24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 828b94047b39… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample 828b94047b39…. Malware family: Win/malicious_confidence_90%. Threat score 87/100. 4/27 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9"],"about":{"@type":"SoftwareApplication","name":"828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T66f,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "VirtualAllocEx"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "WriteProcessMemory"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp")26:T40f,Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "ResumeThread"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "SetThreadContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "GetThreadContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin")27:T6fc,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp")28:T541,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp")29:T5699,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersoxygenReservecommunicationvalvePositionsemiMajorAxisSYSTEMS_CHECKHOLD_SEQUENCEMISSION_ABORTstabilizationsecondaryTankemergencyTankabortSequenceSTRONG_SIGNALCOMMUNICATIONProcessorLoadgeostationaryundervelocityPayloadDeployNORTH_EAST_UPCommunicationstatus_updateencryptionKeynegative fluxapogee_targetmemory_blocksStarlightBetaFUEL_PRESSUREOXIDIZER_FLOWtotal_rocketsSELF_DESTRUCTsafety_statusdata_analysisunknown_phaseThrusterArrayTransmission_LaunchAbortedpower_systemssuperpositionguidanceFaultprocessed_gpssystem_statusorbital_decaylaunch_windowlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waits" (Indicator: "CertOpenStore"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "ailureliquidHydrogenabort_sequencefile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CertCloseStore"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "ailureliquidHydrogenabort_sequencefile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #userArenaStateGC (dedicated)read mem statsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= nil elem type! to finalizer GC worker initruntime: full=runtime: want=MB; allocated RtlGetVersion" (Indicator: "CryptGenRandom"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "active)stopping the worldwait until GC endsbad lfnode addresssystem page size ( but memory size because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupsecondaryTrajectoryfuelPressureOptimalcommunicationLinkedconfigErrorDetectedALPHA-BRAVO-CHARLIEargumentOfPeriapsiscommunicationStatussimulated_emergencySYSTEM_RESET_NEEDEDTerminationProtocolHIGH_EFFICIENCY_MIXsuccess_probabilitynavigation_accuracySystem check failedGPS-Galileo-GLONASSazimuth_calibrationorbital_inclinationINSUFFICIENT THRUSTnetwork_connectionsFUEL_SYSTEM_NOMINALpressure_adjustmentsequence_validationEmergencySeparationMissionAccomplisheddata_center_controlsatellite_positionsbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentP" (Indicator: "CryptReleaseContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiontrajectoryCalibratedguidanceSystemActiveguidance_malfunctionstructural_integritycompressionAlgorithmnavigationParametersINITIALIZATION_PHASEMEMORY_LEAK_DETECTEDSTRUCTURAL_INTEGRITYQUANTUM_BOOST_ACTIVEtrajectory_deviationmaintenance_requiredtrajectory deviationfrequency dissonanceMission accomplishedcommunication_statusrocket_launch_secureinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workb" (Indicator: "CertOpenSystemStoreW"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiontrajectoryCalibratedguidanceSystemActiveguidance_malfunctionstructural_integritycompressionAlgorithmnavigationParametersINITIALIZATION_PHASEMEMORY_LEAK_DETECTEDSTRUCTURAL_INTEGRITYQUANTUM_BOOST_ACTIVEtrajectory_deviationmaintenance_requiredtrajectory deviationfrequency dissonanceMission accomplishedcommunication_statusrocket_launch_secureinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=workb" (Indicator: "CryptAcquireContextW"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "non-Go function at pc=exit hook invoked exitDEEP_SPACE_ARRAY_ACTIVEcommunication_stabilityLaunch sequence anomalyLaunch sequence nominalCRITICAL SYSTEM FAILUREORBITAL_INSERTION_READYPerformanceOptimizationSECONDARY_SYSTEM_ACTIVEMAIN_ENGINE_FULL_THRUSTRETRO_THRUSTERS_ENGAGEDATTITUDE_CONTROL_SYSTEMdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during p" (Indicator: "CertGetCertificateChain"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "reemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicDATA_VERIFICATION_FAILEDQUATERNARY_SYSTEM_ACTIVEconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStartbad use of trace.s" (Indicator: "CertFreeCertificateChain"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "STAGE_SEPARATION_CONFIRMEDORBITAL_INSERTION_COMPLETEinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad sp" (Indicator: "CertFreeCertificateContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin"), Found api reference "an s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryCOMMUNICATIONS_VERIFICATIONInvalid trajectory detectedchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin"), Found api reference "unlock: lock countprogToPointerMask: overflowfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for Safety protocols compromisedCountdown aborted at stage 2file descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workcomparing uncomparable type runtime: bad lfnode address region exceeds uintptr rangegcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free" (Indicator: "CertCreateCertificateContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin"), Found api reference "ed between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeQUANTUM_ENTANGLEMENT_ESTABLISHEDresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of" (Indicator: "CertAddCertificateContextToStore"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "ed between runtime: impossible type kind unsafe.Slice: len out of rangesync: inconsistent mutex statesync: unlock of unlocked mutexGODEBUG: unknown cpu feature "reflect: Elem of invalid type cannot assign requested address.lib section in a.out corruptedslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pagespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeQUANTUM_ENTANGLEMENT_ESTABLISHEDresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyslice bounds out of range [::%x]slice bounds out of" (Indicator: "CertVerifyCertificateChainPolicy"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timersoxygenReservecommunicationvalvePositionsemiMajorAxisSYSTEMS_CHECKHOLD_SEQUENCEMISSION_ABORTstabilizationsecondaryTankemergencyTankabortSequenceSTRONG_SIGNALCOMMUNICATIONProcessorLoadgeostationaryundervelocityPayloadDeployNORTH_EAST_UPCommunicationstatus_updateencryptionKeynegative fluxapogee_targetmemory_blocksStarlightBetaFUEL_PRESSUREOXIDIZER_FLOWtotal_rocketsSELF_DESTRUCTsafety_statusdata_analysisunknown_phaseThrusterArrayTransmission_LaunchAbortedpower_systemssuperpositionguidanceFaultprocessed_gpssystem_statusorbital_decaylaunch_windowlevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep wait" (Indicator: "CertOpenStore"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin"), Found api reference "active)stopping the worldwait until GC endsbad lfnode addresssystem page size ( but memory size because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to threadruntime.semacreateruntime.semawakeupsecondaryTrajectoryfuelPressureOptimalcommunicationLinkedconfigErrorDetectedALPHA-BRAVO-CHARLIEargumentOfPeriapsiscommunicationStatussimulated_emergencySYSTEM_RESET_NEEDEDTerminationProtocolHIGH_EFFICIENCY_MIXsuccess_probabilitynavigation_accuracySystem check failedGPS-Galileo-GLONASSazimuth_calibrationorbital_inclinationINSUFFICIENT THRUSTnetwork_connectionsFUEL_SYSTEM_NOMINALpressure_adjustmentsequence_validationEmergencySeparationMissionAccomplisheddata_center_controlsatellite_positionsbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrent" (Indicator: "CryptReleaseContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiontrajectoryCalibratedguidanceSystemActiveguidance_malfunctionstructural_integritycompressionAlgorithmnavigationParametersINITIALIZATION_PHASEMEMORY_LEAK_DETECTEDSTRUCTURAL_INTEGRITYQUANTUM_BOOST_ACTIVEtrajectory_deviationmaintenance_requiredtrajectory deviationfrequency dissonanceMission accomplishedcommunication_statusrocket_launch_secureinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=work" (Indicator: "CertOpenSystemStoreW"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptiontrajectoryCalibratedguidanceSystemActiveguidance_malfunctionstructural_integritycompressionAlgorithmnavigationParametersINITIALIZATION_PHASEMEMORY_LEAK_DETECTEDSTRUCTURAL_INTEGRITYQUANTUM_BOOST_ACTIVEtrajectory_deviationmaintenance_requiredtrajectory deviationfrequency dissonanceMission accomplishedcommunication_statusrocket_launch_secureinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cacheschan send (synctest)close of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated spanp mcache not flushed markroot jobs donepacer: assist ratio=work" (Indicator: "CryptAcquireContextW"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "non-Go function at pc=exit hook invoked exitDEEP_SPACE_ARRAY_ACTIVEcommunication_stabilityLaunch sequence anomalyLaunch sequence nominalCRITICAL SYSTEM FAILUREORBITAL_INSERTION_READYPerformanceOptimizationSECONDARY_SYSTEM_ACTIVEMAIN_ENGINE_FULL_THRUSTRETRO_THRUSTERS_ENGAGEDATTITUDE_CONTROL_SYSTEMdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)runtimecontentionstackschan receive (nil chan)garbage collection scanchan receive (synctest)makechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelemsmissing type in runfinqruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during" (Indicator: "CertGetCertificateChain"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "reemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall" missing CPU supportexit hook invoked panicDATA_VERIFICATION_FAILEDQUATERNARY_SYSTEM_ACTIVEconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of queuefinalizer during GCupdate