24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T462,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 8991ce3e98dd… — Score 76/100 — Hybrid Analysis","description":"Malicious verdict for sample 8991ce3e98dd…. Malware family: Malware. Threat score 76/100. 16/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0"],"about":{"@type":"SoftwareApplication","name":"10.mov","applicationCategory":["peexe","executable"],"identifier":"8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0","additionalType":"Malicious sample"},"threatScore":76,"malwareFamily":"Malware","antivirusDetections":{"malicious":16,"total":26},"behavioralIndicators":{"malicious":7,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9b9,"" wrote bytes "0000000007004e74436c6f7365" to virtual address "0x0040F5F4" (part of module "10.MOV.EXE") "" wrote bytes "000000000f004e7443726561746553656374696f6e" to virtual address "0x0040F5A4" (part of module "10.MOV.EXE") "" wrote bytes "0000000009006e00740064006c006c002e0064006c006c00" to virtual address "0x0040F588" (part of module "10.MOV.EXE") "" wrote bytes "0000000009006e74646c6c2e646c6c" to virtual address "0x0040D258" (part of module "10.MOV.EXE") "" wrote bytes "00000000130052746c4465636f6d7072657373427566666572" to virtual address "0x0040D268" (part of module "10.MOV.EXE") "" wrote bytes "0000000014004e74556e6d6170566965774f6653656374696f6e" to virtual address "0x0040F5D8" (part of module "10.MOV.EXE") "" wrote bytes "4053ab775858ac77186aac77653cad770000000000bf28770000000056cc2877000000007cca2877000000003768c5756a2cad77d62dad77000000002069c5750000000029a6287700000000a48dc57500000000f70e287700000000" to virtual address "0x77151000" (part of module "NSI.DLL") "" wrote bytes "0000000012004e744d6170566965774f6653656374696f6e" to virtual address "0x0040F5BC" (part of module "10.MOV.EXE") "explorer.exe" wrote bytes "7739a97779a8ad77be72ad77d62dad771de2a87705a2ad77c868ac7757d1b377bee3a877616fad776841ab770050ab7700000000ad3720778b2d2077b641207700000000" to virtual address "0x75601000" "explorer.exe" wrote bytes "0000000000000000" to virtual address "0x046501A0" "explorer.exe" wrote bytes "00000000" to virtual address "0x04797DA0" "explorer.exe" wrote bytes "000000000a0045006e0074007200790050006f0069006e007400" to virtual address "0x0011F228" "explorer.exe" wrote bytes "000000000a00760034002e0030002e0033003000330031003900" to virtual address "0x0011F138" "explorer.exe" wrote bytes "92e6a87779a8ad77be72ad77d62dad771de2a87705a2ad77bee3a877616fad776841ab770050ab7700000000ad3720778b2d2077b641207700000000" to virtual address "0x750E1000" "explorer.exe" wrote bytes "00000000" to virtual address "0x04797DC0" "explorer.exe" wrote bytes "6e74646c6c2e646c6c0000" to virtual address "0x047AB6BE" "explorer.exe" wrote bytes "00000000" to virtual address "0x04797DE0" "explorer.exe" wrote bytes "00000000" to virtual address "0x04797DCC" "explorer.exe" wrote bytes "000000001100434c52437265617465496e7374616e6365" to virtual address "0x0011F244" "explorer.exe" wrote bytes "4e74436f6e74696e756500" to virtual address "0x047AB6B2"26:T2255,Found malicious artifacts related to "78.47.139.102" (ASN: 24940, Owner: Hetzner Online AG): ... URL: http://myexternalip.com/ (AV positives: 4/70 scanned on 01/16/2017 13:11:33) URL: http://78.47.139.102/ (AV positives: 2/68 scanned on 01/16/2017 07:00:49) URL: http://myexternalip.com/raw/ (AV positives: 4/69 scanned on 01/15/2017 08:20:47) URL: http://myexternalip.com/favicon.ico (AV positives: 3/68 scanned on 01/13/2017 13:14:48) URL: http://myexternalip.com/raw (AV positives: 6/69 scanned on 01/11/2017 20:39:43) File SHA256: 151a4e8aa49a1b92103874605de177bc34af952b609197cb4396f8b04fdf3f01 (AV positives: 25/58 scanned on 01/15/2017 19:46:34) File SHA256: d4f4e052297cfd02f115e7ce4cef6e7c4ad4142225b52e6dea0635a1991a594b (AV positives: 25/58 scanned on 01/14/2017 20:42:07) File SHA256: 40a6ec63ebfd8c198ed827a114c6707921322cfb6177e5c24bc6244822f33cea (AV positives: 35/56 scanned on 01/12/2017 09:00:53) File SHA256: c2c050e2937ba79c5f0044ac2fd23b1dc805ced0d5e45f19ae40b700cf62e95e (AV positives: 20/57 scanned on 01/12/2017 03:05:42) File