21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 81a0ecf7ebec… — Score 96/100 — Hybrid Analysis","description":"Malicious verdict for sample 81a0ecf7ebec…. Malware family: Trojan.Generic. Threat score 96/100. 16/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85"],"about":{"@type":"SoftwareApplication","name":"hc7.exe.bin","applicationCategory":["peexe","executable"],"identifier":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85","additionalType":"Malicious sample"},"threatScore":96,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T471,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\Crypto.Hash.SHA256.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\Microsoft.VC90.CRT.manifest" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\_hashlib.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\bz2.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\hc9.exe.manifest" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\msvcm90.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\msvcp90.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\msvcr90.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\python27.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\pywintypes27.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\select.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI33962\win32api.pyd"23:T555,"msvcp90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "msvcr90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "pywintypes27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "msvcm90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "python27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "win32api.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "select.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "Microsoft.VC90.CRT.manifest" has type "XML 1.0 document ASCII text with CRLF line terminators" "Crypto.Hash.SHA256.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "hc9.exe.manifest" has type "XML 1.0 document ASCII text with CRLF line terminators" "Crypto.Cipher.AES.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "unicodedata.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "bz2.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "_hashlib.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed"24:T461,"msvcp90.dll" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "msvcr90.dll" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "pywintypes27.dll" was detected as "ACProtect v1.3x - v1.4x DLL -> Risco Software Inc." "python27.dll" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "win32api.pyd" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "select.pyd" was detected as "ACProtect v1.3x - v1.4x DLL -> Risco Software Inc." "Crypto.Hash.SHA256.pyd" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "Crypto.Cipher.AES.pyd" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "unicodedata.pyd" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "bz2.pyd" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser" "_hashlib.pyd" was detected as "UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser"25:T49e,"msvcp90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "msvcr90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "pywintypes27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "msvcm90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "python27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "win32api.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "select.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "Crypto.Hash.SHA256.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "Crypto.Cipher.AES.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "unicodedata.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "bz2.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "_hashlib.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed"26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZmZmd3d3d3d3d3d3d3dgBGYBMzMwRmZnd3d3d3d3YARnO7u7swAAAAAARmZnd2AEe7u7u7uwAAAAB3AAAGdgBHu7u7u7swAAAAD3AABnYAY7u7u7u7MAAAAAf3AAZkAGO7u7u7uzAAAAAAfwAGZABju7u7u7swAAAAAIgABmQAY7u7u7u7MAAAAH9wAAZgAGO7u7u7u7u7sAB3AAAGYABju7u7u7uzO7AAAAAABmAAY7u7u7u7sAOwAAAAAAZgBGO7u7u7u7M7sAAAAABGYARzu7u7u7u7uzAAAAAARmAEc7u7u7u7uzMAAAAAAGZgBnO7u7u7EAAAAAAAAABmQAZzu7u7uwAAAAAAAAAAZkAEY7u7u7sAAAAAAAAAAGZAAAO7u7u7AAAAAAAAAABmAAADu7u7szAEREAAAAAAZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZmZmd3d3d3d3d3d3d3dgBGYBMzMwRmZnd3d3d3d3YARnO7u7swAAAAAARmZnd2AEe7u7u7uwAAAAB3AAAGdgBHu7u7u7swAAAAD3AABnYAY7u7u7u7MAAAAAf3AAZkAGO7u7u7uzAAAAAAfwAGZABju7u7u7swAAAAAIgABmQAY7u7u7u7MAAAAH9wAAZgAGO7u7u7u7u7sAB3AAAGYABju7u7u7uzO7AAAAAABmAAY7u7u7u7sAOwAAAAAAZgBGO7u7u7u7M7sAAAAABGYARzu7u7u7u7uzAAAAAARmAEc7u7u7u7uzMAAAAAAGZgBnO7u7u7EAAAAAAAAABmQAZzu7u7uwAAAAAAAAAAZkAEY7u7u7sAAAAAAAAAAGZAAAO7u7u7AAAAAAAAAABmAAADu7u7szAEREAAAAAAZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":96,"unified_at_epoch_ms":1790360676004,"unified_at":"2026-09-25T18:24:36.004Z","metadata":{"hashes":{"sha256":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85","sha1":"ec2ddc2f992945715666d0d039baf07bca4c5753","md5":"d7a8a80c8c30378a5f460989e0f50dc3","sha512":"9d1a44bfaffaddfa6cc534d516df85e9237dfdec976d020a12bb932663fb21fd8887e78252fcda2171003e033d226422828852e85ca03fab32b2a149acc4782d","ssdeep":"49152:JTHML3tayOFhpvrnq3Y0O6OooDKU1+V5MDexWepFC83JnxpICoca+w6DW1+i6Uz0:RML3tayIhBrqoRerU1+XMETZ8es+i/MJ","ssdeep_chunks":["49152:JTHML3t","49152:THML3ta","49152:HML3tay","49152:ML3tayO","49152:L3tayOF","49152:3tayOFh","49152:tayOFhp","49152:ayOFhpv","49152:yOFhpvr","49152:OFhpvrn","49152:Fhpvrnq","49152:hpvrnq3","49152:pvrnq3Y","49152:vrnq3Y0","49152:rnq3Y0O","49152:nq3Y0O6","49152:q3Y0O6O","49152:3Y0O6Oo","49152:Y0O6Ooo","49152:0O6OooD","49152:O6OooDK","49152:6OooDKU","49152:OooDKU1","49152:ooDKU1+","49152:oDKU1+V","49152:DKU1+V5","49152:KU1+V5M","49152:U1+V5MD","49152:1+V5MDe","49152:+V5MDex","49152:V5MDexW","49152:5MDexWe","49152:MDexWep","49152:DexWepF","49152:exWepFC","49152:xWepFC8","49152:WepFC83","49152:epFC83J","49152:pFC83Jn","49152:FC83Jnx","49152:C83Jnxp","49152:83JnxpI","49152:3JnxpIC","49152:JnxpICo","49152:nxpICoc","49152:xpICoca","49152:pICoca+","49152:ICoca+w","49152:Coca+w6","49152:oca+w6D","49152:ca+w6DW","49152:a+w6DW1","49152:+w6DW1+","49152:w6DW1+i","49152:6DW1+i6","49152:DW1+i6U","49152:W1+i6Uz","49152:1+i6Uz0","98304:JTHML3t","98304:THML3ta","98304:HML3tay","98304:ML3tayO","98304:L3tayOF","98304:3tayOFh","98304:tayOFhp","98304:ayOFhpv","98304:yOFhpvr","98304:OFhpvrn","98304:Fhpvrnq","98304:hpvrnq3","98304:pvrnq3Y","98304:vrnq3Y0","98304:rnq3Y0O","98304:nq3Y0O6","98304:q3Y0O6O","98304:3Y0O6Oo","98304:Y0O6Ooo","98304:0O6OooD","98304:O6OooDK","98304:6OooDKU","98304:OooDKU1","98304:ooDKU1+","98304:oDKU1+V","98304:DKU1+V5","98304:KU1+V5M","98304:U1+V5MD","98304:1+V5MDe","98304:+V5MDex","98304:V5MDexW","98304:5MDexWe","98304:MDexWep","98304:DexWepF","98304:exWepFC","98304:xWepFC8","98304:WepFC83","98304:epFC83J","98304:pFC83Jn","98304:FC83Jnx","98304:C83Jnxp","98304:83JnxpI","98304:3JnxpIC","98304:JnxpICo","98304:nxpICoc","98304:xpICoca","98304:pICoca+","98304:ICoca+w","98304:Coca+w6","98304:oca+w6D","98304:ca+w6DW","98304:a+w6DW1","98304:+w6DW1+","98304:w6DW1+i","98304:6DW1+i6","98304:DW1+i6U","98304:W1+i6Uz","98304:1+i6Uz0","49152:RML3tay","49152:ML3tayI","49152:L3tayIh","49152:3tayIhB","49152:tayIhBr","49152:ayIhBrq","49152:yIhBrqo","49152:IhBrqoR","49152:hBrqoRe","49152:BrqoRer","49152:rqoRerU","49152:qoRerU1","49152:oRerU1+","49152:RerU1+X","49152:erU1+XM","49152:rU1+XME","49152:U1+XMET","49152:1+XMETZ","49152:+XMETZ8","49152:XMETZ8e","49152:METZ8es","49152:ETZ8es+","49152:TZ8es+i","49152:Z8es+i/","49152:8es+i/M","49152:es+i/MJ"],"imphash":"4e3e7ce958acceeb80e70eeb7d75870e"},"file_info":{"file_name":"hc7.exe.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2733006,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1512085895000,"last_seen":1678609317000,"last_multi_scan":1678609317000}},"detections":{"summary":{"verdict":"malicious","score":96,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":11,"malicious_count":4,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Tiggre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Ransom.rtyrb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12646690","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.12646690 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051f40f1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Python.Agent.m","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Trojan.em","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.evomgz","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-EUB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_HCSIX.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_HCSIX.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanRansom.Python","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 54650-361-00409A60\n SetUnhandledExceptionFilter@KERNEL32.dll at 54650-7-00401500\n SetUnhandledExceptionFilter@KERNEL32.dll at 62058-616-7841F415","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 62058-1233-78413925","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"msvcm90.i386.