34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3c:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 8303c9a36f74… — Score 96/100 — Hybrid Analysis","description":"Malicious verdict for sample 8303c9a36f74…. Malware family: Win/malicious_confidence_60%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2"],"about":{"@type":"SoftwareApplication","name":"pycrackme.exe","applicationCategory":["peexe","executable"],"identifier":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2","additionalType":"Malicious sample"},"threatScore":96,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T832,"" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42845689 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42846013 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42847453 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42848128 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42848552 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42848955 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42849331 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42849841 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42850217 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42850736 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42851147 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42851712 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42852094 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42852798 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42853201 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42853783 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42854463 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42855742 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-42856292 "" queries volume information of "C:\8303C9~1.EXE" at 00015251-00002204-0000010C-4285671137:T467,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\Microsoft.VC90.CRT.manifest" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\_hashlib.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\_socket.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\_ssl.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\black_box.exe.manifest" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\bz2.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\msvcm90.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\msvcp90.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\msvcr90.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\python27.dll" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\select.pyd" "" created file "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\unicodedata.pyd"38:T47d,"msvcm90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows" "msvcp90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "python27.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "msvcr90.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "_ssl.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "black_box.exe.manifest" has type "XML 1.0 document ASCII text with CRLF line terminators" "bz2.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "unicodedata.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "Microsoft.VC90.CRT.manifest" has type "XML 1.0 document ASCII text with CRLF line terminators" "select.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "_socket.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed" "_hashlib.pyd" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed"39:T7f7,"C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\black_box.exe.manifest" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\bz2.pyd" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\Microsoft.VC90.CRT.manifest" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\msvcm90.dll" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\msvcp90.dll" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\msvcr90.dll" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\python27.dll" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\select.pyd" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\unicodedata.pyd" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\_hashlib.pyd" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\_socket.pyd" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362\_ssl.pyd" for deletion "C:\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe" marked "C:\Users\%OSUSER%\AppData\Local\Temp\_MEI18362" for deletion3a:T553,"" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\black_box.exe.manifest" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\bz2.pyd" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\Microsoft.VC90.CRT.manifest" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\msvcm90.dll" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\msvcp90.dll" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\msvcr90.dll" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\python27.dll" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\select.pyd" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\unicodedata.pyd" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\_hashlib.pyd" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\_socket.pyd" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362\_ssl.pyd" with delete access "" opened "C:\Users\GXAGMng\AppData\Local\Temp\_MEI18362" with delete access3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAZmZniId3dwAAAAAAAAAARmZmaIiIiIiIiIh2ZERAAEZmZmiIiIiIiIiId3d3ZABGZmZoiIiIiIiIiHd3d3YARmZmeIiIiIiIiIh3d3d0AGZmZniIiIiIiIiId3d3dABmZmZ4iIiIiIiIiHd3d3QAZmZmeIiIiIiIiIh3d3dkAGZmZniIiIiIiIiId3d3YABmZmZ3d3d4iIiIiHd3d2AAZmZmd3d3d3d3d3d3d3dgBGYBMzMwRmZnd3d3d3d3YARnO7u7swAAAAAARmZnd2AEe7u7u7uwAAAAB3AAAGdgBHu7u7u7swAAAAD3AABnYAY7u7u7u7MAAAAAf3AAZkAGO7u7u7uzAAAAAAfwAGZABju7u7u7swAAAAAIgABmQAY7u7u7u7MAAAAH9wAAZgAGO7u7u7u7u7sAB3AAAGYABju7u7u7uzO7AAAAAABmAAY7u7u7u7sAOwAAAAAAZgBGO7u7u7u7M7sAAAAABGYARzu7u7u7u7uzAAAAAARmAEc7u7u7u7uzMAAAAAAGZgBnO7u7u7EAAAAAAAAABmQAZzu7u7uwAAAAAAAAAAZkAEY7u7u7sAAAAAAAAAAGZAAAO7u7u7AAAAAAAAAABmAAADu7u7szAEREAAAAAAZgAAADM7szMAAAAAAAAEREQADgAAAH4AAAB8AAAAHAAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAABwAAAAcAAAAGAAAABgAAAAYAAAAGAAAABgAAAAYAAAAGAAAABgAAAA4AAAAOAAAADgAAAAwAAAAMAAAADAAAAAwAAAAMAAAADAAAAA8AAAAfADAAH4B//Bw==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":96,"unified_at_epoch_ms":1794089516044,"unified_at":"2026-11-07T22:11:56.044Z","metadata":{"hashes":{"sha256":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2","sha1":"8fe58937a6bdb0f0f275420bd8094e3342b816c6","md5":"8ee7382cfdf632c29df5f2d9d3286614","sha512":"3c32d0a2dea2a328854282f8389b7e7663ddd2b4ad5eed9c0e167fe684cae11c9f16a1d74231ea17b9547662c47cc0cae6fa497d5edbc509ead93a6f5acf02a3","ssdeep":"49152:JTHMguQpZ48Y75eOCUmBzAFgX17/OFCADFEAwy36LwaK7tLAtyz9V4uTP+wD8Dc7:RMguQpW8YVezRBnFriFEAwy4QtAyzIuA","ssdeep_chunks":["49152:JTHMguQ","49152:THMguQp","49152:HMguQpZ","49152:MguQpZ4","49152:guQpZ48","49152:uQpZ48Y","49152:QpZ48Y7","49152:pZ48Y75","49152:Z48Y75e","49152:48Y75eO","49152:8Y75eOC","49152:Y75eOCU","49152:75eOCUm","49152:5eOCUmB","49152:eOCUmBz","49152:OCUmBzA","49152:CUmBzAF","49152:UmBzAFg","49152:mBzAFgX","49152:BzAFgX1","49152:zAFgX17","49152:AFgX17/","49152:FgX17/O","49152:gX17/OF","49152:X17/OFC","49152:17/OFCA","49152:7/OFCAD","49152:/OFCADF","49152:OFCADFE","49152:FCADFEA","49152:CADFEAw","49152:ADFEAwy","49152:DFEAwy3","49152:FEAwy36","49152:EAwy36L","49152:Awy36Lw","49152:wy36Lwa","49152:y36LwaK","49152:36LwaK7","49152:6LwaK7t","49152:LwaK7tL","49152:waK7tLA","49152:aK7tLAt","49152:K7tLAty","49152:7tLAtyz","49152:tLAtyz9","49152:LAtyz9V","49152:Atyz9V4","49152:tyz9V4u","49152:yz9V4uT","49152:z9V4uTP","49152:9V4uTP+","49152:V4uTP+w","49152:4uTP+wD","49152:uTP+wD8","49152:TP+wD8D","49152:P+wD8Dc","49152:+wD8Dc7","98304:JTHMguQ","98304:THMguQp","98304:HMguQpZ","98304:MguQpZ4","98304:guQpZ48","98304:uQpZ48Y","98304:QpZ48Y7","98304:pZ48Y75","98304:Z48Y75e","98304:48Y75eO","98304:8Y75eOC","98304:Y75eOCU","98304:75eOCUm","98304:5eOCUmB","98304:eOCUmBz","98304:OCUmBzA","98304:CUmBzAF","98304:UmBzAFg","98304:mBzAFgX","98304:BzAFgX1","98304:zAFgX17","98304:AFgX17/","98304:FgX17/O","98304:gX17/OF","98304:X17/OFC","98304:17/OFCA","98304:7/OFCAD","98304:/OFCADF","98304:OFCADFE","98304:FCADFEA","98304:CADFEAw","98304:ADFEAwy","98304:DFEAwy3","98304:FEAwy36","98304:EAwy36L","98304:Awy36Lw","98304:wy36Lwa","98304:y36LwaK","98304:36LwaK7","98304:6LwaK7t","98304:LwaK7tL","98304:waK7tLA","98304:aK7tLAt","98304:K7tLAty","98304:7tLAtyz","98304:tLAtyz9","98304:LAtyz9V","98304:Atyz9V4","98304:tyz9V4u","98304:yz9V4uT","98304:z9V4uTP","98304:9V4uTP+","98304:V4uTP+w","98304:4uTP+wD","98304:uTP+wD8","98304:TP+wD8D","98304:P+wD8Dc","98304:+wD8Dc7","49152:RMguQpW","49152:MguQpW8","49152:guQpW8Y","49152:uQpW8YV","49152:QpW8YVe","49152:pW8YVez","49152:W8YVezR","49152:8YVezRB","49152:YVezRBn","49152:VezRBnF","49152:ezRBnFr","49152:zRBnFri","49152:RBnFriF","49152:BnFriFE","49152:nFriFEA","49152:FriFEAw","49152:riFEAwy","49152:iFEAwy4","49152:FEAwy4Q","49152:EAwy4Qt","49152:Awy4QtA","49152:wy4QtAy","49152:y4QtAyz","49152:4QtAyzI","49152:QtAyzIu","49152:tAyzIuA"],"imphash":"4e3e7ce958acceeb80e70eeb7d75870e"},"file_info":{"file_name":"pycrackme.