21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Cryptolocky Sample 8c306d794e0e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8c306d794e0e…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 23/26 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9","keywords":["Malicious","Trojan.Cryptolocky","malware analysis","sandbox report","threat intelligence","8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9"],"about":{"@type":"SoftwareApplication","name":"jDFXfL.exe","applicationCategory":["peexe","executable"],"identifier":"8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Cryptolocky","antivirusDetections":{"malicious":23,"total":26},"behavioralIndicators":{"malicious":10,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T450,"" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES"; Value: "00000000040000000400000000000000") "" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")23:Td84,Found malicious artifacts related to "93.170.131.108" (ASN: 57494, Owner: Krek Ltd.): ... URL: http://93.170.131.108/submit.php (AV positives: 4/68 scanned on 07/15/2016 06:03:37) URL: http://93.170.131.108/main.php (AV positives: 4/67 scanned on 04/08/2016 01:32:33) URL: http://93.170.131.108/submit.php/ (AV positives: 4/67 scanned on 04/07/2016 09:55:10) URL: http://93.170.131.108/ (AV positives: 4/67 scanned on 04/06/2016 13:49:26) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:58) File SHA256: ee97c12897c67c6af43d16221c04d16e4734495b4aada37d7a4307079241055c (AV positives: 35/57 scanned on 04/25/2016 13:29:56) File SHA256: 40e8683ea7c2178c1249cb6d7787228eea4493a805c8a5145a026b3ab24e16c0 (AV positives: 34/56 scanned on 04/25/2016 09:23:14) Found malicious artifacts related to "5.135.76.18" (ASN: 16276, Owner: OVH SAS): ... URL: http://5.135.76.18/submit.php (AV positives: 5/69 scanned on 07/15/2016 04:57:58) URL: http://ghtuuun.xyz/ (AV positives: 3/68 scanned on 07/14/2016 04:26:54) URL: http://xlthtube.xyz/ (AV positives: 2/68 scanned on 07/14/2016 04:26:29) URL: http://adbanner3.ghtuuun.xyz/ (AV positives: 2/68 scanned on 07/12/2016 22:30:03) URL: http://adbanner3.ghtuuun.xyz/xxxPlayer-41.1.apk (AV positives: 2/68 scanned on 07/12/2016 22:30:02) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:59) File SHA256: 190c9b71385da560ddaeb0844f2f90ae7104f453134cbb582f91237321c7c8e8 (AV positives: 41/57 scanned on 04/26/2016 08:43:51) File SHA256: 82aa40ed70fd65f3c0995850eb64aa97bbeca4bd4063a6d1344cdbcc0c96ce16 (AV positives: 39/57 scanned on 04/25/2016 22:27:00) Found malicious artifacts related to "208.100.26.234" (ASN: 32748, Owner: Steadfast Networks): ... URL: http://phyzsglrtvrnpmy.com/ (AV positives: 2/68 scanned on 07/15/2016 18:04:16) URL: http://nonesure.net/ (AV positives: 3/68 scanned on 07/15/2016 17:55:59) URL: http://ghbhxiarm.com/ (AV positives: 1/68 scanned on 07/15/2016 17:44:09) URL: http://umyqnpvzmayi.com/ (AV positives: 1/68 scanned on 07/15/2016 17:40:16) URL: http://weujhau.ifollowya.com/ (AV positives: 3/68 scanned on 07/15/2016 17:37:31) File SHA256: a8b17ddca56ba91ef5acbadb3738763da41959214f091b3f67d2d6d07c96371d (AV positives: 40/55 scanned on 07/15/2016 17:46:18) File SHA256: 057734f8dd35fb1d7d7f5f1484c41d726537f359f551d01aed93a43769e5f5c7 (AV positives: 35/55 scanned on 07/15/2016 17:45:14) File SHA256: 0f49e5380474f33f8d46b61e601ed80228641cd00de424c6577fca7c531c8cf2 (AV positives: 40/55 scanned on 07/15/2016 17:43:56) File SHA256: fb63b2f02f45efc3f8547259452defb4fd0fce506c913cf0ce437d36c092c8d3 (AV positives: 39/55 scanned on 07/15/2016 17:35:14) File SHA256: 37f085498a8a75cb3f8aa327aa27cbbaec2de647626490662094d115809996d1 (AV positives: 40/55 scanned on 07/15/2016 17:09:16)24:Td84,Found malicious artifacts related to "93.170.131.108" (ASN: 57494, Owner: Krek Ltd.): ... URL: http://93.170.131.108/submit.php (AV positives: 4/68 scanned on 07/15/2016 06:03:37) URL: http://93.170.131.108/main.php (AV positives: 4/67 scanned on 04/08/2016 01:32:33) URL: http://93.170.131.108/submit.php/ (AV positives: 4/67 scanned on 04/07/2016 09:55:10) URL: http://93.170.131.108/ (AV positives: 4/67 scanned on 04/06/2016 