24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.PWS.Dybalom Sample 86f90205e8fe… — Score 27/100 — Hybrid Analysis","description":"Malicious verdict for sample 86f90205e8fe…. Malware family: Trojan.PWS.Dybalom. Threat score 27/100. 24/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4","keywords":["Malicious","Trojan.PWS.Dybalom","malware analysis","sandbox report","threat intelligence","86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4"],"about":{"@type":"SoftwareApplication","name":"De_rulat_in_vm.exe","applicationCategory":["peexe","executable"],"identifier":"86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4","additionalType":"Malicious sample"},"threatScore":27,"malwareFamily":"Trojan.PWS.Dybalom","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4ba,Found API call GetVersionExA@KERNEL32.dll (Target: "De_rulat_in_vm.exe.bin"; Stream UID: "22362-1393-00409990") which is directly followed by "cmp dword ptr [00454160h], 02h" and "ret ". See related instructions: "... +18 lea eax, dword ptr [ebp-00000094h] +24 mov dword ptr [ebp-00000094h], 00000094h +34 push eax +35 call dword ptr [00448090h] ;GetVersionExA +41 xor eax, eax +43 cmp dword ptr [ebp-00000084h], 02h +50 sete al +53 inc eax +54 mov dword ptr [00454160h], eax +59 xor eax, eax +61 cmp dword ptr [00454160h], 02h +68 sete al +71 leave +72 ret " ... at 22362-1393-00409990 Found API call GetVersionExA@KERNEL32.DLL (Target: "De_rulat_in_vm.exe"; Stream UID: "00018272-00002328-35592-1141-00409990") which is directly followed by "cmp dword ptr [00454160h], 02h" and "ret ". See related instructions: "... +18 lea eax, dword ptr [ebp-00000094h] +24 mov dword ptr [ebp-00000094h], 00000094h +34 push eax +35 call dword ptr [00448090h] ;GetVersionExA +41 xor eax, eax +43 cmp dword ptr [ebp-00000084h], 02h +50 sete al +53 inc eax +54 mov dword ptr [00454160h], eax +59 xor eax, eax +61 cmp dword ptr [00454160h], 02h +68 sete al +71 leave +72 ret " ... at 00018272-00002328-35592-1141-0040999026:T41e,"SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';" "SELECT 'DELETE FROM vacuum_db.' || quote(name) || ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'" "SELECT 'INSERT INTO vacuum_db.' || quote(name) || ' SELECT * FROM main.' || quote(name) || ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND rootpage>0" "UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;" "UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" "UPDATE sqlite_master SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;" "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);"27:Tdb4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAnbSURBVFhHnZd7UJTnFcZpnGSaZGKSic2kY2NM80c0JqY2MZ2OcWqstRNLJolNJjPNZdpcTFDUohFUVC6p16poQEBuCxoBRXRB5C7IXS6Ci8htZReWO8v9Lgv763mXIBqIyfSdOfMty37ved7zPed5zmdnN3UhX9lizzfu/Hf/Xg7s+4Z9e/dyxCeMY8fDCQg5h7+/hsDASLy9A2y/3bx5MxEREQQHB7Nx40beeuut2/tMk+Pur44cOYLX0W/x8vblW81ZvE8l4ns6ncCoTEK0hZxK1HPmUi0xGW3EZZpJzukms2CE/GJITKrmgQcewMfnGGZzF62trZSVXSc1NZXo6GhcXFzuDSRME8JRTRSfJFjZlWnFt9BKUJEVTRF8JwkiJc5KaCXiVEKJ1KtwWSJHXbO7+fjjj8jMLGZgAMbGuL1qampYuXLlvQHEXbiAuauPeIOVQ5J8Vxb4FSIgGAchESERJXFe4oJEgoQCkaGiwELYiTiqqy20tEBXF9y6NY7Bz8+P+++//94APDw8aDe3Yb01QEvXAK5ZY+MgJIkNhCRRlThdAtESMTq4KNf4gjEScoZJyOij+FoPej3cvAkNDdDdjYDpwt7+b3cmV5+nrnnz5pGUlCTIO+lub8W7YJBPk8BDgBy7YsE/axD/pHb8tPX4Rerx0eg4FlgsZCzimJTK168Ao7GFwcERCejsHI+zZy8yY8aMn0VE9grDDQYjTfW1pBbW4LDnMps84nHeHs3WrVG4ynXnDi27dsbgtusCnvK/3f9Jwcc7C42mgKoqI+3tbXKIDtraWmlqaiYqKopFixb9PACurq4owtTV1VFZXoarcxhffh6Ik9N3bNsWhZubloMHEzlxIoeLF3Xk5VUJ02ul7Ca5z2S7r6bGIDyopqqygmrZQ19dJcTMZMOGDSxcuPCnedCiGCTLLHyITSjgYtxVSVQtz7VZTtXF0NAAfX299PR0SYnb6ZATtzQ30tRQR2OdgUajnqYaSV5ZTkrJTVKy8mQPrejEUVavfvfeADw9PamoqMBkMmEZHiShboycdgVnlNGRYSxD/Vj6uxjtbaevo5VmAVtV10Sxvp4LukYO53XgmNbLm1GdLAoxsyC4nY827ePJX/3mhyScnoiqE3Q6HSkpKVwtyCO6Yog/Rlspbxukq0dYXt/LmfJeDhX04pTezz+TBnnj3AgvRlr5bSQsCu5gqfsV1u5PZ/fRNLwOxbN/fyyOjr7SCet59dW3710Bd3d3SktLyUpPRleUT6J+iJVaePmMlWXnxySsLBFAS6PhT+dgVSz8PR4+TLTyjwO57JZkhVmVNNT20dxkpb4e4QMUFVmIjzfjIaRdvXo7jz/+6+mBeLjtIDZPj1eySRhdRVrNAJ8nw1ep8GXK+HWthOOl8ViXBg7Jt/jcM5HoqByso6PCEdX7CCGhshKuXVMAIDcXLsk9Xl6lfPCBOw89NHMqCE83VwIvVWLnVMPW6Fry6wZwvgyumdNENrhlCBCPVBLj8m/LrgJgNCJcGk9eKGqaJYImEkNMjNIF2LOnjDffXD8VgMfObQRn6LHzMPNppImSuj4O5Alq2X8iDsvnwwVwRK47DpXyXaiU4Y5ltY4rYYmoZMH3yZOliiq5mCQhIaKsQYiuJDFv3ut3g3Df7kJItgG7gxY+1baiq+sRU4LjIsM+sqGKACXL+X0EhNXi6R5Lf78c+QerSR5BjgDPkMpdTBADEx5FCklV8uPHER1B7LpTiLmZ++67bwKEnZ2L8xYKr1fwYcoIXyT2ojN2ESRJw4t6yUnRUhbvQ328K+aAdzn5/goRIzGHadZQn/BAgJsFbKVUKurM+KlV8tBQOCN/x8aOyewQzmOPPTUJ4Ouvv7YpYI9IaXV9M1cNXYSWiePlloL/83DyFTi3jFsH57NvjTNZ+aM2pt9lv6OCqBlGxKzqMkcYk/83G+TEcnqNZiK52Ldwy9s7n9mz508C2LRpk60NlQq2NNVTIhU4I2RKKCunNnMZlgurxIftad3zGod3BnNFTlkgfFBEKy+H1jZJLrOApd1CSFghTs6x+PvUMCSumJsDp8LVyUFxQt0XHl7NSy+tmATg5ORkEyI1zTTUm7hm6CCuSkpo0nPQ8h7Hez8hQ2dPpcfrHDuYQpFwQ7WYinwpdbmARSgRHVVO1NlQtNf72Lw9lqoyqZRJbDtxhKzsQfLFacvKhzmvLWPBgjcmAagZrkTo29zcjKnWSKnBTGqNbFhbwZa2v7Cz8z3evv57lu+eiyaoEJm4uCogJlrtmpR9tB/27skVUCdIqx1ih2c0vZ1D9PYNYTS1SZht0djaTZwMFAsWLJ8EoBzrquzY2NiI0WDguqGNHBGUc7VlfHLzNb4yrmTZlXnMODAL36BsbgiAieTxooiXpCPHhIDaiHZcdmrZsiuGlHj5kUxGw8MWOrsH6egcoF1iYMgiVcrnySefmwTg6OgoGxYKseqll/XcMLZS3CQAjDr+WvQ8q6/9gVfT5vKg16Ns2xdO8R0io1pNPeMqqYJFQBfFDFOSKOUQQipeTKyx0TFGJSyWURGk0zzyyKxJAOvWrRNyFNh8/aa+mnKZcCqEWOeNxSy69BRLM+fzfJzouL8d78vskC3SqhROJVciI5M4AYGgE4XsF3AD0qVt4gXTrba2Hlat2nC3ECkA6enpouGVVIsXVNa2YpSxSmsoZLb2IebHzWZO9BPYBdnx4o430ATUihZMKtxEn58SMFpRPgUuS9g/MZzeCUSjSePZZ1+5G8DatWttVhwjunn5cjr6hg5a1DM15GIXbMeMUDt+GfYLHgx6lKcDXmbLdi2REaO2/r5TZGTAJklaLUv8QnGkTbXnHauyslFOv3HqoOrg4EBCQoJYZ7yMURnUNJjplAEz2VTM4rOvszXPnVNVWvyKdRzK7cIz5Dq7duQRLCoXFjYpMqrPsyW5as8yETIlVsoj1FKld3A4ysMPPz4VwGeffUZaWhoZGRk2IHXNAmAY2getmAfHGBQ2i+NSJ8KiEacLEoK7Hs2WwVQnw6fovjwOlVy5n0p+4wYyIwoPFRFlmaT91q/35oknnp5+TF++fLntfU6BKBPojS1m1UFYvo9hedsZlD8aWjo4mVCIm08EX/x7u5TzX7i6xovVdtp8XzmhGkTUTCCaJvbcy+nTV3jnHWfR/ruGkckO+P5NwfaFvb09J0+exNzeQW9/PzflGJczs/A6cpQ1a9awYsWfWfDCC8ycOfO2mz333GuSwEUmaA2+vtkiszoxnlwBFipT0Dax3qXTzYVTZsPbP1qyZAnOzs7yvvcxixcv5plnnhH0j/3YJre/nzVrDnPn/k5+/zJz5iyU8Wv2ve750Rfmn0w08er+f16nJP4f+1N2+WSg23YAAAAASUVORK5CYII=28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":27,"unified_at_epoch_ms":1790316839614,"unified_at":"2026-09-25T06:13:59.614Z","metadata":{"hashes":{"sha256":"86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4","sha1":"7d01fe0630b1593af1af630dde8010c9d9c15c2b","md5":"9a55e302e5956d4d2d20f6f162ded2d5","sha512":"9f07ec1e19f9651b164ed0fb1d42b558978fd37bb6f400c24af5231c8d355498eeb6a7e555aac31107147a9c1bd06cd2d7868028b13f0a6262f1db56cdf7fe77","ssdeep":"6144:10PEtTPkAuAfjlJuj3QjgJ6snJZ/RjY07qVyLOyFTzVxh3VAitO8yb8D/3/EYU:10m3blK36QhuIOyFHxlAaO8ye3/EYU","ssdeep_chunks":["6144:10PEtTP","6144:0PEtTPk","6144:PEtTPkA","6144:EtTPkAu","6144:tTPkAuA","6144:TPkAuAf","6144:PkAuAfj","6144:kAuAfjl","6144:AuAfjlJ","6144:uAfjlJu","6144:AfjlJuj","6144:fjlJuj3","6144:jlJuj3Q","6144:lJuj3Qj","6144:Juj3Qjg","6144:uj3QjgJ","6144:j3QjgJ6","6144:3QjgJ6s","6144:QjgJ6sn","6144:jgJ6snJ","6144:gJ6snJZ","6144:J6snJZ/","6144:6snJZ/R","6144:snJZ/Rj","6144:nJZ/RjY","6144:JZ/RjY0","6144:Z/RjY07","6144:/RjY07q","6144:RjY07qV","6144:jY07qVy","6144:Y07qVyL","6144:07qVyLO","6144:7qVyLOy","6144:qVyLOyF","6144:VyLOyFT","6144:yLOyFTz","6144:LOyFTzV","6144:OyFTzVx","6144:yFTzVxh","6144:FTzVxh3","6144:TzVxh3V","6144:zVxh3VA","6144:Vxh3VAi","6144:xh3VAit","6144:h3VAitO","6144:3VAitO8","6144:VAitO8y","6144:AitO8yb","6144:itO8yb8","6144:tO8yb8D","6144:O8yb8D/","6144:8yb8D/3","6144:yb8D/3/","6144:b8D/3/E","6144:8D/3/EY","6144:D/3/EYU","12288:10PEtTP","12288:0PEtTPk","12288:PEtTPkA","12288:EtTPkAu","12288:tTPkAuA","12288:TPkAuAf","12288:PkAuAfj","12288:kAuAfjl","12288:AuAfjlJ","12288:uAfjlJu","12288:AfjlJuj","12288:fjlJuj3","12288:jlJuj3Q","12288:lJuj3Qj","12288:Juj3Qjg","12288:uj3QjgJ","12288:j3QjgJ6","12288:3QjgJ6s","12288:QjgJ6sn","12288:jgJ6snJ","12288:gJ6snJZ","12288:J6snJZ/","12288:6snJZ/R","12288:snJZ/Rj","12288:nJZ/RjY","12288:JZ/RjY0","12288:Z/RjY07","12288:/RjY07q","12288:RjY07qV","12288:jY07qVy","12288:Y07qVyL","12288:07qVyLO","12288:7qVyLOy","12288:qVyLOyF","12288:VyLOyFT","12288:yLOyFTz","12288:LOyFTzV","12288:OyFTzVx","12288:yFTzVxh","12288:FTzVxh3","12288:TzVxh3V","12288:zVxh3VA","12288:Vxh3VAi","12288:xh3VAit","12288:h3VAitO","12288:3VAitO8","12288:VAitO8y","12288:AitO8yb","12288:itO8yb8","12288:tO8yb8D","12288:O8yb8D/","12288:8yb8D/3","12288:yb8D/3/","12288:b8D/3/E","12288:8D/3/EY","12288:D/3/EYU","6144:10m3blK","6144:0m3blK3","6144:m3blK36","6144:3blK36Q","6144:blK36Qh","6144:lK36Qhu","6144:K36QhuI","6144:36QhuIO","6144:6QhuIOy","6144:QhuIOyF","6144:huIOyFH","6144:uIOyFHx","6144:IOyFHxl","6144:OyFHxlA","6144:yFHxlAa","6144:FHxlAaO","6144:HxlAaO8","6144:xlAaO8y","6144:lAaO8ye","6144:AaO8ye3","6144:aO8ye3/","6144:O8ye3/E","6144:8ye3/EY","6144:ye3/EYU"],"imphash":"6a64eb45d179baf6bd6ed7b55a0d8cf5"},"file_info":{"file_name":"De_rulat_in_vm.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":368640,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287934000,"last_seen":1630984231000,"last_multi_scan":1630984231000}},"detections":{"summary":{"verdict":"malicious","score":27,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":7,"malicious_count":2,"total":23},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dybalom.lkgv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Fignotok.401408","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Dybalom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.PWS.Dybalom.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.PSW.Dybalom.~FAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.GGZJ-6488","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.PWS.Dybalom.B (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/PSW.Fignotok.H trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/Fignotok.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-PWS.Win32.Dybalom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Password-Stealer ( 004ba0301 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.Win32.Dybalom.dhc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BackDoor-ERY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dapato.daebdr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Fignotok.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-CQE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Infostealer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-PWS/W32.Dybalom.368640.