26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 64:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 88a2c9db752d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 88a2c9db752d…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 5/27 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18"],"about":{"@type":"SoftwareApplication","name":"88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Td21,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetTypeFromCLSID" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetFunctionPointerForDelegate" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ThrowExceptionForHR" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetTypeFromCLSID" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe"28:T420,Observed function "System.IO.Compression.ZipArchive" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed function "System.IO.Compression.ZipFileExtensions" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed function "System.IO.Compression.ZipFile" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed function "System.IO.Compression.ZipArchiveEntry" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin" Observed function "System.IO.Compression.ZipArchive" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed function "System.IO.Compression.ZipFileExtensions" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed function "System.IO.Compression.ZipFile" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe" Observed function "System.IO.Compression.ZipArchiveEntry" in "88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe"29:T1351,88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "youtube_LOriFzhoUTA_628x480_h264" size: "293044" and abnormal entropy:"7.92517278638491" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.aforge.video.directshow.dll.compressed" size: "31842" and abnormal entropy:"7.991515642366471" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.naudio.asio.dll.compressed" size: "14637" and abnormal entropy:"7.981740184575931" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.naudio.core.dll.compressed" size: "81405" and abnormal entropy:"7.995206685705053" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.naudio.midi.dll.compressed" size: "20853" and abnormal entropy:"7.984796934574505" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.naudio.wasapi.dll.compressed" size: "76002" and abnormal entropy:"7.991652341764986" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.naudio.winforms.dll.compressed" size: "14830" and abnormal entropy:"7.9830347080220125" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.naudio.winmm.dll.compressed" size: "25540" and abnormal entropy:"7.985683913880299" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.newtonsoft.json.dll.compressed" size: "272899" and abnormal entropy:"7.991127166764327" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.system.memory.dll.compressed" size: "59807" and abnormal entropy:"7.995401382862062" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.system.numerics.vectors.dll.compressed" size: "32868" and abnormal entropy:"7.984935838008249" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.system.resources.extensions.dll.compressed" size: "33668" and abnormal entropy:"7.990599052240979" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin has big resource with name: "costura.system.security.accesscontrol.dll.compressed" size: "13323" and abnormal entropy:"7.980502218263154" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "youtube_LOriFzhoUTA_628x480_h264" size: "293044" and abnormal entropy:"7.92517278638491" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.aforge.video.directshow.dll.compressed" size: "31842" and abnormal entropy:"7.991515642366471" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.naudio.asio.dll.compressed" size: "14637" and abnormal entropy:"7.981740184575931" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.naudio.core.dll.compressed" size: "81405" and abnormal entropy:"7.995206685705053" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.naudio.midi.dll.compressed" size: "20853" and abnormal entropy:"7.984796934574505" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.naudio.wasapi.dll.compressed" size: "76002" and abnormal entropy:"7.991652341764986" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.naudio.winforms.dll.compressed" size: "14830" and abnormal entropy:"7.9830347080220125" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.naudio.winmm.dll.compressed" size: "25540" and abnormal entropy:"7.985683913880299" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.newtonsoft.json.dll.compressed" size: "272899" and abnormal entropy:"7.991127166764327" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.system.memory.dll.compressed" size: "59807" and abnormal entropy:"7.995401382862062" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.system.numerics.vectors.dll.compressed" size: "32868" and abnormal entropy:"7.984935838008249" 88a2c9db752d0474d3acae63d3a5c7059051460c588142ee8d0769d9765ddc18.bin.exe has big resource with name: "costura.system.resources.extensions.dll.compressed" size: "33668" and abnormal entropy:"7.990599052240979"2a:T919,"+g3#8yf_(yf_(x*(gyf_(*(gyf_(x*(g398" Pattern match: "https://github.com/dotnet/corefx/tree/30ab651fcb4354552bd4891619a0bdd81e0ebdbf.netframeworkassemblyserviceabletruepreferinboxtrueinheriteditemlsystem.resources.resourcereader" Pattern match: "https://github.com/dotnet/runtimezbinaryformatter" Pattern match: "https://github.com/naudio/naudio*naudio.mixer.mixer+" Pattern match: "https://github.com/naudio/naudioitemgkq7][/6[psl" Pattern match: "https://github.com/naudio/naudiovbetter" Pattern match: "https://github.com/naudio/naudio3system.resources.tools.stronglytypedresourcebuilder16.0.0.0uysystem.windows.forms.orientation" Pattern match: "www.microsoft.com/pkiops/crl/miccodsigpca2011_2011-07-08.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/miccodsigpca2011_2011-07-08.crt0|r~,&ve-|=+xzq/rv:v6w~21}a~m|j" Pattern match: "https://github.com/dotnet/corefx/tree/7601f4f6225089ffb291dc7d58293c7bbf5c5d4f.netframeworkassemblyserviceabletruepreferinboxtruetursystem.diagnostics.tracing.eventlevel" Pattern match: "https://github.com/naudio/naudio~" Pattern match: "https://t.me/sillyisafed" Pattern match: "https://ipwhois.app/json/" Heuristic match: "%windir%\system32\chcp.com"54:T5c9,YARA signature for RSA public and private key matched on file "naudio.winmm.dll" YARA signature for RSA public and private key matched on file "aforge.video.dll" YARA signature for RSA public and private key matched on file "system.security.accesscontrol.dll" YARA signature for RSA public and private key matched on file "aforge.dll" YARA signature for RSA public and private key matched on file "newtonsoft.json.dll" YARA signature for RSA public and private key matched on file "aforge.video.directshow.dll" YARA signature for RSA public and private key matched on file "naudio.dll" YARA signature for RSA public and private key matched on file "naudio.midi.dll" YARA signature for RSA public and private key matched on file "microsoft.win32.registry.dll" YARA signature for RSA public and private key matched on file "costura.dll" YARA signature for RSA public and private key matched on file "system.runtime.compilerservices.unsafe.dll" YARA signature for RSA public and private key matched on file "system.resources.extensions.dll" YARA signature for RSA public and private key matched on file "naudio.wasapi.dll" YARA signature for RSA public and private key matched on file "naudio.core.dll" YARA signature for RSA public and private key matched on file "system.security.principal.windows.dll" YARA signature for RSA public and private key matched on file "naudio.asio.dll" YARA signature for RSA public and private key matched on file "naudio.winforms.dll"55:T8a5,"