SHA256: 5f003b9b1d68cc22e895bfabd0aea197a5a36ec6f1f3fbd1842265111890e6d5 (AV positives: 26/55 scanned on 01/09/2017 18:59:25) Found malicious artifacts related to "128.31.0.39" (ASN: 3, Owner: Massachusetts Institute of Technology): ... URL: http://128.31.0.39:9101/ (AV positives: 3/68 scanned on 01/12/2017 07:43:59) URL: http://128.31.0.39/ (AV positives: 3/68 scanned on 01/11/2017 22:26:43) URL: http://128.31.0.39:9131/ (AV positives: 3/68 scanned on 12/21/2016 21:20:46) URL: http://128.31.0.39:9131/tor/status-vote/current/consensus-microdesc.z/ (AV positives: 3/68 scanned on 11/06/2016 13:59:57) URL: http://128.31.0.39:9131/tor/status-vote/current/consensus-microdesc.z (AV positives: 3/68 scanned on 10/28/2016 01:50:54) File SHA256: 47e34d57f9006734c74556a8ed214d91b5b63b8773f18e815714c6e49c2af9f1 (AV positives: 30/55 scanned on 01/09/2017 04:25:40) File SHA256: e9c6aadad89a3de349fb1efcafd05fa1aa8d830850b322c3a8c18fdf2182c446 (AV positives: 42/57 scanned on 01/06/2017 03:29:30) File SHA256: e5fd4edcb2477fa4156fd61c525f113c0e12305d1a85cd8eaef5ee58fb032518 (AV positives: 33/57 scanned on 01/01/2017 15:08:50) File SHA256: b16e3827a88f5b1c8822f0196119eabb0e2442abf4c1ad8ef4f760cb879c2a02 (AV positives: 49/56 scanned on 12/28/2016 09:42:51) File SHA256: 94f1031e0b76a44f6e92fce1150246da41afdcc1e88d7dabbd8469d637661328 (AV positives: 33/55 scanned on 12/17/2016 17:51:07) Found malicious artifacts related to "86.59.21.38" (ASN: 3248, Owner: Tele2 Telecommunication GmbH): ... URL: http://86.59.21.38:443/ (AV positives: 2/68 scanned on 01/12/2017 12:47:58) URL: http://86.59.21.38/ (AV positives: 2/68 scanned on 01/12/2017 00:16:49) URL: https://86.59.21.38/ (AV positives: 1/68 scanned on 12/13/2016 23:25:39) URL: http://86.59.21.38/tor/status-vote/current/consensus/ (AV positives: 2/68 scanned on 11/05/2016 11:28:23) URL: http://86.59.21.38/tor/status-vote/current/consensus (AV positives: 2/68 scanned on 11/02/2016 13:25:38) File SHA256: 22dd1f4b99d8fae4554c0e8c1a643948a81ded27b713318a1b136a4bd8d9e8f2 (AV positives: 17/56 scanned on 01/16/2017 10:16:37) File SHA256: 98d00d5cb4114326de8d82fa022097c5082322f3d1612c957499ab4d47a891ca (AV positives: 47/57 scanned on 01/15/2017 00:43:37) File SHA256: 73e718d13bce3c780a1a98b8730aca48301cd9984e83333522e53d282d04c824 (AV positives: 6/56 scanned on 01/10/2017 09:30:47) File SHA256: 80d75295f9614dfe89eb1cbe038ca394679e73b4e317eea08bea977eac89a9b4 (AV positives: 35/56 scanned on 01/05/2017 11:30:10) File SHA256: b16e3827a88f5b1c8822f0196119eabb0e2442abf4c1ad8ef4f760cb879c2a02 (AV positives: 49/56 scanned on 12/28/2016 09:42:53) Found malicious artifacts related to "62.220.148.97" (ASN: 6893, Owner: Saitis Network, N.Desir): ... URL: https://62.220.148.97/ (AV positives: 1/68 scanned on 08/09/2016 14:01:04) File SHA256: 96f6dcbe783275f1521f94f85845f8267f1a90a1c1a0f89d2c8b9a18edac566d (AV positives: 37/56 scanned on 10/27/2016 15:02:50) File SHA256: 705445dfe48eedfba4750c4bb3efcdd82117e61f3aa81d26e0081b8e9ea77fc5 (AV positives: 42/55 scanned on 02/25/2016 19:03:14) File SHA256: 776f17390761244401287b53340ecd29b65a67667b8ee64e31732d183c15f2e3 (AV positives: 38/53 scanned on 01/22/2016 01:42:59) File SHA256: bd59b9cc6599a1ed5e9a68f163e32bd9fc4447d1398691a60eaa1bc26432d9cf (AV positives: 3/56 scanned on 01/09/2016 20:14:35) File SHA256: 01972b2006b24a51da4784cd0012d7c4887b238e955fe8fc9453a83dc1395864 (AV positives: 41/57 scanned on 05/21/2015 06:03:15) Found malicious artifacts related to "83.149.20.38" (ASN: 31133, Owner: OJSC MegaFon): ... URL: https://83.149.20.38/ (AV positives: 1/68 scanned on 07/15/2016 13:54:05) File SHA256: 223d2eba588e1ddcb6b3c0a76d8182fa2f92d94f1e951cdaead4151928a5b8d9 (AV positives: 44/57 scanned on 11/13/2016 19:54:48) File SHA256: 09bea5ef0aa5b2a8ea11431c555abadc9d53f47c61383896b21f40aa577d47f7 (AV positives: 30/57 scanned on 09/18/2016 13:28:24) File SHA256: cce73091ea2de392aa6a479d376171bb567306ba0eab1d587a7ee5494b315e8a (AV positives: 40/58 scanned on 09/14/2016 07:33:19) Found malicious artifacts related to "139.59.159.222" (ASN: , Owner: ): ... File SHA256: 73c3613c2bf098d111546a58673cd2d3eb3a3ebe6a2d7f39da26a36021e47438 (AV positives: 26/57 scanned on 12/12/2016 13:15:27) Found malicious artifacts related to "81.17.17.131" (ASN: 51852, Owner: Private Layer INC): ... URL: https://81.17.17.131/ (AV positives: 1/68 scanned on 07/21/2016 14:34:18) File SHA256: b476f0db82daf1d05a4b4718a161a69342a13daa18fa89ea75c9de9c8eca4126 (AV positives: 40/55 scanned on 01/08/2017 10:24:45) File SHA256: 1d074df17ea68f6e9daf0424b827ca62f19aa87a7416b418a9653a157f0d1c6c (AV positives: 33/56 scanned on 10/12/2016 14:24:25) File SHA256: 29515230a9ce61dbc2d2233ffcc332af341d08a40590c17b85ccfcc0cea03c9c (AV positives: 7/57 scanned on 09/22/2016 17:00:03) File SHA256: 8546498fc22e6910810923ef544b89fb0b6b1a290c83c37c6fa73714a245eacc (AV positives: 28/57 scanned on 09/14/2016 21:08:56) File SHA256: 4b9f44ce281ce04a3e6eeee34dbda1a5510aa233765be24c70a6fed9e0aeea7a (AV positives: 31/58 scanned on 08/28/2016 08:52:40) Found malicious artifacts related to "46.41.130.68" (ASN: 12824, Owner: home.pl sp. z o.o.): ... URL: https://46.41.130.68/ (AV positives: 1/68 scanned on 07/21/2016 15:26:11) File SHA256: e91881528f7fcc3091735b1d4efb7570e60f4b9ba7019a5cc60ce435aeef3560 (AV positives: 4/56 scanned on 12/11/2016 23:11:23) File SHA256: 69a96bb78e18abf2c6e23c5ddc597c53af0c9b70fdaac1144cac155aabc7d7dc (AV positives: 4/54 scanned on 07/28/2016 16:41:48) File SHA256: 730f44c6ea9321a1611311affa1f187aa739c6a7d3e7d7031530756fef1f6f42 (AV positives: 42/55 scanned on 01/18/2016 06:31:06) File SHA256: 4c845132e2313cb9ce3727fca12cc5fc0081574be350fd6b1b61deee961f1d19 (AV positives: 43/57 scanned on 03/28/2015 02:10:20) File SHA256: c46b9deede9b6f987d45b2723b18b775aec99777f97f162492660f3f4f1e84b3 (AV positives: 19/55 scanned on 01/11/2015 20:17:25) Found malicious artifacts related to "85.235.250.88" (ASN: 9167, Owner: WEBPARTNER A/S is a Danish Internet Service Provider): ... URL: http://85.235.250.88/tor/server/fp/e0ee8584c081a906703b68b7976bd0cab0416110 (AV positives: 1/68 scanned on 01/09/2017 23:22:39) URL: http://85.235.250.88/ (AV positives: 1/68 scanned on 01/09/2017 06:23:05) URL: https://85.235.250.88/ (AV positives: 1/68 scanned on 07/25/2016 14:42:09) File SHA256: 5bebaae1a609dac5e733693a4bf03c72f95864a0360975478b42f4073fac2a94 (AV positives: 30/58 scanned on 01/13/2017 09:37:37) File SHA256: e91881528f7fcc3091735b1d4efb7570e60f4b9ba7019a5cc60ce435aeef3560 (AV positives: 4/56 scanned on 12/11/2016 23:11:27) File SHA256: 03f87764d8d7431dc756157370d048e56818d693fde10016b157f21cdaf1dff5 (AV positives: 31/57 scanned on 12/11/2016 02:06:20) File SHA256: fe512b9a58ffe3a1382134e50eed42669fffc85e37a22376ab9b725df122bfd4 (AV positives: 31/56 scanned on 12/05/2016 09:36:02) File SHA256: 223d2eba588e1ddcb6b3c0a76d8182fa2f92d94f1e951cdaead4151928a5b8d9 (AV positives: 44/57 scanned on 11/13/2016 19:54:49) Found malicious artifacts related to "163.172.167.28" (ASN: , Owner: ): ... File SHA256: 58eae44e304290e21757008a9fa32b946a2ff20b5ec7f1ae6fea47e72c556439 (AV positives: 26/56 scanned on 12/09/2016 07:57:41) File SHA256: a5acfcf0f347a41998cfb0057b3240b2c039f7804bd046d9f10ce66a4c6a67d6 (AV positives: 4/50 scanned on 12/04/2016 17:17:43) File SHA256: b4df505b5f6f5d93f792ac7e17a3410e8b40af20004231ea87c2878b499f7c1a (AV positives: 22/57 scanned on 09/22/2016 08:51:47) File SHA256: 28fe0c530b19a53c1796b076a73e78671122c8deccff3a40316fa9a7a59eab53 (AV positives: 7/57 scanned on 09/19/2016 08:24:50) File SHA256: cce73091ea2de392aa6a479d376171bb567306ba0eab1d587a7ee5494b315e8a (AV positives: 40/58 scanned on 09/14/2016 