26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T483,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Deshacop Sample 8af2cc0bfb02… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8af2cc0bfb02…. Malware family: Trojan.Deshacop. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e","keywords":["Malicious","Trojan.Deshacop","malware analysis","sandbox report","threat intelligence","8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Deshacop","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4db,Heuristic match: "Microsoft.NET" Pattern match: "https://localbitcoins.com" Pattern match: "https://www.coinbase.com" Pattern match: "https://xchange.cc" Pattern match: "https://tpc.googlesyndication.com/simgad/7275976128475430912','clickTFTextFontName" Pattern match: "https://tpc.googlesyndication.com/simgad/7275976128475430912','text1TFTextFontName" Pattern match: "https://tpc.googlesyndication.com/simgad/7275976128475430912','displayUrl" Pattern match: "www.webling.eu/funktionen.php','destinationUrl" Pattern match: "https://www.webling.eu/verein.php','format" Pattern match: "https://tpc.googlesyndication.com/simgad/7128766069743395798','FLAG_client_side_flag_overrides" Heuristic match: "!2|D1?1_4fkow,#ts'zJ)/ZV)7yXyckTFTextColor': '0xf8f8f8','clickTFTextFont': 'arialbd','clickTFText': 'Hier weiter','text2TFTextColor': '0x444444','text2TFTextFont': 'arial','text2TFText': 'Benutzerfreundlich und einfach','text1TFTextColor': '0x092d4d','text" Heuristic match: "z*w\-\HI`FoKs=Qt<2W;n%hYp1|2HvVzm l3Bd#Z~[NZAt~J?Dl3'.xDCpLt6xotE(p\plA93oiH0{{;]z]F+= ]/,+J_z/(i])4~o7]2J+[k>62-}%ij^9Q3Vj`k]q2^w`&ryQ{:vouP9?Cxr8Rv|<0 3F3M6$g{k$Fp}S}olrZ/nmb`!\TKB->wH.{]c/_U!WU< *1`C`q18ITyzj.dk" Pattern match: "Qg0Wg.Oo/4{2,9iap_jOnLw"28:T1072," How to back my files?

...

-->

...

-->

... -->

57 51 D6 C6 55 8D 46 80 F0 E7 4F B3 27 3D FF 7C 2E B7 38 5E 50 1C 69 31 D2 56 67 5A 3C 78 E1 76 B7 98 A3 D9 29 5E 99 A0 3F 06 BD FD 94 E7 BC DE 1A C0 95 82 40 22 0D A0 E5 32 2B 76 49 6E FB BB 16 DD 1C 47 9B 72 52 1D 60 A2 6E 64 4A D4 D9 46 03 8E FE B7 A4 12 59 05 6E 08 8E 3B 06 7B A8 18 F5 F7 BB 91 13 AE 1B 84 32 DD C8 8D 57 3A AC FF B2 CC FA 1A B4 51 74 53 1D 96 6B 10 50 AB 2F 05

Your documents, photos, databases and other important files have been encrypted!

To decrypt your files, you must purchase the special software "Decryptor"
Data recovery requires a decoder.

Site for buy bitcoin:

Buy 2 BTC on one of these sites

https://localbitcoins.com
https://www.coinbase.com
https://xchange.cc

Bitcoin adress for pay:

1MDfQMYSF586GMjwEYxnesAcRhsobEd4BD

Send now 2 BTC for decrypt (Later 4 BTC)

To get a decoder, contact me by email:

btc.me@india.com

Reserve e-mail:

BM-2cXpCihgsVxB31uLjALsCzAwt5xyxr467U@bitmessage.ch

Attention!

No Payment = No decryption
You really get the decryptor after payment
Do not attempt to remove the program or run the anti-virus tools
Attempts to self-decrypting files will result in the loss of your data
Decoders other users are not compatible with your data, because each user's unique encryption key

... !!! !!! -->

... -->

" (Source: how_to_back_files.html, Indicator: "decrypt your files") "

Your documents, photos, databases and other important files have been encrypted!