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"TROJ_FIGNOTO.SMA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"TROJ_FIGNOTO.SMA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dybalom.CUI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanPSW.Fignotok","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dybalom.Win32.2421","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.PWS.Dybalom","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 22362-1409-0040A35D\n GetSystemTime@KERNEL32.dll at 22362-1408-0040A28C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00018272-00002328-35592-1157-0040A35D\n GetSystemTime@KERNEL32.DLL at 00018272-00002328-35592-1156-0040A28C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 22362-1361-00443B0D\n GetTimeZoneInformation@KERNEL32.DLL at 00018272-00002328-35592-1109-00443B0D","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 22362-1-00441175\n GetVersionExA@KERNEL32.dll at 22362-1393-00409990\n GetVersion@KERNEL32.DLL at 00018272-00002328-35592-1-00441175\n GetVersionExA@KERNEL32.DLL at 00018272-00002328-35592-1141-00409990","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.dll at 22362-1398-0040A0A4\n GetDiskFreeSpaceA@KERNEL32.DLL at 00018272-00002328-35592-1146-0040A0A4","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$25","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$26","origin":"File/Memory","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c timeout 5 && del C:\\DE_RUL~1.EXE\" on 2017-2-12.09:16:00.951","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c timeout 5 && del C:\\DE_RUL~1.EXE\" (UID: 00024804-00003016)\n Spawned process \"timeout.exe\" with commandline \"timeout 5\" (UID: 00024813-00003100)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\OLEACCRC.DLL\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"\" touched file \"%WINDIR%\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://stlr.multiencoder.com/admin.php\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"De_rulat_in_vm.exe.bin\" was detected as \"Microsoft Visual C++ v6.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FreeResource@KERNEL32.DLL at 00018272-00002328-35592-7-00401D22\n FreeResource@KERNEL32.DLL at 00018272-00002328-41408-7-00401D22","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n OpenProcessToken\n RegOpenKeyExA\n RegEnumKeyExA\n GetFileAttributesA\n GetDriveTypeA\n GetFileAttributesW\n GetTempPathA\n GetTempPathW\n CopyFileA\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n TerminateProcess\n LoadLibraryW\n GetTickCount\n GetVersionExA\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n DeleteFileA\n DeleteFileW\n GetProcAddress\n CreateFileW\n CreateFileA\n LockResource\n GetCommandLineA\n WriteFile\n Sleep\n FindResourceA\n VirtualAlloc\n ShellExecuteA\n FindWindowA\n InternetOpenUrlA\n InternetCloseHandle\n InternetOpenA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Scans for artifacts that may help identify the target","description":"\"\" (Path: \"HKCU\\SOFTWARE\\GOOGLE\\GOOGLE TALK\\ACCOUNTS\")","origin":"Registry Access","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Touched instant messenger related registry keys","description":"\"\" (Path: \"HKCU\\SOFTWARE\\GOOGLE\\GOOGLE TALK\\ACCOUNTS\")","origin":"Registry Access","relevance":5,"id":"registry-34","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]}],"incidents":[{"name":"Credential Stealer","details_count":2,"details":[{"detail":"Touched instant messenger related registry keys"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the active computer name"},{"detail":"Scans for artifacts that may help identify the target"}],"sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":25,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"58a086a5aac2ed636f83dc33","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":27,"submit_name":"De_rulat_in_vm.exe","analysis_start_time":"2017-02-12T17:00:58+00:00","indicators_count":{"informative":14,"suspicious":7,"malicious":2},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}],"processes":[{"pid":2328,"ppid":0,"name":"De_rulat_in_vm.exe","command_line":"","normalized_path":"C:\\De_rulat_in_vm.exe","uid":"00018272-00002328","icon":"$27"},{"pid":3016,"ppid":2328,"name":"cmd.exe","command_line":"/c