33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 3a:I[99539,["$1","$2","$3","$4","$5"],"IconMark"] 35:T434,Found HTTPS url "https://www.iana.org", Found HTTPS url "https://www.iana.or", Found HTTPS url "https://www.iana.", Found HTTPS url "https://trustedcomputinggroup.org", Found HTTPS url "https://github.com", Found HTTPS url "https://datatracker.ietf.org", Found HTTPS url "https://www.w3.org", Found HTTPS url "https://www.ian", Found HTTPS url "https://www.cdisc.org", Found HTTPS url "https://www.oasis", Found HTTPS url "https://www.qt.io", Found HTTPS url "https://www.tmforum.org", Found HTTPS url "https://www.astm.org", Found HTTPS url "https://www", Found HTTPS url "https://www.cta.tech", Found HTTPS url "https://www.iso.org", Found HTTPS url "https://c2pa.org", Found HTTPS url "https://yaml.org", Found HTTPS url "https://www.whatwg.org", Found HTTPS url "https://www.prostep.org", Found HTTPS url "https://www.ieee.org", Found HTTPS url "https://www.imsglobal.org", Found HTTPS url "https://ww", Found HTTPS url "https://www.nena.org", Found HTTPS url "https://lists.openid.net", Found HTTPS url "https://tracker.orgmode.org", Found HTTPS url "https://www.itu.int"36:T3110,Pattern match: "https://www.iana.org/go/rfc5934", Pattern match: "https://www.iana.org/assignments/media-type-sub-parameters", Pattern match: "www.iana.org/go/rfc4155", Pattern match: "https://www.iana.org/go/rfc6020", Pattern match: "https://www.iana.org/go/rfc9781", Pattern match: "https://www.iana.org/go/rfc4855", Pattern match: "https://www.iana.or", Pattern match: "https://www.iana.org/go/rfc8392", Pattern match: "https://www.iana.org/go/rfc8895", Pattern match: "https://www.iana.org/go/rfc8840", Pattern match: "https://www.iana.org/go/rfc10034", Pattern match: "https://www.iana.org/go/rfc4", Pattern match: "https://www.iana.org/go/rfc6030", Pattern match: "https://www.iana.org/go/rfc6381", Pattern match: "https://www.iana.org/go/rfc8081", Pattern match: "https://www.iana.org/go/rfc8846", Pattern match: "https://www.iana.org/go/rfc6849", Pattern match: "https://www.iana.org/go/rfc8130", Pattern match: "https://www.iana.org/go/rfc8790", Pattern match: "http://www.khronos.org", Pattern match: "https://www.iana.org/go/rfc2077", Heuristic match: "tarkkala>lauri tarkkala vnd.nearst.inv+json application/vnd.nearst.inv+json thom", Pattern match: "https://www.iana.org/go/rfc4856", Pattern match: "http://www.hl7.org", Pattern match: "https://www.iana.org/go/rfc8817", Pattern match: "https://trustedcomputinggroup.org/wp-content/uploads/tcg-dice-concise-evidence-binding-for-spdm-version-1.1-rc1_10april25.pdf", Pattern match: "https://www.iana.org/go/rfc4588", Pattern match: "https://www.iana.org/go/rfc6940", Pattern match: "https://www.iana.org/go/rfc9068", Pattern match: "https://www.iana.org/go/rfc5941", Pattern match: "https://www.iana.org/go/rfc6690", Pattern match: "https://www.iana.org/go/rfc4287", Pattern match: "iana.org/go/rfc6208", Pattern match: "https://www.iana.org/go/rfc7903", Pattern match: "https://www.iana.org/go/rfc7095", Pattern match: "https://www.iana.org/go/rfc6838#appendix-a", Pattern match: "https://www.iana.org/go/rfc7303", Pattern match: "https://www.iana.org/go/rfc4730", Heuristic match: "> 2023-09-11 victor kuchynsky vk&logipipe.com 2019-05-04 rajesh kumar application/vnd.cncf.helm.config.v1+json andrew block vnd.coffeescript applic", Pattern match: "https://www.iana.org/go/rfc7741", Pattern match: "https://www.iana.org/go/rfc3555", Pattern match: "https://www.iana.org/go/rfc1874", Pattern match: "https://www.iana.org/go/rfc4733", Pattern match: "https://www.iana.org/go/rfc2045", Pattern match: "https://www.w3.org/community/shacl", Pattern match: "https://www.iana.org/go/rfc9112", Pattern match: "https://www.iana.org/go/rfc7946", Pattern match: "http://www.w3.org/tr/mathml3/appendixb.html", Pattern match: "https://www.iana.org/go/rfc8427", Pattern match: "http://www.w3.org/tr/2007/cr-rdf-sparql-xmlres-20070925/#mime", Pattern match: "https://www.iana.org/go/rfc9584", Pattern match: "https://www.iana.org/go/draft-ietf-sidrops-rpki-ccr-11", Pattern match: "https://www.iana.org/go/rfc9292", Pattern match: "https://www.iana.org/go/rfc3745", Pattern match: "https://www.iana.org/go/rfc1895", Pattern match: "www.iana.org/go/rfc9528", Pattern match: "https://www.iana.org/go/rfc6917", Pattern match: "https://www.iana.org/go/rfc6015", Pattern match: "https://www.iana.org/go/rfc5334", Pattern match: "https://www.iana.org/go/rfc9457", Pattern match: "https://www.iana.org/go/draft-demosra-mtsv-01", Pattern match: "https://www.cdisc.org/", Pattern match: "https://www.iana.org/go/rfc7265", Pattern match: "https://www.iana.org/go/rfc9237", Pattern match: "https://www.iana.org/go/rfc4267", Pattern match: "https://www.iana.org/go/rfc5707", Pattern match: "https://www.iana.org/go/rfc9695", Pattern match: "https://www.iana.org/go/draft-ietf-suit-manifest-34", Pattern match: "https://www.iana.org/go/rfc5955", Pattern match: "https://www.iana.org/go/rfc2122", Heuristic match: " var at = text.tolowercase().indexof(term); if (at === -1) return; var mark = document.createelement(mark); mark.textcontent = text.substr(at, term.length); var fragment = document.createdocumentfragment(); f", Pattern match: "https://www.iana.org/go/rfc6035", Pattern match: "https://www.iana.org/go/rfc1314", Pattern match: "https://www.iana.org/go/rfc9943", Pattern match: "https://www.oasis-open.org", Pattern match: "https://www.iana.org/go/rfc6682", Pattern match: "https://www.iana.org/go/rfc9290#section-6.3", Pattern match: "https://www.qt.io", Pattern match: "http://www.jtc_1sc34.org/repository/0661.pdf", Pattern match: "https://www.iana.org/go/rfc5022", Pattern match: "https://www.iana.org/go/rfc9636", Pattern match: "https://www.iana.org/go/rfc3902", Pattern match: "https://www.iana.org/go/rfc4709", Pattern match: "https://www.tmforum.org", Pattern match: "https://www.iana.org/go/rfc3190", Pattern match: "https://www.iana.org/go/rfc5730", Pattern match: "w.iana.org/go/rfc5707", Pattern match: "https://www.iana.org/go/rfc3391", Pattern match: "https://www.astm.org", Pattern match: "https://www.iana.org/go/rfc4735", Pattern match: "https://www.iana.org/go/rfc4708", Pattern match: "https://www.iana.org/go/rfc6922", Pattern match: "https://datatracker.ietf.org/doc/minutes-interim-2025-iesg-19-202509251400/", Pattern match: "https://www.cta.tech", Pattern match: "https://trustedcomputinggroup.org", Pattern match: "https://www.iana.org/go/draft-ietf-cose-cbor-encoded-cert-20", Pattern match: "http://www.iso.org/iso/jtc_1_home.html", Pattern match: "https://www.iana.org/go/rfc6354", Pattern match: "https://www.iana.org/go/rfc8555", Pattern match: "https://c2pa.org", Pattern match: "https://www.iana.org/go/rfc9999#section-4.2", Pattern match: "https://www.iana.org/go/rfc9052", Pattern match: "https://www.iana.org/go/rfc6066", Pattern match: "https://www.iana.org/go/rfc8292", Pattern match: "http://www.w3.org/tr/2007/rec-xslt20-20070123/#media-type-registration", Pattern match: "https://www.iana.org/go/rfc5215", Pattern match: "http://www.w3.org/tr/2009/cr-exi-20091208/#mediatyperegistration", Pattern match: "https://www.iana.org/go/draft-ietf-ohai-chunked-ohttp-08", Pattern match: "https://www.iana.org/go/rfc4103", Pattern match: "https://www.iana.org/go/rfc4826", Pattern match: "https://www.iana.org/go/rfc3640", Pattern match: "https://www.whatwg.org/", Pattern match: "https://www.iana.org/go/draft-ietf-oauth-rfc7523bis-11", Pattern match: "https://www.iana.org/go/rfc6230", Pattern match: "https://www.iana.org/go/rfc4825", Pattern match: "https://www.iana.org/go/rfc5574", Pattern match: "https://www.iana.org/go/rfc7464", Pattern match: "https://www.iana.org/go/rfc3302", Pattern match: "https://www.iana.org/go/rfc6838#section-3.1", Pattern match: "na.org/go/rfc7061", Pattern match: "https://www.iana.org/go/rfc2652", Pattern match: "https://www.iana.org/go/rfc8351", Pattern match: "https://www.iana.org/go/rfc9649", Heuristic match: ".oob application/vnd.ms-windows.nwprinting.oob justin hutchings vnd.ms-wi", Pattern match: "https://www.iana.org/go/rfc8613", Pattern match: "https://www.iana.org/go/rfc4180", Pattern match: "https://www.iana.org/go/rfc2046", Pattern match: "https://www.iana.org/go/rfc8428", Pattern match: "https://www.iana.org/go/rfc7826", Pattern match: "https://www.iana.org/go/rfc4788", Pattern match: "https://www.iana.org/go/rfc4352", Pattern match: "https://www.iana.org/go/rfc5222", Pattern match: "https://www.iana.org/go/rfc7846", Pattern match: "https://www.iana.org/go/rfc8894", Pattern match: "https://www.iana.org/go/rfc9200", Pattern match: "https://www.prostep.org/", Pattern match: "http://www.w3.org/tr/2007/cr-emma-20071211/#media-type-registration", Pattern match: "https://www.iana.org/go/rfc3625", Pattern match: "https://www.iana.org/go/rfc9782", Pattern match: "https://www.iana.org/go/rfc9559", Pattern match: "https://www.iana.org/go/rfc7763", Pattern match: "www.iana.org/go/rfc2046", Pattern match: "https://www.ieee.org", Pattern match: "https://www.iana.org/go/rfc9639", Pattern match: "https://www.iana.org/go/rfc9101", Pattern match: "https://www.iana.org/go/rfc7285", Pattern match: "https://www.iana.org/go/rfc4235", Pattern match: "https://www.iana.org/go/rfc4536", Pattern match: "https://www.w3.org/tr/png/", Pattern match: "https://www.nena.org", Pattern match: "https://www.iana.org/go/rfc5362", Pattern match: "https://www.iana.org/go/rfc7517", Pattern match: "https://www.iana.org/go/rfc9594", Pattern match: "https://www.iana.org/go/rfc8520", Pattern match: "https://www.iana.org/go/rfc3801", Pattern match: "https://www.iana.org/go/draft-ietf-teep-protocol-26", Pattern match: "https://www.iana.org/go/rfc6960", Pattern match: "https://www.iana.org/go/rfc4263", Pattern match: "https://www.iana.org/go/draft-pantos-hls-rfc8216bis-22", Pattern match: "https://www.iana.org/go/rfc7852", Pattern match: "ww.iana.org/go/rfc5545", Pattern match: "http://www.aes.org", Pattern match: "https://lists.openid.net/mailman/listinfo/openid-specs-ab", Pattern match: "http://www.smpte.org", Pattern match: "w.iana.org/go/rfc5577", Pattern match: "https://tracker.orgmode.org/", Pattern match: "https://www.iana.org/go/draft-pantos-content-steering-05", Pattern match: "https://www.iana.org/go/rfc8450", Pattern match: "https://www.iana.org/go/rfc9240", Pattern match: "https://www.iana.org/go/rfc9110#section-12.5.1", Pattern match: "https://www.iana.org/go/rfc6884", Pattern match: "http://www.3mf.io/specification", Pattern match: "https://www.iana.org/go/rfc5698", Pattern match: "https://www.iana.org/go/rfc4329", Pattern match: "https://www.iana.org/go/rfc5655", Pattern match: "www.iana.org/go/rfc6533", Pattern match: "https://www.iana.org/go/rfc9528", Pattern match: "https://www.iana.org/go/rfc8627", Pattern match: "https://www.itu.int", Pattern match: "https://www.iana.org/go/rfc9635", Pattern match: "https://www.iana.org/go/rfc8040", Pattern match: "https://www.iana.org/go/rfc8876", Pattern match: "http://www.w3.org/tr/svg/mimereg.html", Pattern match: "https://www.iana.org/go/rfc4745", Pattern match: "https://www.iana.org/go/rfc4194", Pattern match: "http://3mf.io", Pattern match: "a.org/go/rfc4629", Heuristic match: " }); } // ===== scroll tracking ===== var sections = array.prototype.map.call( nav.queryselectorall('a[href^=#]'), function (a) { return {link: a, target: fragmenttarget(a.getattribute(href))}; } ", Pattern match: "https://www.iana.org/go/rfc3823", Pattern match: "https://www.iana.org/go/rfc7193", Pattern match: "https://www.iana.org/go/rfc5055", Heuristic match: "> 2009-03-04 mike ward mcw&dolby.com 2007-06-18 fred waskiewicz vnd.ms-3mfdocument application/vnd.ms-3mfdocument shawn maloney vnd.ms-excel gbrammer&gmx.de 2007-06-12 sascha brawer sascha&brawer.ch 2025-04-17 ron brill ronb&anglepoint.com 2019-09-03 john brinkman john.brinkman&adobe.com 2007-05-22 ryan brinkman rbrinkman&bccrc.ca 2010-03-26 broadband forum help&broadband-forum.org 2019-12-13 tim brody greg vaudreuil vnd.rip audio/vnd.rip martin dawe vnd.sealedmedia.softseal.mpeg audio/vnd.sealedmedia.softseal.mpeg david petersen vnd.vmx.cvsd audio/vnd.vmx.cvsd greg vaudreuil vorbis audio/vorbis rfc 5215 vorbis-config audio/vorbis-config rfc 5215 " [Source: sample.bin], Observed email domain:"rg falkenberg j.falkenberg&cabgmbh.com 2007-01-18 benja fallenstein b.fallenstein&gmx.de 2003-10-20 patrik faltstrom paf&nada.kth.se betsy fanning betsy.fanning&pdfa.org 2022-04-29 michael c. fanning mikefan&microsoft.com 2021-04-26 dirk farin dirk.farin&gmail.com 2017-04-12 david faure nils langhammer nils.langhammer&miele.de 2014-05-01 michael laramie laramiem&btv.ibm.com 1999-02-19 steven lasker stevenlasker&hotmail.com 2020-04-09 kevin lau kevinlau&microsoft.com 2006-09-29 juern laun juern.laun&gmx.de 1999-04-19 jeff lawson jlawson&ud.com 2006-09-14 <" [Source: sample.bin]38:T431," Kerrick Staley kerrick&kerrickstaley.com 2015-09-01 Peter Stark stark&uplanet.com 1999-03-19 Sebastian Stenzel sebastian.stenzel&skymatic.de 2021-04-12 Michael Steidl mdirector&iptc.org 2014-01-29 William Stevenson dev&maxmind.com 2014-07-25 Thomas Stockhammer stockhammer&nomor.de 2013-03-29 " (Indicator: "maxmind.com"; File: "sample.bin")39:T420,"nz Friederes fraenz&frieder.es 2019-07-25 Randolph Fritz rfritz&u.washington.edu 2009-03-04 Kiyofusa Fujii kfujii&japannet.or.jp 1997-02-19 Shuji