24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Spy.Virkonni Sample 94113c9968db… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 94113c9968db…. Malware family: Spy.Virkonni. Threat score 100/100. 20/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5","keywords":["Malicious","Spy.Virkonni","malware analysis","sandbox report","threat intelligence","94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5"],"about":{"@type":"SoftwareApplication","name":"How can North Korean hydrogen bomb wipe out Manhattan.scr","applicationCategory":["peexe","executable"],"identifier":"94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Spy.Virkonni","antivirusDetections":{"malicious":20,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T757,"winnit.exe.281298034" has type "PE32 executable (GUI) Intel 80386, for MS Windows" "conhote.dll.562561448" has type "PE32 executable (DLL) (GUI) Intel 80386, for MS Windows" "Anti virus service.lnk.579504302" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Mar 16 23:15:59 2016, mtime=Wed Mar 16 23:15:59 2016, atime=Wed Mar 16 23:15:59 2016, length=104960, window=hide" "opa12.dat.911241580" has type "data" "index.dat.1647014572" has type "data" "Local Disk (C).LNK.1789590254" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Hidden, System, Directory, ctime=Tue Jul 14 09:07:54 2009, mtime=Wed Mar 16 23:18:32 2016, atime=Wed Mar 16 23:18:32 2016, length=12288, window=hide" "How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.LNK.3214013838" has type "MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Mar 16 23:16:14 2016, mtime=Wed Mar 16 23:16:14 2016, atime=Wed Mar 16 23:16:14 2016, length=29696, window=hide" "~WRS{E7E4EEC7-EAA8-43EA-B4B3-2997DAAF8437}.tmp.4223914996" has type "FoxPro FPT, blocks size 0, next free block index 218103808, 1st used item "\375"" "How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc.4226938626" has type "Composite Document File V2 Document, Little Endian, O%WINDIR%\ Version 6.2, Code page: 949, Author: John, Template: Normal.dotm, Last Saved By: John, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Total Editing Time: 04:00, Create Time/Date: Mon Mar 14 16:55:00 2016, Last Saved Time/Date: Mon Mar 14 16:59:00 2016, Number of Pages: 2, Number of Words: 467, Number of Characters: 2664, Security: 0" "~$w_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc.4226938626" has type "data"26:T576,"" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" created file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\Anti virus service.lnk" "" created file "C:\Windows\system32\cmd.exe" "WINWORD.EXE" created file "C:\Windows\AppPatch\AcSpecfc.DLL" "WINWORD.EXE" created file "C:\Windows\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" created file "C:\Windows\Fonts\staticcache.dat" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" created file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" created file "C:\Windows\system32\spool\DRIVERS\W32X86\3\mxdwdui.BUD" "WINWORD.EXE" created file "C:\Windows\system32\spool\DRIVERS\W32X86\3\mxdwdui.gpd" "WINWORD.EXE" created file "C:\Windows\system32\spool\DRIVERS\W32X86\3\StdNames.gpd" "WINWORD.EXE" created file "C:\Windows\system32\spool\DRIVERS\W32X86\3\mxdwdui.ini"27:T712,"" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN-US") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "EN-US") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "AR") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "AR-SA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "BG-BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "BG-BG") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "CA") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "CA-ES") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "ZH-HANS") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE", Key: "ZH-CN") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE", Key: "ZH-CN")28:T6f4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAATMSURBVFhHzZftT9VlGMf9B3zp1ltf6Yu2li+ca9ncahObbLpabM2K2MxcTTN1VhN1s4kry3hRzZA0QFFAdGNT8Dh1oAWoqMwSkYMEiYeHeFBEOE9Xv8+tl96/+/wOHp1zsX0H58D5fR+u676um2nT/q9flaFWyQQVdZcEHKi9IOVHz6Xgqf1BnkwmnwqJRFLiHspqGmX5lpA8VsSaXRFRfP5Tj4CVBa0GK7ZdlHc3NkrOV82yZMN5WbzunGStPmvw+icnZW7ukRSRtoBbQzHJyt08tQjIa5uHA3HwdL8o9tZFBBQd7TbYeahL5iyr8AlQck0AAeFIVBbkrEovQgUERc6DYvGkTEQTBuMTCRm7l5Dbd+OBAngGnwF7j5wVFXCpc1zmZi8PFkHkJOAKUPJoLCn3Jv3kKuDFnP0PP3f4jxGx8Wt1g0/A71cG5OVFH6aKoNYIWP9ju6ze0WJArfeFOgTyeTkFxjk9QD8AeuCb8k5xBWBieCwuf/VMyu6qejl9cVBCF4bM86vODEr5qb5UEbYA6groXh5GE760dLs0tPab9z/a2ijz8mpka2m7fFseltlvlfgSICn6oPnqkBGQtylkmhAsys2Xhe+tk9fe/tQvQgVAyEMh/7s/an6GdNbiAiOARCB/4dV3ZHA0Zn4/M7vIJwDnkI94PVJRP2Ac7zvpwfusovR4p18ALul0mo0yIIDXuM1ef94IQAhl4ee13zcZAaTgCoAM4tITESk8fEN2H/tHvi5pkzte4456ohBW4grgjENIvak/Ani4klNvjR73LR1jXnNFzd/MeGOnL4Ht+zsMcXFtr1/A+H3yoTtx2VPnJKACOGYQcSyVnOhpOn2Ne8h7B6MmLRXAieEE4FxjRwjzggRwT3MigFR8p4FoGTAIeD+/4SHZTY+EqBd8HDLRq3vIbQE6fCBKB9wj4N/bcSPKJ4CIEcBRo6shY8GMeB8AvAf5zxVnDLGCNKbPLzBDh/4BlBEjnIa73vO09ko+MJpGAKp0wjFklJwEgMau5JwSFaDdTnfTYKD4WNhzGpZfHoDoIe8biZve8CXAUrEFZEJuC8D1VM5tckbzD9VdqQJ0AOl3phznHNDtNBzAtQ1KoM7pbtt5YfV1KTzUZoDzyHBM6KsUAaxUthpgtALqzhkHdLoCQhdab7vm2nQau5J3DwQkEHRhYJHoBqxpur9kmOXU2625Otd6285NAlWtZin1eO67vN75rtKZA+kE4CgdaFg6XKFTTs+67RxynEPO3WBjmXMMgwSwSPTh6pxpyZBxaz6Vc9zvOBA25J19Ubl+6wkE4MoFtVWoW7qcAeO6puFs55C33YzKF785kzAogV2V9YYIEpyzZJ7EOa5xz27YVnbNOIecbbl2TyT4YmILQQDOFOoQlwqOlh4v6oxjGk1dEzk1b+99RH6le1LWFPdnJkAj1e82IccKUpcY1wDXgN3AHPnTcw755a6JzAVA4gKXCnXLVNQmwzFxq2ubGPKMBbB41J1LSMQa8w0vZo3aJqbWOFbXEHMz5i6RUQkQoERBhC6pXWfXNcRKjoDPijLoAQQQKxcSbrTc59hyLC1meRDYIwwZBceNjsexjYwFcDXL+uBLc4t9ZelKmfNmnuneZ4XH/s/4PP7gP8GAOjrYaqU7AAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791268134608,"unified_at":"2026-10-06T06:28:54.608Z","metadata":{"hashes":{"sha256":"94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5","sha1":"fa9d6bdd36c17ab505aa091237aee278e33318fe","md5":"49b3c5975c8717da0606ec060b4271a2","sha512":"c1e7015bb11f303bc087290216c388dbff057e5fdfedb1c36f5d2cb24256cd2529fbffa81c6c40a7741e9af623aceab1226ed820db2bb927caab8fba6c145fbc","ssdeep":"3072:k0fOW70LTlBmW9g8EwDoMSadtPM5ZZRiCoYkBaxPSnASjQu/KLM:kQO40La18DLPM5Z1oYkBaxqNBCL","ssdeep_chunks":["3072:k0fOW70","3072:0fOW70L","3072:fOW70LT","3072:OW70LTl","3072:W70LTlB","3072:70LTlBm","3072:0LTlBmW","3072:LTlBmW9","3072:TlBmW9g","3072:lBmW9g8","3072:BmW9g8E","3072:mW9g8Ew","3072:W9g8EwD","3072:9g8EwDo","3072:g8EwDoM","3072:8EwDoMS","3072:EwDoMSa","3072:wDoMSad","3072:DoMSadt","3072:oMSadtP","3072:MSadtPM","3072:SadtPM5","3072:adtPM5Z","3072:dtPM5ZZ","3072:tPM5ZZR","3072:PM5ZZRi","3072:M5ZZRiC","3072:5ZZRiCo","3072:ZZRiCoY","3072:ZRiCoYk","3072:RiCoYkB","3072:iCoYkBa","3072:CoYkBax","3072:oYkBaxP","3072:YkBaxPS","3072:kBaxPSn","3072:BaxPSnA","3072:axPSnAS","3072:xPSnASj","3072:PSnASjQ","3072:SnASjQu","3072:nASjQu/","3072:ASjQu/K","3072:SjQu/KL","3072:jQu/KLM","6144:k0fOW70","6144:0fOW70L","6144:fOW70LT","6144:OW70LTl","6144:W70LTlB","6144:70LTlBm","6144:0LTlBmW","6144:LTlBmW9","6144:TlBmW9g","6144:lBmW9g8","6144:BmW9g8E","6144:mW9g8Ew","6144:W9g8EwD","6144:9g8EwDo","6144:g8EwDoM","6144:8EwDoMS","6144:EwDoMSa","6144:wDoMSad","6144:DoMSadt","6144:oMSadtP","6144:MSadtPM","6144:SadtPM5","6144:adtPM5Z","6144:dtPM5ZZ","6144:tPM5ZZR","6144:PM5ZZRi","6144:M5ZZRiC","6144:5ZZRiCo","6144:ZZRiCoY","6144:ZRiCoYk","6144:RiCoYkB","6144:iCoYkBa","6144:CoYkBax","6144:oYkBaxP","6144:YkBaxPS","6144:kBaxPSn","6144:BaxPSnA","6144:axPSnAS","6144:xPSnASj","6144:PSnASjQ","6144:SnASjQu","6144:nASjQu/","6144:ASjQu/K","6144:SjQu/KL","6144:jQu/KLM","3072:kQO40La","3072:QO40La1","3072:O40La18","3072:40La18D","3072:0La18DL","3072:La18DLP","3072:a18DLPM","3072:18DLPM5","3072:8DLPM5Z","3072:DLPM5Z1","3072:LPM5Z1o","3072:PM5Z1oY","3072:M5Z1oYk","3072:5Z1oYkB","3072:Z1oYkBa","3072:1oYkBax","3072:oYkBaxq","3072:YkBaxqN","3072:kBaxqNB","3072:BaxqNBC","3072:axqNBCL"],"imphash":"6e4635c661ce4c2cb79a51bc1bb29a4a"},"file_info":{"file_name":"How can North Korean hydrogen bomb wipe out Manhattan.