34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5e:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Draftor.Generic Sample 86b78febd3f9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 86b78febd3f9…. Malware family: Draftor.Generic. Threat score 100/100. 17/24 AV engines flagged this file. 17 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/86b78febd3f923f5082b104a1ffef508e46ddfec4601286ff2457c0e1cc0ff13","keywords":["Malicious","Draftor.Generic","malware analysis","sandbox report","threat intelligence","86b78febd3f923f5082b104a1ffef508e46ddfec4601286ff2457c0e1cc0ff13"],"about":{"@type":"SoftwareApplication","name":"86b78febd3f923f5082b104a1ffef508e46ddfec4601286ff2457c0e1cc0ff13.bin","applicationCategory":["peexe","executable"],"identifier":"86b78febd3f923f5082b104a1ffef508e46ddfec4601286ff2457c0e1cc0ff13","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Draftor.Generic","antivirusDetections":{"malicious":17,"total":24},"behavioralIndicators":{"malicious":17,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:Tae1,Found string "??\C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources.exe" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "??\C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation.resources\v4.0_3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "ile:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.DLL" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "ile:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.EXE" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "ile:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources.DLL" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "System.Management.Automation.resources.EXE" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string ":\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\en-US\System.Management.Automation.resources\System.Management.Automation.resources.EXE" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "System.Management.Automation.resources.DLL" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "??\C:\WINDOWS\assembly\GAC_MSIL\System.Management.Automation.resources\3.0.0.0_en-US_31bf3856ad364e35\System.Management.Automation.resources.dll" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "/System.Management.Automation.resources/System.Management.Automation.resources" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "file:///C:/WINDOWS/SysWOW64/WindowsPowerShell/v1.0/en-US/System.Management.Automation.resources/System.Management.Automation.resources.EXE" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006232.00000000.198819.02DC0000.00000004.mdmp")37:T983," HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:41:52 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a557d0b7de43581c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A36333265373536363733363237323636326536333666366432633331333933363265333133393336....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:41:53 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=7 cfOrigin;dur=823 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=qzdvT3rybU8OchheCeSCvnG2xOwrJXHCKBCSz53fog2o7kFudjxkUp6oigFm9PujkOnRbg41zglPKw5RAbPG%2BxTk2YjXvCVE%2FBYJ2n1cTuQAdPecgA5VoIpi7rna"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d0b9cb316c4d-SJC with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:41:56 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=14 cfOrigin;dur=250 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=pm1Hb08pUo8%2FxEzl5o%2BL8plpi4ZkREGhoNKLUDKtawgwPZ5E6V0D%2BDogjh6cWZzOdmbhlntK4SRICYj%2F2oXhHk1zvQFWLyqgOHCG%2F%2BDGnFNNxazHHJ%2B7t9sAyBhz"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d0cdd94a6c4d-SJC with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC291C382C3B3....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:42:48 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a557d2165d62cc90-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A36333265373536363733363237323636326536333666366432633331333933363265333133393336....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:42:49 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=60 cfOrigin;dur=244 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=nf3JJe05eZ0qkUXE30%2BwmpSZgYFJJAUY%2B2jXZVgBF%2F8OdqywxQNDbEMCh%2F5r%2Bzl4wF6yyMApHYQ%2BsOvQwezjAewkfV7sUX8LHkLTJF1vqMorunSjsdy8TN5K7N6q"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d2184970250d-SJC with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:42:51 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=271 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=1n%2FWJgeFLgwg7XDQn1Fj%2BG7EV2CLilqtMhsAjVpUu%2BHt9PcFziEkiB0qsSJcn5eqcRxoOKzJBvvPogk5kT%2FK8LvyZYl32U6O816qwoWuuUg96pyH154oqodN2tPj"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d226cc5c250d-SJC with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC291C382C3B3....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 70967 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:42:54 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=8 cfOrigin;dur=2100 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=H3AWZ90eUIN7K16IDBaGxWDhQp5y5mQd7M8xBLtIcqzAPFbT6IyUs9xp1ILloAaE4m2rD81RZxkgVIFa5DzB0GCFD7yNu68wU3%2FdYAb7X%2FgZTa6Ewo9KIiQbP%2BEG"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d22bcfee250d-SJC with no response body "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 75 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:42:53 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=788 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=U%2FMVTS24mLWm4hapks4OoMfEHIV4EvJn1ZDuYD%2BLwS94QjN6Kd3PVRnwg4MZmy4XYxsuwr76p1DNKUjiXP5n2qfBbcj3TUJ1jY2e1gLh1ZYca50Tj9%2BMUX0TffYp"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d22ea837c6ec-SJC with response body ==>C2ABC3B633C383C2A3C389C29DC383C2BFC39EC2ABC381C2962EC392C28FC398C2BAC388C28FC381C2A1C389C288C29C....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 69 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:42:53 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=25 cfOrigin;dur=788 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ORRcIGHghczwnoIgKubp5mo3RZhBfBWKfDScym1HbwKt4I%2BbuzleuBNv1lTrfLXIPNa%2B%2BY39CYw7lpueFj%2BX5rhJ3FE0sn5udHLnAFQf%2BZVp7dGB7hheUKPNfYZV"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d2317a42cdb3-SJC with no response body "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 108 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:43:00 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=17 cfOrigin;dur=254 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hvj62m9%2FwpmhDC4MNEnPQakTbLQUkf8W9tKtn6sleYVly3SVaeQbtg2FbghjMPqS%2BGerFluqQOyx45ZpxgLwqS9dINkvcM365uxTYOHJShAHivnOTJ9FnL1WIJKz"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d25e09c8cdb3-SJC with no response body "GET /favicon?url=geotvnews.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 00:43:09 GMT X-Msedge-Ref: Ref A: 3D6DA438FFE14B6C8091D3AA41BD0FB0 Ref B: SJC211051201051 Ref C: 2026-11-05T00:43:10Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 3D6DA438FFE14B6C8091D3AA41BD0FB0 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000Q_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-6DC84 Ref C: 2026-11-05T00:43:10Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=cafemom.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 00:43:09 GMT X-Msedge-Ref: Ref A: D14F57310D314DA2958E01829894F076 Ref B: SJC211051201051 Ref C: 2026-11-05T00:43:10Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: D14F57310D314DA2958E01829894F076 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000O_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-GD5D5 Ref C: 2026-11-05T00:43:10Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon?url=newsday.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Thu 05 Nov 2026 00:43:09 GMT X-Msedge-Ref: Ref A: 35E10F6B885F4BFBB0A5C5B824221833 Ref B: SJC211051201051 Ref C: 2026-11-05T00:43:10Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: 35E10F6B885F4BFBB0A5C5B824221833 Ref B: SC-WUS2-36H23_AKS-GEN00-32749822-VMSS00000F_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-2TQTB Ref C: 2026-11-05T00:43:10Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT.......47:T20a5," www.upx.sourceforge.net\"\n \"sihost.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aebd047cca2a8bf0b09a3b5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"