Fujii fujii&centurysys.co.jp 2012-04-20 Arild Fuldseth Arild.Fuldseth&fast.no 2000-06-20 David Furbeck dfurbeck&blackberry.com 2013-09-06 Amir Gaash " (Indicator: "blackberry.com")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample 8ad4d626fafe… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample 8ad4d626fafe…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"urlref_httpwww.iana.orgassignmentsmedia-types\",\"applicationCategory\":[\"html\"],\"identifier\":\"8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":24},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":2},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793930653142,"unified_at":"2026-11-06T02:04:13.142Z","metadata":{"hashes":{"sha256":"8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04","sha1":"a3b5b69dd759b8e63641b859deeaaedd1b58dc08","md5":"48781621e91a8e1c31ff20890c8b66c9"},"file_info":{"file_name":"urlref_httpwww.iana.orgassignmentsmedia-types","file_type":["html"],"file_type_id":"html","file_size":762533,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793930646000,"last_seen":1793930646000,"last_multi_scan":1793930646000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":13,"suspicious_count":2,"malicious_count":0,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"},{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to evade Sandbox environment"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to access file/directory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"suspicious","value":"Reference to an external IP address lookup service identified"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Able to copy folder/file using ditto command"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Able to download payload"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"$35","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$36","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to download payload","description":"file/memory contains long string with (Indicator: \"curl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-10039","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-169","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Reference to an external IP address lookup service identified","description":"$38","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-56","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"file/memory contains long string with (Indicator: \"aes\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \".encrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"file/memory contains long string with (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"$39","origin":"sample.bin","id":"string-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"file/memory contains long string with (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access file/directory","description":"file/memory contains long string with (Indicator: \".delete(\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-779","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to evade Sandbox environment","description":"file/memory contains long string with (Indicator: \"vmware\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497","id":"string-10035","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.007","id":"string-626","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"file/memory contains long string with (Indicator: \"youtube\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"netflix.com\"; Source: \"sample.bin\")","origin":"sample.bin","id":"string-10","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to copy folder/file using ditto command","description":"file/memory contains long string with (Indicator: \"ditto \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1005","id":"string-10085","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample 8ad4d626fafe… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 8ad4d626fafe…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04"}],["$","meta","4",{"property":"og:title","content":"Sample 8ad4d626fafe… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 8ad4d626fafe…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8ad4d626fafe94665c573d3b62e961a1d079be7948f12990f66998d092e81a04"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 8ad4d626fafe… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 8ad4d626fafe…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3a","11",{}]] 32:null