07:33:13)27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":76,"unified_at_epoch_ms":1790322646260,"unified_at":"2026-09-25T07:50:46.260Z","metadata":{"hashes":{"sha256":"8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0","sha1":"0ba4c5b8082bc71b6c919b8d8b56ad5da86d36ab","md5":"2aa095b688a84181c0883ed00e79ccac","sha512":"6a3e6eb6c46bc94ff3e685d3f451ed2df501cd84c3cf531ebbe8a9d8deab0aea436a3a40552aa2caa3eadcb1aa56dc79e4b2f633f3f1cf5287109698eaecbb76","ssdeep":"49152:zrs7gIlrqcrAycLXuo17iERvOFBCFMXVnscLYp7oRPHi3nTar7R:xIl+cr4DUPVFLYVoRHiXTa","ssdeep_chunks":["49152:zrs7gIl","49152:rs7gIlr","49152:s7gIlrq","49152:7gIlrqc","49152:gIlrqcr","49152:IlrqcrA","49152:lrqcrAy","49152:rqcrAyc","49152:qcrAycL","49152:crAycLX","49152:rAycLXu","49152:AycLXuo","49152:ycLXuo1","49152:cLXuo17","49152:LXuo17i","49152:Xuo17iE","49152:uo17iER","49152:o17iERv","49152:17iERvO","49152:7iERvOF","49152:iERvOFB","49152:ERvOFBC","49152:RvOFBCF","49152:vOFBCFM","49152:OFBCFMX","49152:FBCFMXV","49152:BCFMXVn","49152:CFMXVns","49152:FMXVnsc","49152:MXVnscL","49152:XVnscLY","49152:VnscLYp","49152:nscLYp7","49152:scLYp7o","49152:cLYp7oR","49152:LYp7oRP","49152:Yp7oRPH","49152:p7oRPHi","49152:7oRPHi3","49152:oRPHi3n","49152:RPHi3nT","49152:PHi3nTa","49152:Hi3nTar","49152:i3nTar7","49152:3nTar7R","98304:zrs7gIl","98304:rs7gIlr","98304:s7gIlrq","98304:7gIlrqc","98304:gIlrqcr","98304:IlrqcrA","98304:lrqcrAy","98304:rqcrAyc","98304:qcrAycL","98304:crAycLX","98304:rAycLXu","98304:AycLXuo","98304:ycLXuo1","98304:cLXuo17","98304:LXuo17i","98304:Xuo17iE","98304:uo17iER","98304:o17iERv","98304:17iERvO","98304:7iERvOF","98304:iERvOFB","98304:ERvOFBC","98304:RvOFBCF","98304:vOFBCFM","98304:OFBCFMX","98304:FBCFMXV","98304:BCFMXVn","98304:CFMXVns","98304:FMXVnsc","98304:MXVnscL","98304:XVnscLY","98304:VnscLYp","98304:nscLYp7","98304:scLYp7o","98304:cLYp7oR","98304:LYp7oRP","98304:Yp7oRPH","98304:p7oRPHi","98304:7oRPHi3","98304:oRPHi3n","98304:RPHi3nT","98304:PHi3nTa","98304:Hi3nTar","98304:i3nTar7","98304:3nTar7R","49152:xIl+cr4","49152:Il+cr4D","49152:l+cr4DU","49152:+cr4DUP","49152:cr4DUPV","49152:r4DUPVF","49152:4DUPVFL","49152:DUPVFLY","49152:UPVFLYV","49152:PVFLYVo","49152:VFLYVoR","49152:FLYVoRH","49152:LYVoRHi","49152:YVoRHiX","49152:VoRHiXT","49152:oRHiXTa"],"imphash":"ec8663937440602af9af868f23560f91"},"file_info":{"file_name":"10.mov","file_type":["peexe","executable"],"file_type_id":"exe","file_size":5148672,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499288153000,"last_seen":1713415062000,"last_multi_scan":1713415062000}},"detections":{"summary":{"verdict":"malicious","score":76,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":11,"malicious_count":7,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/VBKrypt.RP.X1768","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.VB.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.@p0@cu3WLajb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Vbkryjetor-5857623-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.PonyStealer.@p0@cu3WLajb (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DKMU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0050252a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.bkk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.DJXP.ekpvhk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/FareitVB-M","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.VBKryjetor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.VBKryjetor.Win32.2698","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"myexternalip.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"78.47.139.102:80\"\n \"128.31.0.39:9101\"\n \"86.59.21.38:443\"\n \"62.220.148.97:443\"\n \"195.1.41.6:9001\"\n \"185.76.145.109:9001\"\n \"104.131.184.21:9001\"\n \"83.149.20.38:443\"\n \"139.59.159.222:443\"\n \"216.218.222.14:9002\"\n \"144.76.53.125:9001\"\n \"81.17.17.131:443\"\n \"46.41.130.68:443\"\n \"213.141.138.174:9002\"\n \"85.235.250.88:443\"\n \"163.172.167.28:9001\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\OQsbBGdftE\"\n \"\\Sessions\\1\\BaseNamedObjects\\OQsbBGdftE-module\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\mdtMMiIUok\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /raw HTTP/1.1\nHost: myexternalip.com\nConnection: Keep-Alive\"\n \"GET /raw HTTP/1.1\nHost: myexternalip.com\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"\" loaded module \"%WINDIR%\\System32\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","id":"module-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"explorer.exe\" (UID: 00020107-00002732)\n Spawned process \"RegAsm.exe\" with commandline \"\"%APPDATA%\\itunes.exe\" OQsbBGdftE mdtMMiIUok\" (UID: 00020401-00002388)\n Spawned