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2731948,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1517093119000,"last_seen":1662451136000,"last_multi_scan":1662451136000}},"detections":{"summary":{"verdict":"malicious","score":96,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":13,"malicious_count":4,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.Gen.S1670342","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_60%","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 36929-7-00401500\n SetUnhandledExceptionFilter@KERNEL32.dll at 36929-361-00409A60\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015094-00001836-40124-1-00401500\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015094-00001836-40124-115-00409A60\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015251-00002204-46628-1-00401500\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00015251-00002204-46628-110-00409A60\n SetUnhandledExceptionFilter@KERNEL32.dll at 54427-616-7841F415","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00015094-00001836-40124-2-004099B0\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00015251-00002204-46628-2-004099B0\n GetSystemTimeAsFileTime@KERNEL32.dll at 54427-1233-78413925","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$36","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"msvcm90.i386.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$37","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"msvcm90.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"), Antivirus vendors marked dropped file \"msvcp90.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"), Antivirus vendors marked dropped file \"python27.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"), Antivirus vendors marked dropped file \"msvcr90.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"), Antivirus vendors marked dropped file \"_ssl.pyd\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"), Antivirus vendors marked dropped file \"unicodedata.pyd\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"), Antivirus vendors marked dropped file \"_hashlib.pyd\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"\" (UID: 00015251-00002204) was launched with new environment variables: \"_MEIPASS2=\"%TEMP%\\_MEI18362\"\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00015251-00002204)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$38","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\System32\\tzres.dll\"\n \"\" touched file \"%WINDIR%\\System32\\en-US\\tzres.dll.mui\"\n \"\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"std.locale.name\"\n Heuristic match: \"std.codecvt.in\"\n Heuristic match: \"std.codecvt.in\"\n Heuristic match: \"std.codecvt.in\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"msvcp90.dll\" was detected as \"UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser\"\n \"python27.dll\" was detected as \"UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser\"\n \"msvcr90.dll\" was detected as \"UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser\"\n \"_ssl.pyd\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"bz2.pyd\" was detected as \"UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser\"\n \"unicodedata.pyd\" was detected as \"UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser\"\n \"select.pyd\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"_socket.pyd\" was detected as \"ACProtect v1.3x - v1.4x DLL -> Risco Software Inc.