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$22","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"msvcm90.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"\" (UID: 00015185-00002896) was launched with new environment variables: \"_MEIPASS2=\"%TEMP%\\_MEI33962\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015185-00002896)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$23","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\tzres.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"std.locale.name\"\n Heuristic match: \"std.codecvt.in\"\n Heuristic match: \"std.codecvt.in\"\n Heuristic match: \"std.codecvt.in\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"$24","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rsrc\n UPX1\n UPX1\n UPX1 with unusual entropies 7.00107076884\n 7.29703979729\n 7.97856068811\n 7.99794071415\n 7.94937363258","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"msvcp90.dll\" has a section named \"UPX0\"\n \"msvcp90.dll\" has a section named \"UPX1\"\n \"msvcr90.dll\" has a section named \"UPX0\"\n \"msvcr90.dll\" has a section named \"UPX1\"\n \"pywintypes27.dll\" has a section named \"UPX0\"\n \"pywintypes27.dll\" has a section named \"UPX1\"\n \"python27.dll\" has a section named \"UPX0\"\n \"python27.dll\" has a section named \"UPX1\"\n \"win32api.pyd\" has a section named \"UPX0\"\n \"win32api.pyd\" has a section named \"UPX1\"\n \"select.pyd\" has a section named \"UPX0\"\n \"select.pyd\" has a section named \"UPX1\"\n \"select.pyd\" has a section named \"UPX2\"\n \"Crypto.Hash.SHA256.pyd\" has a section named \"UPX0\"\n \"Crypto.Hash.SHA256.pyd\" has a section named \"UPX1\"\n \"Crypto.Cipher.AES.pyd\" has a section named \"UPX0\"\n \"Crypto.Cipher.AES.pyd\" has a section named \"UPX1\"\n \"unicodedata.pyd\" has a section named \"UPX0\"\n \"unicodedata.pyd\" has a section named \"UPX1\"\n \"unicodedata.pyd\" has a section named \"UPX2\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe\", Handle: 36)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$25","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe.bin\" claimed CRC 156538 while the actual is CRC 2781471\n \"msvcm90.dll\" claimed CRC 233090 while the actual is CRC 74603","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"msvcp90.dll\" has an entrypoint in section \"UPX1\"\n \"msvcr90.dll\" has an entrypoint in section \"UPX1\"\n \"pywintypes27.dll\" has an entrypoint in section \"UPX1\"\n \"python27.dll\" has an entrypoint in section \"UPX1\"\n \"win32api.pyd\" has an entrypoint in section \"UPX1\"\n \"select.pyd\" has an entrypoint in section \"UPX1\"\n \"Crypto.Hash.SHA256.pyd\" has an entrypoint in section \"UPX1\"\n \"Crypto.Cipher.AES.pyd\" has an entrypoint in section \"UPX1\"\n \"unicodedata.pyd\" has an entrypoint in section \"UPX1\"\n \"bz2.pyd\" has an entrypoint in section \"UPX1\"\n \"_hashlib.pyd\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetProcAddress\n GetModuleHandleA\n GetTempPathW\n TerminateProcess\n CreateProcessW\n Sleep\n VirtualAlloc\n IsDebuggerPresent\n CreateThread\n ExitThread\n GetModuleHandleW\n RegCloseKey\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053be775858bf77186abf77653cc0770000000000bf5e760000000056cc5e76000000007cca5e76000000003768f3756a2cc077d62dc077000000002069f3750000000029a65e7600000000a48df37500000000f70e5e7600000000\" to virtual address \"0x76051000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/66 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/67 Antivirus vendors marked dropped file \"msvcr90.dll\" as malicious (classified as \"Unsafe.AI_Score_96%\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"4/66 Antivirus vendors marked spawned process \"\" (PID: 2896) as malicious (classified as \"Heuristic\" with 6% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe\" (Handle: 36)\n \"\" wrote 52 bytes to a remote process \"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe\" (Handle: 36)\n \"\" wrote 4 bytes to a remote process \"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe\" (Handle: 