process \"RegAsm.exe\" with commandline \"\"%APPDATA%\\itunes.exe\" OQsbBGdftE mdtMMiIUok\" (UID: 00020450-00002864)\n Spawned process \"InstallUtil.exe\" (UID: 00020850-00003004)\n Spawned process \"InstallUtil.exe\" (UID: 00023618-00003140)\n Spawned process \"InstallUtil.exe\" (UID: 00026360-00003456)\n Spawned process \"InstallUtil.exe\" (UID: 00031734-00002956)\n Spawned process \"RegAsm.exe\" with commandline \"%APPDATA%\\file.txt\" (UID: 00032742-00003780)\n Spawned process \"RegAsm.exe\" with commandline \"-f \"%APPDATA%\\file.txt\"\" (UID: 00033047-00003764)\n Spawned process \"InstallUtil.exe\" (UID: 00039515-00002452)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"cached-microdescs.tmp\" has type \"ASCII text with very long lines\"\n \"sx_res_bin.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"unverified-microdesc-consensus.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"state.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"cached-certs.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"cached-microdescs.new\" has type \"ASCII text with very long lines\"\n \"cached-microdesc-consensus.tmp\" has type \"ASCII text with CRLF line terminators\"\n \"itunes_ftp.dat\" has type \"data\"\n \"itunes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"file.txt\" has type \"ASCII text with CRLF line terminators\"\n \"itunes_ge.dat\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"v&.PN\"\n Heuristic match: \"tK?.Ca\"\n Heuristic match: \"qI.mz\"\n Heuristic match: \"ov.kz\"\n Heuristic match: \"Kf(.TP\"\n Heuristic match: \"0%8.MM\"\n Heuristic match: \"2?~.cZ\"\n Heuristic match: \">#.Mp\"\n Heuristic match: \"#n.gY\"\n Heuristic match: \"Dn.TZ\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"r paypal14relay01 vpU8lcmNIHdCpm3cBbCkdv8iJck 2017-01-15 23:22:36 212.47.246.18 443 80\" (Indicator: \"paypal\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"tQqt/34h3QI+RT2PM3VbOxuEnEQD9kHV3Ensx0HAXQIGSDaSaHKs/jGHCShcwA46\" (Indicator: \"vbox\")\n \"MIGJAoGBAMbYe9g2DoZn+3WKIsfyY/DyeXqkCJwhmfDeDRvqEmUhv2nmGqzYFh3f\" (Indicator: \"qemu\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"r CloseTheDoor Skr8+jQtU0rAMSibFuT9m3cLxe0 2017-01-16 08:00:27 195.154.13.96 9001 9000\" (Indicator: \"08:00:27\")","origin":"File/Memory","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"explorer.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"RegAsm.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"InstallUtil.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"itunes.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ITUNES\"; Value: \"\"%APPDATA%\\itunes.exe\"\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"*ITUNES\"; Value: \"\"%APPDATA%\\itunes.exe\"\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"details too long to display","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"m zep0Xdo2KQkcYvncd9faBFIlx2fmdpBN0OCaEySokyg\" (Indicator for product: Generic VNC)\n \"m 7pvxTXO9G35bN4UOQdWvT8c0ED/4EgnJU79Z3R6vncs\" (Indicator for product: Generic VNC)\n \"m LfVRNH9uIWz7jh26EoVeAg65x8K1CbQ3jaetk35ivnc\" (Indicator for product: Generic VNC)\n \"LZHtpMNLjYgf8RiBDeDLcISEvncogIgDcZsE64cJ+ffRb0gKHwsDAgMBAAE=\" (Indicator for product: Generic VNC)\n \"ntor-onion-key lsvncTjPbbOd/BEnp8YbllkFkVNbhPvO15fnCJ8GIV8=\" (Indicator for product: Generic VNC)\n \"MIGJAoGBAKbC5kZaMapJthhBPfiU0SxUWkmnBJsoRjTe0WYvncsyl+/wBqISlx7l\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"itunes.exe\" claimed CRC 5155157 while the actual is CRC 5181125","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"explorer.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")\n \"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"RegAsm.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY Possible IP Check myexternalip.com\" (SID: 2019980, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET POLICY TLS possible TOR SSL traffic\" (SID: 2018789, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/55 Antivirus vendors marked sample as malicious (9% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00020107-00002732)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"myexternalip.