\"\n \"_hashlib.pyd\" was detected as \"UPX v3.0 (DLL_LZMA) -> Markus Oberhumer & Laszlo Molnar & John Reiser\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00015251-00002204-00000105-42869759","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .rsrc\n UPX1\n UPX1\n UPX1 with unusual entropies 7.00107076884\n 7.29703979729\n 7.98447746485\n 7.99966234557\n 7.99649645979","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"msvcp90.dll\" has a section named \"UPX0\"\n \"msvcp90.dll\" has a section named \"UPX1\"\n \"python27.dll\" has a section named \"UPX0\"\n \"python27.dll\" has a section named \"UPX1\"\n \"msvcr90.dll\" has a section named \"UPX0\"\n \"msvcr90.dll\" has a section named \"UPX1\"\n \"_ssl.pyd\" has a section named \"UPX0\"\n \"_ssl.pyd\" has a section named \"UPX1\"\n \"_ssl.pyd\" has a section named \"UPX2\"\n \"bz2.pyd\" has a section named \"UPX0\"\n \"bz2.pyd\" has a section named \"UPX1\"\n \"bz2.pyd\" has a section named \"UPX2\"\n \"unicodedata.pyd\" has a section named \"UPX0\"\n \"unicodedata.pyd\" has a section named \"UPX1\"\n \"unicodedata.pyd\" has a section named \"UPX2\"\n \"select.pyd\" has a section named \"UPX0\"\n \"select.pyd\" has a section named \"UPX1\"\n \"select.pyd\" has a section named \"UPX2\"\n \"_socket.pyd\" has a section named \"UPX0\"\n \"_socket.pyd\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"msvcm90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"\n \"msvcp90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"python27.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"msvcr90.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"_ssl.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"bz2.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"unicodedata.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"select.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"_socket.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"\n \"_hashlib.pyd\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows UPX compressed\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$39","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3a","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe.bin\" claimed CRC 156538 while the actual is CRC 2769471\n \"msvcp90.dll\" claimed CRC 0 while the actual is CRC 290153","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"msvcp90.dll\" has an entrypoint in section \"UPX1\"\n \"python27.dll\" has an entrypoint in section \"UPX1\"\n \"msvcr90.dll\" has an entrypoint in section \"UPX1\"\n \"_ssl.pyd\" has an entrypoint in section \"UPX1\"\n \"bz2.pyd\" has an entrypoint in section \"UPX1\"\n \"unicodedata.pyd\" has an entrypoint in section \"UPX1\"\n \"select.pyd\" has an entrypoint in section \"UPX1\"\n \"_socket.pyd\" has an entrypoint in section \"UPX1\"\n \"_hashlib.pyd\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleFileNameW\n GetTickCount\n VirtualProtect\n LoadLibraryA\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetProcAddress\n GetModuleHandleA\n GetTempPathW\n TerminateProcess\n CreateProcessW\n Sleep\n IsDebuggerPresent\n CreateThread\n ExitThread\n GetModuleHandleW\n ShellExecuteW\n send\n listen","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053ed765858ee76186aee76653cef760000000000bf36750000000056cc3675000000007cca36750000000037682a756a2cef76d62def760000000020692a750000000029a6367500000000a48d2a7500000000f70e367500000000\" to virtual address \"0x76FE1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/65 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/67 Antivirus vendors marked dropped file \"bz2.pyd\" as malicious (classified as \"PAK_Generic.005\" with 2% detection rate)\n 2/64 Antivirus vendors marked dropped file \"select.pyd\" as malicious (classified as \"PAK_Generic.005\" with 3% detection rate)\n 2/66 Antivirus vendors marked dropped file \"_socket.pyd\" as malicious (classified as \"Suspicious_GEN.F47V0730\" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"5/65 Antivirus vendors marked spawned process \"\" (PID: 2204) as malicious (classified as \"BehavesLike.TrojanVeil\" with 7% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"C:\\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe\" (Handle: 36)\n \"\" wrote 52 bytes to a remote process \"C:\\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe\" (Handle: 36)\n \"\" wrote 4 bytes to a remote process \"C:\\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe\" (Handle: 