" (Source: how_to_back_files.html, Indicator: "files have been encrypted") "

To decrypt your files, you must purchase the special software "Decryptor"
" (Source: how_to_back_files.html, Indicator: "decrypt your files")29:T6a5,"" opened "C:\autoexec.bat" with delete access "" opened "C:\config.sys" with delete access "" opened "C:\Users\desktop.ini" with delete access "" opened "%PUBLIC%\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\desktop.ini" with delete access "" opened "%PUBLIC%\Videos\Sample Videos\Wildlife.wmv" with delete access "" opened "%PUBLIC%\Recorded TV\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\desktop.ini" with delete access "" opened "%PUBLIC%\Recorded TV\Sample Media\win7_scenic-demoshort_raw.wtv" with delete access "" opened "%PUBLIC%\Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Chrysanthemum.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Desert.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\desktop.ini" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Hydrangeas.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Jellyfish.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Koala.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Lighthouse.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Penguins.jpg" with delete access "" opened "%PUBLIC%\Pictures\Sample Pictures\Tulips.jpg" with delete access2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790442482694,"unified_at":"2026-09-26T17:08:02.694Z","metadata":{"hashes":{"sha256":"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e","sha1":"5f18acd983fdca06491a314ce31079c68cc894c6","md5":"c1987b9d242524906793c89953a629e5","sha512":"fe42c161e2baa16c5d44115281b9dbffee1b0424d574f1fa5cde62f6f47c4e7070c9be50131727016d0925d75bd0e287ed8886ca712b940fe0bff171d06e4d4c","ssdeep":"1536:nBx+BdTk/6CebW4OPExGRc9Mmi3c3eC1sWjcdBhqz91:nBozh0RcjeLBhqP","ssdeep_chunks":["1536:nBx+BdT","1536:Bx+BdTk","1536:x+BdTk/","1536:+BdTk/6","1536:BdTk/6C","1536:dTk/6Ce","1536:Tk/6Ceb","1536:k/6CebW","1536:/6CebW4","1536:6CebW4O","1536:CebW4OP","1536:ebW4OPE","1536:bW4OPEx","1536:W4OPExG","1536:4OPExGR","1536:OPExGRc","1536:PExGRc9","1536:ExGRc9M","1536:xGRc9Mm","1536:GRc9Mmi","1536:Rc9Mmi3","1536:c9Mmi3c","1536:9Mmi3c3","1536:Mmi3c3e","1536:mi3c3eC","1536:i3c3eC1","1536:3c3eC1s","1536:c3eC1sW","1536:3eC1sWj","1536:eC1sWjc","1536:C1sWjcd","1536:1sWjcdB","1536:sWjcdBh","1536:WjcdBhq","1536:jcdBhqz","1536:cdBhqz9","1536:dBhqz91","3072:nBx+BdT","3072:Bx+BdTk","3072:x+BdTk/","3072:+BdTk/6","3072:BdTk/6C","3072:dTk/6Ce","3072:Tk/6Ceb","3072:k/6CebW","3072:/6CebW4","3072:6CebW4O","3072:CebW4OP","3072:ebW4OPE","3072:bW4OPEx","3072:W4OPExG","3072:4OPExGR","3072:OPExGRc","3072:PExGRc9","3072:ExGRc9M","3072:xGRc9Mm","3072:GRc9Mmi","3072:Rc9Mmi3","3072:c9Mmi3c","3072:9Mmi3c3","3072:Mmi3c3e","3072:mi3c3eC","3072:i3c3eC1","3072:3c3eC1s","3072:c3eC1sW","3072:3eC1sWj","3072:eC1sWjc","3072:C1sWjcd","3072:1sWjcdB","3072:sWjcdBh","3072:WjcdBhq","3072:jcdBhqz","3072:cdBhqz9","3072:dBhqz91","1536:nBozh0R","1536:Bozh0Rc","1536:ozh0Rcj","1536:zh0Rcje","1536:h0RcjeL","1536:0RcjeLB","1536:RcjeLBh","1536:cjeLBhq","1536:jeLBhqP"],"imphash":"68a0bd52d65861c4403a63bff22e93d8"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":100352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286951000,"last_seen":1677375426000,"last_multi_scan":1677375426000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":12,"malicious_count":5,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Deshacop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Crypren.CB7D11A1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/GlobeImposter.HKWA-0316","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Ransom.Crypren.CB7D11A1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.FV trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00518fab1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deshacop.fog","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXBO-GI!C1987B9D2425","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Deshacop.eoqwvh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_.437BF656","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_.437BF656","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Encoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Deshacop.Win32.827","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Deshacop","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00017121-00002524-63370-19-00409BF8\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00017121-00002524-63370-10-00409BC7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00017121-00002524-63370-206-004096E7","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00017121-00002524-63370-70-0040439E\n GetProcessHeap@KERNEL32.DLL at 00017121-00002524-63370-92-004045B1\n GetProcessHeap@KERNEL32.DLL at 00017121-00002524-63370-205-00406B19","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\qfjgmfgmkj.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00017493-00002492)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"how_to_back_files.html\" has type \"HTML document UTF-8 Unicode text with CRLF LF line terminators\"\n \"deployment.properties\" has type \"data\"\n \"autoexec.bat\" has type \"data\"\n \"blogger.com.url\" has type \"data\"\n \"jDJAedKZ.txt\" has type \"data\"\n \"9rNtWnjTq9RGbU.exe\" has type \"data\"\n \"metrolyrics.com.url\" has type \"data\"\n \"webapps.json\" has type \"data\"\n \"5yqb2pxbZ.txt\" has type \"data\"\n \"netlog.com.url\" has type \"data\"\n \"ocNqp38QzZ.jpg\" has type \"data\"\n \"NTUSER.DAT.LOG\" has type \"data\"\n \"healthreport.sqlite\" has type \"data\"\n \"windowprefs.xml\" has type \"data\"\n \"CE95114622634B41823E2186167B85810C065D80\" has type \"data\"\n \"surveymonkey.com.url\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\vssadmin.exe\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.79420394232","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00017121-00002524-63370-308-0040AC84","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"Found dropped filename \"PSPUBWS.contact\" containing the Windows username \"PSPUBWS\"","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00017121-00002524-63370-68-00404679\n FindResourceW@KERNEL32.DLL at 00017121-00002524-63370-65-0040479F\n FindResourceW@KERNEL32.DLL at 00017121-00002524-63370-137-004046E5","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\desktop.ini\"\n \"\" read file \"%PUBLIC%\\Videos\\Sample Videos\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"$28","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 895 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00017121-00002524-63370-136-00401000","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$29","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeA\n FindNextFileA\n GetTempPathA\n WriteFile\n OutputDebugStringW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n LoadLibraryA\n GetStartupInfoW\n GetProcAddress\n GetFileSizeEx\n FindFirstFileA\n FindFirstFileW\n CreateFileW\n CreateFileA\n LockResource\n GetCommandLineA\n GetModuleHandleW\n CreateProcessA\n FindResourceW\n Sleep\n ShellExecuteA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"20/61 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"20/61 Antivirus vendors marked sample as malicious (32% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"20/61 Antivirus vendors marked spawned process \"\" (PID: 2524) as malicious (classified as \"Gen:Variant.Graftor\" with 32% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00017493-00002492)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"UserCache.bin\" which has been seen in the context of ransomware (Indicator: .bin)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]}],"incidents":[{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":28,"dropped_files_count":0,"extracted_files_count":61,"files_written_count":49,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"591215acaac2ed514ba8085b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","submit_name":"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e","analysis_start_time":"2017-05-09T21:17:38+00:00","indicators_count":{"informative":10,"suspicious":16,"malicious":7},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}],"processes":[{"pid":2524,"ppid":0,"name":"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e.exe","