13:49:26) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:58) File SHA256: ee97c12897c67c6af43d16221c04d16e4734495b4aada37d7a4307079241055c (AV positives: 35/57 scanned on 04/25/2016 13:29:56) File SHA256: 40e8683ea7c2178c1249cb6d7787228eea4493a805c8a5145a026b3ab24e16c0 (AV positives: 34/56 scanned on 04/25/2016 09:23:14) Found malicious artifacts related to "5.135.76.18" (ASN: 16276, Owner: OVH SAS): ... URL: http://5.135.76.18/submit.php (AV positives: 5/69 scanned on 07/15/2016 04:57:58) URL: http://ghtuuun.xyz/ (AV positives: 3/68 scanned on 07/14/2016 04:26:54) URL: http://xlthtube.xyz/ (AV positives: 2/68 scanned on 07/14/2016 04:26:29) URL: http://adbanner3.ghtuuun.xyz/ (AV positives: 2/68 scanned on 07/12/2016 22:30:03) URL: http://adbanner3.ghtuuun.xyz/xxxPlayer-41.1.apk (AV positives: 2/68 scanned on 07/12/2016 22:30:02) File SHA256: d54173be31f755d216c6679bb999b12399678e555912e66c2c4e6bb7d2dcb394 (AV positives: 37/57 scanned on 04/26/2016 10:52:49) File SHA256: f82501fdab6d14ae41feee1046485d5be118d4a6160963f48f738e5d1a25ff4c (AV positives: 37/57 scanned on 04/26/2016 10:17:36) File SHA256: 470ecda5ee50bd8a94b50d6d60067814047ba495a038e6a1e0bc4d8ec65ddcf5 (AV positives: 37/57 scanned on 04/26/2016 08:46:59) File SHA256: 190c9b71385da560ddaeb0844f2f90ae7104f453134cbb582f91237321c7c8e8 (AV positives: 41/57 scanned on 04/26/2016 08:43:51) File SHA256: 82aa40ed70fd65f3c0995850eb64aa97bbeca4bd4063a6d1344cdbcc0c96ce16 (AV positives: 39/57 scanned on 04/25/2016 22:27:00) Found malicious artifacts related to "208.100.26.234" (ASN: 32748, Owner: Steadfast Networks): ... URL: http://phyzsglrtvrnpmy.com/ (AV positives: 2/68 scanned on 07/15/2016 18:04:16) URL: http://nonesure.net/ (AV positives: 3/68 scanned on 07/15/2016 17:55:59) URL: http://ghbhxiarm.com/ (AV positives: 1/68 scanned on 07/15/2016 17:44:09) URL: http://umyqnpvzmayi.com/ (AV positives: 1/68 scanned on 07/15/2016 17:40:16) URL: http://weujhau.ifollowya.com/ (AV positives: 3/68 scanned on 07/15/2016 17:37:31) File SHA256: a8b17ddca56ba91ef5acbadb3738763da41959214f091b3f67d2d6d07c96371d (AV positives: 40/55 scanned on 07/15/2016 17:46:18) File SHA256: 057734f8dd35fb1d7d7f5f1484c41d726537f359f551d01aed93a43769e5f5c7 (AV positives: 35/55 scanned on 07/15/2016 17:45:14) File SHA256: 0f49e5380474f33f8d46b61e601ed80228641cd00de424c6577fca7c531c8cf2 (AV positives: 40/55 scanned on 07/15/2016 17:43:56) File SHA256: fb63b2f02f45efc3f8547259452defb4fd0fce506c913cf0ce437d36c092c8d3 (AV positives: 39/55 scanned on 07/15/2016 17:35:14) File SHA256: 37f085498a8a75cb3f8aa327aa27cbbaec2de647626490662094d115809996d1 (AV positives: 40/55 scanned on 07/15/2016 17:09:16)25:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790321444491,"unified_at":"2026-09-25T07:30:44.491Z","metadata":{"hashes":{"sha256":"8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9","sha1":"544478b0a0966634958c72f6ad5292626a95d8bd","md5":"df0198d5368df1cd600292fcc77cd45e","sha512":"3996598396650efadcdc631f31c7756b6bbf2431bf74a9c8e2d191aeb4da117cab73a9068663c86dcacc135070694fb22c019010d3a77f120588547c6db5ecca","ssdeep":"3072:B2tfsbnUv6dbxJJorkUn45AX536f/MMDFmOuSZsTvX1atUdupc8a2n:B6sbUvsNyn4tfEimTvUUspza2n","ssdeep_chunks":["3072:B2tfsbn","3072:2tfsbnU","3072:tfsbnUv","3072:fsbnUv6","3072:sbnUv6d","3072:bnUv6db","3072:nUv6dbx","3072:Uv6dbxJ","3072:v6dbxJJ","3072:6dbxJJo","3072:dbxJJor","3072:bxJJork","3072:xJJorkU","3072:JJorkUn","3072:JorkUn4","3072:orkUn45","3072:rkUn45A","3072:kUn45AX","3072:Un45AX5","3072:n45AX53","3072:45AX536","3072:5AX536f","3072:AX536f/","3072:X536f/M","3072:536f/MM","3072:36f/MMD","3072:6f/MMDF","3072:f/MMDFm","3072:/MMDFmO","3072:MMDFmOu","3072:MDFmOuS","3072:DFmOuSZ","3072:FmOuSZs","3072:mOuSZsT","3072:OuSZsTv","3072:uSZsTvX","3072:SZsTvX1","3072:ZsTvX1a","3072:sTvX1at","3072:TvX1atU","3072:vX1atUd","3072:X1atUdu","3072:1atUdup","3072:atUdupc","3072:tUdupc8","3072:Udupc8a","3072:dupc8a2","3072:upc8a2n","6144:B2tfsbn","6144:2tfsbnU","6144:tfsbnUv","6144:fsbnUv6","6144:sbnUv6d","6144:bnUv6db","6144:nUv6dbx","6144:Uv6dbxJ","6144:v6dbxJJ","6144:6dbxJJo","6144:dbxJJor","6144:bxJJork","6144:xJJorkU","6144:JJorkUn","