timeout 5 && del C:\\DE_RUL~1.EXE","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00018272-00002328","uid":"00024804-00003016","icon":"$28"},{"pid":3100,"ppid":3016,"name":"timeout.exe","command_line":"timeout 5","normalized_path":"%WINDIR%\\System32\\timeout.exe","parent_uid":"00024804-00003016","uid":"00024813-00003100"}],"all_imported_dlls":["winmm.dll","oleacc.dll","oleaccrc.dll","Wldap32.dll","sechost.dll","wininet.dll","iertutil.dll","nsi.dll","clbcatq.dll","profapi.dll","msctf.dll","msvcr100.dll","rpcss.dll","cryptbase.dll","sspicli.dll","kernel32.dll","lpk.dll","cfgmgr32.dll","usp10.dll","shell32.dll","urlmon.dll","msasn1.dll","imm32.dll","propsys.dll","setupapi.dll","ntmarta.dll","user32.dll","gdi32.dll","advapi32.dll","shlwapi.dll","wsock32.dll","comctl32.dll","version.dll","ntdll.dll","softokn3.dll","uxtheme.dll","apphelp.dll","winbrand.dll","rpcrt4.dll","ole32.dll","oleaut32.dll","crypt32.dll","ieframe.dll","psapi.dll","devobj.dll","ws2_32.dll","KernelBase.dll","msvcrt.dll","nss3.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%PROGRAMFILES%\\Trillian\\users\\default\\msn.ini","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%PROGRAMFILES%\\Trillian\\users\\default\\aim.ini","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%PROGRAMFILES%\\Trillian\\users\\default\\yahoo.ini","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\.purple\\accounts.xml","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%ALLUSERSPROFILE%\\DynDNS\\Updater\\config.dyndns","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Web Data","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\chrtmp","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\Opera\\Opera\\wand.dat","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\FileZilla\\recentservers.xml","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%ALLUSERSPROFILE%\\FlashFXP\\3\\Sites.dat","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Pro\\8.0\\sm.dat","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Home\\8.0\\sm.dat","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%APPDATA%\\GlobalSCAPE\\CuteFTP Lite\\8.0\\sm.dat","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%WINDIR%\\system32\\timeout.exe","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%WINDIR%\\system32\\en-US\\timeout.exe.mui","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58a086a5aac2ed636f83dc33"}]}]}},"report_ids":{"sandbox_job_ids":["58a086a5aac2ed636f83dc33"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.PWS.Dybalom Sample 86f90205e8fe… — Score 27/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 86f90205e8fe…. Malware family: Trojan.PWS.Dybalom. Threat score 27/100. 24/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.PWS.Dybalom Sample 86f90205e8fe… — Score 27/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 86f90205e8fe…. Malware family: Trojan.PWS.Dybalom. Threat score 27/100. 24/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/86f90205e8fecad04dff483d2a9295a8f5b2b14bb9d9570dace8dbcb30b9fde4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.PWS.Dybalom Sample 86f90205e8fe… — Score 27/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 86f90205e8fe…. Malware family: Trojan.PWS.Dybalom. Threat score 27/100. 24/28 AV engines flagged this file. 2 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]