command_line":"","sha256":"8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e","normalized_path":"C:\\8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e.exe","uid":"00017121-00002524","icon":"$2a"},{"pid":2492,"ppid":2524,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00017121-00002524","uid":"00017493-00002492","icon":"$2b"}],"all_imported_dlls":["ntdll.dll","KernelBase.dll","gdi32.dll","usp10.dll","shlwapi.dll","imm32.dll","cryptbase.dll","atl.dll","kernel32.dll","msvcrt.dll","sechost.dll","ole32.dll","msctf.dll","oleaut32.dll","rsaenh.dll","vssapi.dll","user32.dll","shell32.dll","apphelp.dll","cryptsp.dll","vsstrace.dll","clbcatq.dll","RpcRtRemote.dll","lpk.dll","advapi32.dll","rpcrt4.dll","rpcss.dll","vss_ps.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"RecordedTV.library-ms","sha256":"65d25f4f73124cbc3513cf4282bfb4c0e7393bf5152d1ebf5021ed0dc7fca5d6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Maid with the Flaxen Hair.mp3","sha256":"bdd8b486fbf806b2310d15d2179b55f8eef04b81b0c51992333f5321a1090cdf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Sleep Away.mp3","sha256":"3321eb8290954055cf46b259d27fa1d602c499e153a00007e4adf8cacc5674ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Chrysanthemum.jpg","sha256":"0ed99303167044ab99d2963afcaf797fa14d31f925a4caf90ed9470d2bbc31a6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Desert.jpg","sha256":"d33e8ba789a9ea94dcceed782cb777b1e8a2cd35280c5d0eee894d025caf05e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Hydrangeas.jpg","sha256":"a5100d17bfd25524f6cbdac73cb7e0d7c67f52f5b4d7751d917379c0e695ce0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Jellyfish.jpg","sha256":"aac72b273540e301a5c316a9f2e73ded8ba7dd9985d09ead324c0b950581e7f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Koala.jpg","sha256":"24be8879e70bd8a38f17c2a78b975d56f9f36420d9423b897f74af84a5f6dfcd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Lighthouse.jpg","sha256":"9592e798f5807a89ac0a3b63f820cd64d692ac02b6c26e9dc463093bb8abd40e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Penguins.jpg","sha256":"159aed10c7beab4c08200d5f266bf575938fab71bfdcaad0930628eddee1b4d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Tulips.jpg","sha256":"a6570a582dfe773032de1b33c657baca3c365adc2e871f837f68a64b8ee72d2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"qfjgmfgmkj.tmp","sha256":"71b269b065474a8f97fcb79fc1d10954b407098f6bf9cfca1ee180b3bb74ffbc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Desktop background.png","sha256":"2488a50c99c91f180bb9a8a7d2d538ba328210695b7bc349f1626587eeea8aa9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"GobiernoUSA.gov.url","sha256":"3e1124104f46d95edaa4d39d247bda316f23e37982cbf4a488ba9f72530b211c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"USA.gov.url","sha256":"4d5c51c424af353bae6d6d0c9352061327e049eec5f089aadd0ddacf61d2dc48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"1616.net.url","sha256":"0b911292907f29d419ba06e0ce9fb264dabd854a359dff3fca65c0dbeeb648ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"163.com.url","sha256":"cda29ca9b52b0edf92b306adefa1bf5e84a29ef03da021f09c1c35005882648c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"17kuxun.com.url","sha256":"714a84cd53a6cb554430c973879914ed9c921786ff83d0fcdb7664ad64c494af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"2345.com.url","sha256":"cf18ee5a5a69751947a00f63fb47fcf50367b8d15c0cc3e2d08c1bcbc1d59bd9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"27.cn.url","sha256":"2541fa847cfc6a41df782c92fff22c1073bf549a1faacc489f0a2dd66c5fee1c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Desktop.lnk","sha256":"831bb84be64d870d05e9760e02ea8b92bfebf1c9e81f8dbadbee818278a5527c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Downloads.lnk","sha256":"336b8b31dba0abed7400272e049d0711b3845d9ad29e633095db2548a0f04ca4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"RecentPlaces.lnk","sha256":"cbefc7feade009bf03201bfe317943510d26f39127f4aeee7da5572ae6e0698b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"autoexec.bat","sha256":"7d49bb106e5bef3454b738d7d3f29e8b7032a76c00f8e72debaaf372e2f4d323","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