36)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":24,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5a6cff3e7ca3e13a341daff4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"BehavesLike.TrojanVeil","submit_name":"pycrackme.exe","analysis_start_time":"2018-01-27T23:37:10+00:00","indicators_count":{"informative":14,"suspicious":17,"malicious":4},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}],"processes":[{"pid":1836,"ppid":0,"name":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe","command_line":"","sha256":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2","normalized_path":"C:\\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe","uid":"00015094-00001836","icon":"$3b"},{"pid":2204,"ppid":1836,"name":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe","command_line":"","sha256":"8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2","normalized_path":"C:\\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe","parent_uid":"00015094-00001836","uid":"00015251-00002204"}],"all_imported_dlls":["msvcrt.dll","apphelp.dll","sechost.dll","gdi32.dll","rsaenh.dll","rpcrt4.dll","nsi.dll","advapi32.dll","msvcr90.dll","shell32.dll","user32.dll","usp10.dll","imm32.dll","kernel32.dll","tzres.dll","shlwapi.dll","lpk.dll","msctf.dll","cryptsp.dll","cryptbase.dll","ws2_32.dll","python27.dll","ntdll.dll","KernelBase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"bz2.pyd","sha256":"93290d4c26c5d41b86172acad0837ad7eac3d33fff5e961585bca136e9bb1c00","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"select.pyd","sha256":"d3e5cb5e2f5591abb9a6e124e7864a892b4c31b7cd7f98bb8364d400fa137674","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"_socket.pyd","sha256":"50a332a837957db7e9c0153bab47eabf667c3538ed8140201648ddbb026ec787","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"msvcm90.dll","sha256":"5bce3764a69e4c7d6806b53facd462c17b2706fce3df3ac8b13c123d7baabc36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"msvcp90.dll","sha256":"dbd402d6f2be0c6073c5a5ea8f93afd36d50eaa278c17c26f57519711caa44a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"msvcr90.dll","sha256":"9d71f5e1e05d916374d4a924a49668e2b8161017aa6ac44f96d05dfa5ca0b470","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"python27.dll","sha256":"cdee4f8069d3d2deb732cebb73e75aaa184c716197e3ab5f36b9e1c207e19299","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"unicodedata.pyd","sha256":"a2896e644176802550b8121b5f7f49e6c1b2eac037099ac2a5fd6acd0a2ccb1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"_hashlib.pyd","sha256":"cb8090a9a95bb909d1b6df2d30810c6ae5253e0aaa1cd9505a3739cd52caf704","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"_ssl.pyd","sha256":"f9882c83dbf659e1a1a0262c2aef2bcf21161c8ae2a4b21ea5c7468063bddaf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"Microsoft.VC90.CRT.manifest","sha256":"eb0c4035d6f7ef1d2656ed90208409848df0fabc8375aa5daf3645ce96e8357c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"name":"black_box.exe.manifest","sha256":"bfd434d5ed321597105049da7b051db147b211d5557949036843af1884e684a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]}],"files_written":[{"path":"C:\\8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2.exe","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"C:\\8303C9~1.EXE","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\pyimod00_crypto_key.pyd","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\pyimod00_crypto_key.py","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\pyimod00_crypto_key.pyw","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\pyimod00_crypto_key.pyc","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\ctypes.pyd","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\ctypes.py","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\ctypes.pyw","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%TEMP%\\_MEI18~1\\ctypes.pyc","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a6cff3e7ca3e13a341daff4"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a6cff3e7ca3e13a341daff4"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample 8303c9a36f74… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8303c9a36f74…. Malware family: Win/malicious_confidence_60%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample 8303c9a36f74… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8303c9a36f74…. Malware family: Win/malicious_confidence_60%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8303c9a36f749bdecb5719c4e95177f50a4aeaa81ad172581e51cb2641eb09c2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample 8303c9a36f74… — Score 96/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8303c9a36f74…. Malware family: Win/malicious_confidence_60%. Threat score 96/100. 3/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]] 32:null