6144:JorkUn4","6144:orkUn45","6144:rkUn45A","6144:kUn45AX","6144:Un45AX5","6144:n45AX53","6144:45AX536","6144:5AX536f","6144:AX536f/","6144:X536f/M","6144:536f/MM","6144:36f/MMD","6144:6f/MMDF","6144:f/MMDFm","6144:/MMDFmO","6144:MMDFmOu","6144:MDFmOuS","6144:DFmOuSZ","6144:FmOuSZs","6144:mOuSZsT","6144:OuSZsTv","6144:uSZsTvX","6144:SZsTvX1","6144:ZsTvX1a","6144:sTvX1at","6144:TvX1atU","6144:vX1atUd","6144:X1atUdu","6144:1atUdup","6144:atUdupc","6144:tUdupc8","6144:Udupc8a","6144:dupc8a2","6144:upc8a2n","3072:B6sbUvs","3072:6sbUvsN","3072:sbUvsNy","3072:bUvsNyn","3072:UvsNyn4","3072:vsNyn4t","3072:sNyn4tf","3072:Nyn4tfE","3072:yn4tfEi","3072:n4tfEim","3072:4tfEimT","3072:tfEimTv","3072:fEimTvU","3072:EimTvUU","3072:imTvUUs","3072:mTvUUsp","3072:TvUUspz","3072:vUUspza","3072:UUspza2","3072:Uspza2n"],"imphash":"ba03760e3cd10f5b616c332fad1ddd74"},"file_info":{"file_name":"jDFXfL.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":197887,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293195000,"last_seen":1713400573000,"last_multi_scan":1713400573000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":18,"malicious_count":10,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Locky","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.Locky.e","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/FileCoder.Locky.74532","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Downloader.JSUK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.8C40FDED","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Ransom.Agent.NINB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Downloader.JSUK (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.Locky.B trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 004dc4921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.ys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.efhitd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Ransom-CPF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Spy/W32.ZBot.197887","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Forucon.PWFC-3047","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cryptolocky.X","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanSpy.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Injector.Win32.369672","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Cryptolocky","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00182078-00004008-40701-135-002682AF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00182078-00004008-45994-258-002682B1","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 76E10000\n \"\" loaded module \"USER32.DLL\" at base 777A0000\n \"\" loaded module \"NTDLL.DLL\" at base 77B70000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 34764-542-00407394\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00182078-00004008-40701-12-0026631D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00182078-00004008-40701-33-0026613D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00182078-00004008-40701-374-00267394\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00182078-00004008-45994-34-0026613D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00182078-00004008-45994-21-0026631D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00182078-00004008-45994-390-00267394","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"},{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ExitThread\n GetCommandLineA\n GetStartupInfoW\n GetModuleHandleW\n GetProcAddress\n UnhandledExceptionFilter\n IsDebuggerPresent\n TerminateProcess\n WriteFile\n GetModuleFileNameW\n GetModuleFileNameA\n GetTickCount\n Sleep\n LoadLibraryW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"},{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"37/57 Antivirus vendors marked sample as malicious (64% detection rate)\n 15/43 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"37/57 Antivirus vendors marked sample as malicious (64% detection rate)\n 15/43 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"},{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"5.135.76.18:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00016452-00002412)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"jDFXfL.