"9rNtWnjTq9RGbU.exe","sha256":"0da560009a65f76ee1360d2fdab3f291e0bf7ac57f6846ca7d2cf72b0ed173fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"yZw6snqBQ28DAzu.exe","sha256":"b39f0de24ed0ad3be2f89346d7c350e028274af8376b30be5bb2dacaef9a03a9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"rRgk91Ih5n.doc","sha256":"3c099dbbe0cb3f854755bb0533cde7e8453b137fbf6c4a8c9ab411db1e669193","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"dH1rDN9f9.doc","sha256":"ce701cd5c485a27380bd3178043e7e2b7ffc486688dc16e07eed5089622e0bd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"UserCache.bin","sha256":"0829e92ad42dc15336bd8aea82ecd9c4ec11a5c12752f49c7dfcbcf81c4a54f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"6SZfLTu9z.doc","sha256":"5875e5021050db4875d37c76002a9419e7f1395e8e773e70f82a4d12814903f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"securitypack.jar","sha256":"de2f8350a90c3e89a6fc03fd0fe3fb7c0c5449791ad63f8537408f1fe823949f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"e8ee792eb86d14c845dc44db8bb6df7847bb7e36339e67ed2857cf5167166d16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"C04T72pR0Bcl.doc","sha256":"5298aa3063c58617b5714fae2376505f6f9c0aa13255292b13b04df1d92f81c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"w5JaoO.doc","sha256":"2b5e96650b9573db6229052c40fec6798cda0ed74e9133fb2cc4f7ca59e5c85c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"6WMjwc1zqk3IB.exe","sha256":"8798f5b367cd698ee20569ed4e3bb695084f98e7b15850db790f39a10e269402","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"tDUzYwYK5f.exe","sha256":"064e090c7066296afec54725a0af95c437c2dadfe36dd4dcee17cbcf7a0ce0c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"kdo6iAicsoicvHg.exe","sha256":"68d9902767e9475e5141404fae29c7d12ac53e0f7373096eeb607e6e37b3094c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"dskCEJ.exe","sha256":"7a48f30b6573bcb504505cd8a1f2671f590e68b3b8f5d9daf9d8bb95c5a70790","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"kY01UeAiy5.exe","sha256":"bd99e023b46d06ae8186bd42306816c2dbafd3baa488ed84c1bb0fe6a7c4fccb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"AcroRead.msi","sha256":"057af762e3f20ec8fda0aeae572f3ce8021d1b80521f1e0efdb0c559d27c7b5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"hlchPBL.exe","sha256":"bb35c80d4c434e11af80028dcb42515129927ba512ef197c0cd9ac6cc89f43ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"bg3oTe.doc","sha256":"ec9c3dbcaf4760bab6ebe5afdd9d4fefceed8a1ca24e691d9d416a49ecf14032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"javaws.exe","sha256":"e955111df35d737d3ae3509e9c551ea5e5fb6a15e4e46290a45a008865ef5508","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"0zIG0D.doc","sha256":"b83bb5936041139e4ebd0eb7de7ea3151850e5a36b35a2b571782f289bb98695","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"javaw.exe","sha256":"30acdfbdee46aebb4f88cfebc9ee86485f2e10e1d8f6ed94a857019d0087463d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"a3Ntx.exe","sha256":"c890e4280ff10e47b3d2b57769361e1fce7e5999c4039914f09c0d429dd28ca8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"iLLOga.exe","sha256":"2ea680c22ece3a74f584afa5e2610009a0562bb9f519590094bc365d95c9b9ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"java.exe","sha256":"f04ae560c2956d43585d145837d7623e2e27a595c5ce1f980b3066b5a2c91dae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"klmqz.doc","sha256":"0a7ce1061a497e64aa967ce5be83ecda6548c7e9193e9d7b5ab200793f4d11b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"mtgFs8Za.doc","sha256":"19bb2ae1283a32e78eeafe4c03f95e3b1ba2adbc3a69d0d9d209b7224a0dff2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"bvYkKJ33N9A.exe","sha256":"9bf7b7dcaa0aa738fc628b7c72be96c03919b1662850b95487f365aeb8490ffb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"F3hzum1.doc","sha256":"4245a1b2b91fba732d88b71c5eed1f413edcc6aa9ce87ab8b1efaea87c89cbe6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"Tmg2wsFHYf9ioO.doc","sha256":"b8bd0369e5931786504d53aaf1304e2f2812f56decc74f90a175d412fa700240","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"hKY8.doc","sha256":"87fffd27e71e0d58e177614609d06b1a8d96d6342d724c8eed1a6a81ed5728fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"setup.exe","sha256":"f1f8b1f8c2dd80a4e3f339369ca9059a9834836d24df4a748e8725ceb0c0eca6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"9289c6675d4f84a5f8cb2852ae65e361415fbfd4b53ac1c6a32dd5a58604bd4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"2aa4d7cd5ef04a90b0c9514954071e80857f50e670fa90d361a0b44a738f137e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"EKeaJO.doc","sha256":"8d6eacc01abbc8f7eb47d0e59cf4eb707f875b73de00852ddc85cfc9157206d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"0pYWspjURe8aqA.exe","sha256":"7c941ae35e7bd4ba5fa9272e6f28aee10299a491f7e572a3ca4ae5f76b9b5baf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"dgQJde60mPXhI.exe","sha256":"7368b535a8c627f82250d7f5f57f545f7a2234a343a66b342f34b66e8d5a340c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"name":"63sDzrkUoHoRT.exe","sha256":"cb1f5ecfe627e7bdbf65cf003531d05104cf4029c5ab8ad0822a5161979bb47d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]}],"files_written":[{"path":"%TEMP%\\qfjgmfgmkj.tmp","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\1494357480391$MAPFAILURE","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\1494357480391$OK","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\Vkc.7E1","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e.exe","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%WINDIR%\\system32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\pagefile.sys","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\6TboZZf8bFzMS.M7V","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\JxS6UTkFE5KachMGJ8F0.skM","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\iHvmUE5wWDozBO2ayJ1BGPNK.2o1","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\bCKwCP5oN.fc0","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\thWbRjfIr.3e6","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"C:\\Users\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Videos\\Sample Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Recorded TV\\Sample Media\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Pictures\\Sample Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Music\\Sample Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Libraries\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Downloads\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%PUBLIC%\\Documents\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG1","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\ntuser.dat.LOG2","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Videos\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Searches\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Saved Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Saved Games\\Microsoft Games\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Pictures\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Music\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Windows Live\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\MSN Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Microsoft Websites\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Links for United States\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]},{"path":"%USERPROFILE%\\Favorites\\Links\\how_to_back_files.html","sources":[{"report_type":"sandbox","report_id":"591215acaac2ed514ba8085b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["591215acaac2ed514ba8085b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Deshacop Sample 8af2cc0bfb02… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8af2cc0bfb02…. Malware family: Trojan.Deshacop. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Deshacop Sample 8af2cc0bfb02… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8af2cc0bfb02…. Malware family: Trojan.Deshacop. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8af2cc0bfb02f6332b0bbc00022a4f96059d352f6abbe8041ad20a73a9be6a5e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Deshacop Sample 8af2cc0bfb02… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8af2cc0bfb02…. Malware family: Trojan.Deshacop. Threat score 100/100. 20/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]