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"System Security","name":"References security related windows services","description":"\"m Q8plOAVYjerswEO50+t22dbkV3CAm94bfehWMy56asU\" (Indicator: \"bfe\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00018556-00002332)\n Spawned process \"explorer.exe\" (UID: 00020107-00002732)\n Spawned process \"RegAsm.exe\" with commandline \"\"%APPDATA%\\itunes.exe\" OQsbBGdftE mdtMMiIUok\" (UID: 00020401-00002388)\n Spawned process \"RegAsm.exe\" with commandline \"\"%APPDATA%\\itunes.exe\" OQsbBGdftE mdtMMiIUok\" (UID: 00020450-00002864)\n Spawned process \"InstallUtil.exe\" (UID: 00020850-00003004)\n Spawned process \"InstallUtil.exe\" (UID: 00023618-00003140)\n Spawned process \"InstallUtil.exe\" (UID: 00026360-00003456)\n Spawned process \"InstallUtil.exe\" (UID: 00031734-00002956)\n Spawned process \"RegAsm.exe\" with commandline \"%APPDATA%\\file.txt\" (UID: 00032742-00003780)\n Spawned process \"RegAsm.exe\" with commandline \"-f \"%APPDATA%\\file.txt\"\" (UID: 00033047-00003764)\n Spawned process \"InstallUtil.exe\" (UID: 00039515-00002452)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}],"incidents":[{"name":"Remote Access","details_count":3,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"},{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Tries to identify its external IP address"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":32,"dropped_files_count":0,"extracted_files_count":11,"files_written_count":74,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":16,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"587cd735aac2edf15f89ffd6","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":76,"malware_family":"QVM03.0.0000.Malware","contacted_countries":["AUT","CHE","DEU","DNK","GBR","NOR","POL","RUS","SGP","USA"],"submit_name":"10.mov","analysis_start_time":"2017-01-16T15:23:44+00:00","indicators_count":{"informative":12,"suspicious":13,"malicious":10},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"78.47.139.102","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"128.31.0.39","port":9101,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"86.59.21.38","port":443,"protocol":"TCP","country":"Austria","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"62.220.148.97","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"195.1.41.6","port":9001,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"185.76.145.109","port":9001,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"104.131.184.21","port":9001,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"83.149.20.38","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"139.59.159.222","port":443,"protocol":"TCP","country":"Singapore","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"216.218.222.14","port":9002,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"144.76.53.125","port":9001,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"81.17.17.131","port":443,"protocol":"TCP","country":"Switzerland","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"46.41.130.68","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"213.141.138.174","port":9002,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"85.235.250.88","port":443,"protocol":"TCP","country":"Denmark","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"address":"163.172.167.28","port":9001,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}],"dns_resolutions":[{"domain":"myexternalip.com","address":"78.47.139.102","country":"Germany","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}],"http_requests":[{"host":"78.47.139.102","host_ip":"78.47.139.102:80","url":"/raw","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /raw HTTP/1.1\nHost: myexternalip.