during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlapsstack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowunexpected syncgroup setdouble traceGCSweepStartbad use of trace." (Indicator: "CertFreeCertificateChain"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of remaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStartGODEBUG: can not enable "STAGE_SEPARATION_CONFIRMEDORBITAL_INSERTION_COMPLETEinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0negative idle mark workersuse of invalid sweepLockerruntime: bad s" (Indicator: "CertFreeCertificateContext"; File: "828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin"), Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp 00000000-00004508.00000000.282426.F4740000.00000004.mdmp")2a:Tae6,Found XOR loop in file "sample.bin" at offset 81712; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 375212; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 525017; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1178268; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2017965; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2041377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2051820; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2267619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3166984; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3424596; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 564489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1869754; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 164118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203559; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 312382; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 357368; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 383365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 384061; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 384702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 516107; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 516129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 516151; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 516164; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 757547; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 757569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 757591; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 757604; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1491140; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1561328; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3091289; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3324308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3328048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3332288; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3395072; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3438536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3768336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3826808; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3836348; code bytes = 80302b:T4c6,Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004508.00000000.282426.F46A0000.00000004.mdmp, 00000000-00004508.00000000.282426.F4740000.00000004.mdmp")2c:T9f2," tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\SysWOW64\\explorer.exe\" launched with commandline \"\" (UID: 00000000-00007612)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET DROP Spamhaus DROP Listed Traffic Inbound group 5\" (SID: 2400004, Rev: 4580, Severity: 2) categorized as \"Misc Attack\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST /124d0720183846ba.php HTTP/1.1\nContent-Type: application/json\nHost: 45.93.20.34\nContent-Length: 136\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload::==> \"x9pReyeQ0ou5MWgu6PchRPrEvtfnVZEbwyYQnePFyP81yOZceQ8Q/pGIvZpJCdEdNNjzydApsYeA1gqeiVzMiftL+yhUjFH6cfGc8eEX9b0x9qpF2/n9sLff2RoudYbL+52TERdP\" HTTP/1.1 200 OK\nDate: Fri\n 30 Jan 2026 01:18:16 GMT\nServer: Apache/2.4.58 (Ubuntu)\nVary: Accept-Encoding\nContent-Length: 76\nKeep-Alive: timeout=5\n max=100\nConnection: Keep-Alive\nContent-Type: text/html; charset=UTF-8 with response body ==>782F4A46626A445578746974625441752B503567414C79592B384731464D394A68544550702F4747304C787A6C624D5A50304A61766479743649354C486F4243.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\" x9pReyeQ0ou5MWgu6PchRPrEvtfnVZEbwyYQnePFyP81yOZceQ8Q/pGIvZpJCdEdNNjzydApsYeA1gqeiVzMiftL+yhUjFH6cfGc.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-67","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 45.93.20.34 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"%WINDIR%\\SysWOW64\\explorer.exe\" connects to 45.93.20.34 on port 80 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetSystemInfo\n GetThreadContext\n LoadLibraryW\n VirtualAlloc\n CreateThread\n GetSystemDirectoryA\n WriteFile\n GetProcAddress\n LoadLibraryExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"828b94047b39ea988ffa79770cc3f288e0099df2774123e17d9c1c1b18ad1cb9.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"697c06b99ef43e3de9003c89"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"