec2e12f6732fe69e55390a1d0655c1de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"system@91.187.75[1].txt","sha256":"97f7e8d949b83f4aabdaf83ab7955abe9dab5e5294382ebecf4ba026b4c080de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"81807833c0344b6e3cbaaed1cdc28c005dbe85b83573af434605f08ae3528a08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]},{"name":"ea1bw72e0f4.dll","sha256":"f7e3c0f64d1ffbfcce15db3d1ee4d192335511472899c9304994edd9a8b0c748","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55912f050e316d9f59e84e18"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\counters.dat","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"C:\\Users\\Payload","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%WINDIR%\\System32\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%WINDIR%\\system32\\en-US\\mswsock.dll.mui","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\O9C7JOLM\\proxy_v29[1].exe","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%APPDATA%\\csrss_2.exe","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"path":"%WINDIR%\\WVTYHnjwAdOPQYW.exe","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\ONDEMANDINTERFACECACHE\\","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\DOWNLOADMANAGER\\","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55918f400e316d527b692b74"}]}]}},"report_ids":{"sandbox_job_ids":["55918f400e316d527b692b74","55912f050e316d9f59e84e18","559126a10e316d2909a6d131"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 7abf401381b8… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 7abf401381b8…. Malware family: Trojan.Generic. Threat score 85/100. 26/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 7abf401381b8… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 7abf401381b8…. Malware family: Trojan.Generic. Threat score 85/100. 26/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/7abf401381b81d0effcf074df3fe1d38b38cf513f8ec202fbe1ce150c45c6f8d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 7abf401381b8… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 7abf401381b8…. Malware family: Trojan.Generic. Threat score 85/100. 26/28 AV engines flagged this file. 12 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]