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}],"processes":[{"pid":2332,"ppid":0,"name":"10.mov.exe","command_line":"","normalized_path":"C:\\10.mov.exe","uid":"00018556-00002332","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAACcSURBVFhH7ZZhDoAgCEY9ukfzZhQrtxCT/Gq4Ndj4qT6fDEwpIgyEgb4BWi2GAdp0ZaJEJNMZSBtwBqJSikj1JDbQqzrat5cBAsF1owCmgY6agcMEeAjkB9ACnTUTAGEgDKw1kHMmToRiuhH1+kAFQEDENOQ5MBvciFoABKTaU+PZguoBIE8xWjO0dAX4+uC7/ZZ/47wuGuf8zMAGThXiToEru8UAAAAASUVORK5CYII="},{"pid":2732,"ppid":2332,"name":"explorer.exe","command_line":"","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00018556-00002332","uid":"00020107-00002732","icon":"$27"},{"pid":2388,"ppid":2732,"name":"RegAsm.exe","command_line":"\"%APPDATA%\\itunes.exe\" OQsbBGdftE mdtMMiIUok","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00020107-00002732","uid":"00020401-00002388"},{"pid":2864,"ppid":2388,"name":"RegAsm.exe","command_line":"\"%APPDATA%\\itunes.exe\" OQsbBGdftE mdtMMiIUok","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00020401-00002388","uid":"00020450-00002864"},{"pid":3004,"ppid":2732,"name":"InstallUtil.exe","command_line":"","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00020107-00002732","uid":"00020850-00003004"},{"pid":3140,"ppid":2732,"name":"InstallUtil.exe","command_line":"","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00020107-00002732","uid":"00023618-00003140"},{"pid":3456,"ppid":2732,"name":"InstallUtil.exe","command_line":"","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00020107-00002732","uid":"00026360-00003456"},{"pid":2956,"ppid":2732,"name":"InstallUtil.exe","command_line":"","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00020107-00002732","uid":"00031734-00002956"},{"pid":3780,"ppid":2732,"name":"RegAsm.exe","command_line":"%APPDATA%\\file.txt","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00020107-00002732","uid":"00032742-00003780"},{"pid":3764,"ppid":2732,"name":"RegAsm.exe","command_line":"-f \"%APPDATA%\\file.txt\"","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe","parent_uid":"00020107-00002732","uid":"00033047-00003764"},{"pid":2452,"ppid":2732,"name":"InstallUtil.exe","command_line":"","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","parent_uid":"00020107-00002732","uid":"00039515-00002452"}],"all_imported_dlls":["kernel32.dll","usp10.dll","sechost.dll","comctl32.dll","msasn1.dll","dhcpcsvc.dll","dwmapi.dll","msvcrt.dll","rpcss.dll","uxtheme.dll","sxs.dll","ws2_32.dll","ntdll.dll","KernelBase.dll","imm32.dll","cryptbase.dll","winnsi.dll","crypt32.dll","nsi.dll","msvbvm60.dll","user32.dll","gdi32.dll","advapi32.dll","rpcrt4.dll","oleaut32.dll","msctf.dll","lpk.dll","ole32.dll","shlwapi.dll","IPHLPAPI.DLL","shell32.dll","apphelp.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"file.txt","sha256":"afe12b0ba654c537ad19f93db71768c119058b14ca1efe8bacbb9046d744a767","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"itunes.exe","sha256":"7e70f4d4d0f49a354353490449d71cbec9eb8c5aac97222010390f6d539717b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"cached-microdesc-consensus.tmp","sha256":"50dcc4c2de17a24a5ffe09804cbfedf7b41cc94b7488d12a4829bb8e607478ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"unverified-microdesc-consensus.tmp","sha256":"50dcc4c2de17a24a5ffe09804cbfedf7b41cc94b7488d12a4829bb8e607478ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"itunes_ftp.dat","sha256":"873e284ffca13df1a9d2beeee24f0bf60e92e7328cbc6348f97988a4c7a3611b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"itunes_ge.dat","sha256":"6b18312d9336fcc836573344ffc8f7dbbca7f3c17d2c3bce67953b9f060f7c15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"cached-certs.tmp","sha256":"12a422ff31dea4821ab48cabecb13c85dde78566d5aea8ff4abfb57b841be9d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"cached-microdescs.new","sha256":"0361f7d92c7f50c248b028f6d96e3f9d7ef6c484fc8c41c2bb8f699bc7e9a4b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"cached-microdescs.tmp","sha256":"464d38292f2a12b36cca52bd09f2c4769118434566f69aa574a9de2f487ca07c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"state.tmp","sha256":"d094a25c66d2e953781595b20b37d2fc713dcfc594c596a8fb7ede2ea83f1e88","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"sx_res_bin.tmp","sha256":"76c7dc2c21ccdebbab038cd88fd665d87ee42dc26d01e3096482ac21fb09f3df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}],"files_written":[{"path":"%WINDIR%\\explorer.exe.config","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\22ae167d586450ad3a9b9a9ee43ebc86\\System.Windows.Forms.