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"jDFXfL.exe\" at 00012630-00004008-00000105-56589834","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"jDFXfL.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /submit.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 5.135.76.18\nContent-Length: 101\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /submit.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: 5.135.76.18\nContent-Length: 55\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"jDFXfL.exe\" created file \"C:\\Windows\\\"\n \"jDFXfL.exe\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"jDFXfL.exe\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"jDFXfL.exe\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"jDFXfL.exe\" created file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"jDFXfL.exe\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"jDFXfL.exe\" created file \"C:\\Windows\\System32\\vssadmin.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"5.135.76.18\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"jDFXfL.exe\" opened \"UNC\\192.168.56.1\\VM15\\VxStream\\libs\\commons-io-2.4.jar\" with delete access\n \"jDFXfL.exe\" opened \"UNC\\USLOFT4112\\VxAnalysisData\\VM14\\VxStream\\libs\\commons-io-2.4.jar\" with delete access\n \"jDFXfL.exe\" opened \"c:\\autoexec.bat\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"jDFXfL.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"jDFXfL.exe\" allocated memory in \"C:\\jDFXfL.exe\"\n \"jDFXfL.exe\" allocated memory in \"%WINDIR%\\System32\\vssadmin.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00016452-00002412)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"hrbgkcngbuvg.xyz\"\n \"mvhifmgvjitfncnxh.biz\"\n \"rubtdyuyc.click\"\n \"jivgvpqtpexpixc.work\"\n \"gocvsfgssynlftkc.pl\"\n \"udtjlddtbnjxrf.xyz\"\n \"ijiayhmgqbag.org\"\n \"vwbiknpwsgrtdc.info\"\n \"ljfiqjn.work\"\n \"dhfinmiouwyeg.biz\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$22","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET INFO GENERIC SUSPICIOUS POST to Dotted Quad with Fake Browser 1\" (SID: 2018358, Rev: 7, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"C:\\Windows\\\"\n \"\" touched file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" touched file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" touched file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"hrbgkcngbuvg.xyz\" is random\n \"rubtdyuyc.click\" is random\n \"gocvsfgssynlftkc.pl\" is random\n \"ljfiqjn.work\" is random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$23","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$24","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat\" (Type: \"FileHandle\")\n \"\" had access to \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\" (Type: \"FileHandle\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}],"incidents":[{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 10 domains and 10 hosts"}],"sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":70,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":10,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"578923d3aac2ed9d2495f232","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Downloader","contacted_countries":["CZE","FRA","RUS","USA"],"submit_name":"df0198d5368df1cd600292fcc77cd45e","analysis_start_time":"2016-07-15T19:57:11+00:00","indicators_count":{"informative":6,"suspicious":17,"malicious":9},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"56fb8ad4aac2ed9c22ae9804","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":77,"malware_family":"Zbot.QB.gen","contacted_countries":["FRA"],"submit_name":"jDFXfL.exe","analysis_start_time":"2016-03-30T03:14:29+00:00","indicators_count":{"informative":3,"suspicious":11,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"56fb8ad4aac2ed9c22ae9802","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":56,"malware_family":"Trojan.GenericKD","submit_name":"jDFXfL.exe","analysis_start_time