36)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":30,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5a2098717ca3e12b481a3b26","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"Heuristic","submit_name":"hc7.exe.bin","analysis_start_time":"2017-12-01T00:43:45+00:00","indicators_count":{"informative":12,"suspicious":13,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}],"processes":[{"pid":3396,"ppid":0,"name":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe","command_line":"","sha256":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85","normalized_path":"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe","uid":"00015073-00003396","icon":"$26"},{"pid":2896,"ppid":3396,"name":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe","command_line":"","sha256":"81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85","normalized_path":"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe","parent_uid":"00015073-00003396","uid":"00015185-00002896","icon":"$27"}],"all_imported_dlls":["python27.dll","msvcr90.dll","shell32.dll","shlwapi.dll","gdi32.dll","sspicli.dll","KernelBase.dll","msvcrt.dll","rpcrt4.dll","msctf.dll","rsaenh.dll","oleaut32.dll","version.dll","ntdll.dll","ws2_32.dll","nsi.dll","tzres.dll","cryptsp.dll","cryptbase.dll","kernel32.dll","apphelp.dll","sechost.dll","usp10.dll","user32.dll","lpk.dll","pywintypes27.dll","secur32.dll","advapi32.dll","imm32.dll","ole32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"msvcr90.dll","sha256":"f6087e65017515d7b2e18b686345457bec5810c2c6ca76e524384b452b2d24f6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"msvcm90.dll","sha256":"307b04e884db79da88b167fbf5fb6f8b2fe9fa7eb13f77dfa09340a63dc60abc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"Microsoft.VC90.CRT.manifest","sha256":"d977b5510a9fe05b7e6200d8da42dc0089176a601851f26705b5852a2644c07f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"bz2.pyd","sha256":"051fd387f0a1a6f5b21851e838046b654afd6752fd1694970cf7cc09fb0888cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"hc9.exe.manifest","sha256":"51bd5cd1fc4f3a889d46b97786534de81de961522b789864f31b3f596779c3c1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"msvcp90.dll","sha256":"ef15924746259414e32ebcdb6b45748b0b4a7bb8f59893abdf0edd51cd50945e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"python27.dll","sha256":"224840b10f47fdb038efd66702ed2081bebdbb282e6743130b56187381e78b02","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"select.pyd","sha256":"604821f111d2d658e6bc53c9c8cdc6b76b6fc176c44856ac0083848c26ec2bd7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"unicodedata.pyd","sha256":"3e7518f21daef120c90c5f33ffa0dbccd4430753bb9d597d0f05788bbea240ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"Crypto.Cipher.AES.pyd","sha256":"3e3023a7d52c52dd85813bbbb57ca8b0fbb49144ba1620af6559fbd3b934f1b3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"Crypto.Hash.SHA256.pyd","sha256":"535c90e3743576bb4117ee9f12e5a2ff370350862c5f6142eb937cae0bd048cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"_hashlib.pyd","sha256":"102bb01176ee8d8cc3c2188bd74f96063efb47d05cb3fc2b0260fea8962fae4d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"pywintypes27.dll","sha256":"2ae1dddcbf8dd550fe99f021ab223a94dd5b77b3828d63af05d7dc16f80d896a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"name":"win32api.pyd","sha256":"ab665086260183ba99aa1c82cb9e5ab594aa51e45cc1f70990e33d378f6cfa93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]}],"files_written":[{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\ctypes.py","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\ctypes.pyw","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%TEMP%\\_MEI33~1\\ctypes.pyc","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"C:\\81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85.exe","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]},{"path":"C:\\81A0EC~1.EXE","sources":[{"report_type":"sandbox","report_id":"5a2098717ca3e12b481a3b26"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a2098717ca3e12b481a3b26"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 81a0ecf7ebec… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 81a0ecf7ebec…. Malware family: Trojan.Generic. Threat score 96/100. 16/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 81a0ecf7ebec… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 81a0ecf7ebec…. Malware family: Trojan.Generic. Threat score 96/100. 16/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/81a0ecf7ebec8f86d8042e3a3dbd756f6b8992c6cf3b4f94a9026d0192153b85"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 81a0ecf7ebec… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 81a0ecf7ebec…. Malware family: Trojan.Generic. Threat score 96/100. 16/28 AV engines flagged this file. 4 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]