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\72269ea7cc6281139e4d155e7c57dc67\\System.Drawing.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\SortDefault.nlp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\95623e12dc6a64d28bad5b85f4c730ae\\System.Management.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\itunes.vbs","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe.config","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\ngen.log","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\51e2934144ba15628ba5a31be2dae7dc\\mscorlib.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System\\e40da7a49f8c3f0108e7c835b342f382\\System.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.V9921e851#\\536f3c2e6e4137a628f2f64e0dfd407e\\Microsoft.VisualBasic.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\b9f7adbc90a2bcbe8eb9e6e8d2bb975b\\System.Core.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\28586400bcaf94c13a9fd0dff4a1e090\\System.Configuration.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\9ba07396ae369d010c5c3927a82ef426\\System.Xml.ni.dll.aux","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\InstallUtil.exe","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\unverified-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-certs.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.new.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%TEMP%\\sx_res_bin.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.DLL","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\Ipswitch\\WS_FTP\\Sites\\ws_ftp.ini","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\file.txt","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\itunes_ftp.dat","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\itunes_ge.dat","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"C:\\Users\\5e8cJXU","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\lock","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\router-stability","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\geoip","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\geoip6","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-certs","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-consensus","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\unverified-consensus","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-microdescs","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-microdescs.new","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\unverified-microdesc-consensus","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-descriptors","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\cached-extrainfo","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\tor\\state.tmp","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"path":"%APPDATA%\\itunes.exe","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\OQsbBGdftE","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\OQsbBGdftE-module","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mdtMMiIUok","sources":[{"report_type":"sandbox","report_id":"587cd735aac2edf15f89ffd6"}]}]}},"report_ids":{"sandbox_job_ids":["587cd735aac2edf15f89ffd6"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample 8991ce3e98dd… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8991ce3e98dd…. Malware family: Malware. Threat score 76/100. 16/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 8991ce3e98dd… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8991ce3e98dd…. Malware family: Malware. Threat score 76/100. 16/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8991ce3e98dd732dafedd22723c51212278717e6d9583244bda5d1d178ba08d0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 8991ce3e98dd… — Score 76/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8991ce3e98dd…. Malware family: Malware. Threat score 76/100. 16/26 AV engines flagged this file. 7 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]