":"2016-03-31T11:09:36+00:00","indicators_count":{"informative":2,"suspicious":2,"malicious":3},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"5.135.76.18","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"address":"93.170.131.108","port":80,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"address":"82.146.37.200","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"address":"208.100.26.234","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}],"dns_resolutions":[{"domain":"mvhifmgvjitfncnxh.biz","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"rubtdyuyc.click","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"jivgvpqtpexpixc.work","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"gocvsfgssynlftkc.pl","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"hrbgkcngbuvg.xyz","address":"208.100.26.234","country":"United States","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"udtjlddtbnjxrf.xyz","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"ijiayhmgqbag.org","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"vwbiknpwsgrtdc.info","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"ljfiqjn.work","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"domain":"dhfinmiouwyeg.biz","country":"-","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}],"http_requests":[{"host":"5.135.76.18","host_ip":"5.135.76.18:80","url":"/submit.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"},{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9804"}],"processes":[{"pid":3648,"ppid":0,"name":"jDFXfL.exe","command_line":"","normalized_path":"C:\\jDFXfL.exe","uid":"00010060-00003648","icon":"$25"},{"pid":4008,"ppid":0,"name":"jDFXfL.exe","command_line":"","normalized_path":"C:\\jDFXfL.exe","uid":"00012630-00004008"},{"pid":2412,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","uid":"00016452-00002412"}],"all_imported_dlls":["MSCTF.dll","ADVAPI32.dll","USER32.dll","DEVOBJ.dll","KERNELBASE.dll","ntdll.dll","SETUPAPI.dll","RPCRT4.dll","sechost.dll","SspiCli.dll","CFGMGR32.dll","msvcrt.dll","VERSION.dll","PSAPI.DLL","LPK.dll","GDI32.dll","USP10.dll","ole32.dll","IMM32.DLL","kernel32.dll","OLEAUT32.dll","imm32.dll","cryptbase.dll","comctl32.dll","Wldap32.dll","rtutils.dll","user32.dll","msctf.dll","shlwapi.dll","oleaut32.dll","rasman.dll","WSHTCPIP.DLL","wship6.dll","FWPUCLNT.DLL","lpk.dll","usp10.dll","crypt32.dll","mpr.dll","uxtheme.dll","shell32.dll","urlmon.dll","rsaenh.dll","nsi.dll","rasapi32.dll","nlaapi.dll","netapi32.dll","srvcli.dll","ws2_32.dll","winnsi.dll","KernelBase.dll","gdi32.dll","wininet.dll","msasn1.dll","netutils.dll","ntmarta.dll","advapi32.dll","wkscli.dll","dsrole.dll","sspicli.dll","profapi.dll","rasadhlp.dll","wshqos.dll","apphelp.dll","iertutil.dll","cryptsp.dll","dnsapi.dll","IPHLPAPI.DLL","SensApi.dll","mswsock.dll","rpcrt4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%SAMPLEDIR%\\jDFXfL.exe","sources":[{"report_type":"sandbox","report_id":"56fb8ad4aac2ed9c22ae9802"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"key":"HKCU\\SOFTWARE\\1BSSQX05U34CRZ0\\","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"578923d3aac2ed9d2495f232"}]}]}},"report_ids":{"sandbox_job_ids":["578923d3aac2ed9d2495f232","56fb8ad4aac2ed9c22ae9804","56fb8ad4aac2ed9c22ae9802"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Cryptolocky Sample 8c306d794e0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8c306d794e0e…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 23/26 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Cryptolocky Sample 8c306d794e0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8c306d794e0e…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 23/26 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8c306d794e0eb33e24e252f51aa19964c0f5a04cac742396f4b570a2c7b48ca9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Cryptolocky Sample 8c306d794e0e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8c306d794e0e…. Malware family: Trojan.Cryptolocky. Threat score 100/100. 23/26 AV engines flagged this file. 10 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]