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":266752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286724000,"last_seen":1638385798000,"last_multi_scan":1638385798000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":18,"malicious_count":5,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Graftor.266752.17","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.11200507","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Virus.Win32.Part.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.11200507 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Spy.Virkonni.X trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Hupigon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0057b9051 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Agent.hhjs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic.bxp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.eokaxa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.MauvaiseRI.S5247393","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Konni-B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Konni.266752","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"TSPY_KO.E40A1DE9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"TSPY_KO.E40A1DE9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop7.BUYA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.MulDrop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Spy.Virkonni","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00010537-00003504-40019-153-00CA41AF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010537-00003504-45331-153-00CA41AF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00010537-00003504-49439-153-00CA41AF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"F:\\0_work\\planes\\complete_exe\\Doc7\\Release\\Doc.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\~DFDFA976FA6445B1D3.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\KYIMEShareCachedData.MutexObject.PSPUBWS\"\n \"\\Sessions\\1\\BaseNamedObjects\\KYTransactionServer.MutexObject.PSPUBWS\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"conhote.dll.562561448\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386\n for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE12\\RICHED20.DLL\" at 66580000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c del C:\\HOW_CA~1.EXE >> NUL\" on 2016-3-16.09:18:37.142","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c del C:\\HOW_CA~1.EXE >> NUL\" (UID: 00015939-00002596)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"WINWORD.EXE\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$25","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\"\n Pattern match: \"http://%s/download.php?file=%s_comman\"\n Pattern match: \"http://%s/login.php\"\n Heuristic match: \"dowhelsitjs.netau.net\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"WINWORD.EXE\" at 00012027-00003812-00000105-56676405","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"WINWORD.EXE\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-40019-33-00CA2BCD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-40019-12-00CA159D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-40019-277-00CA2E25\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-45331-33-00CA2BCD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-45331-12-00CA159D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-45331-277-00CA2E25\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-49439-12-00CA159D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-49439-33-00CA2BCD\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00010537-00003504-49439-277-00CA2E25\n SetUnhandledExceptionFilter@KERNEL32.dll at 55168-826-0040E68E","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00010537-00003504-40019-48-00CA10F0\n FindResourceA@KERNEL32.DLL at 00010537-00003504-40019-112-00CA1200\n FindResourceA@KERNEL32.DLL at 00010537-00003504-45331-48-00CA10F0\n FindResourceA@KERNEL32.DLL at 00010537-00003504-45331-112-00CA1200\n FindResourceA@KERNEL32.DLL at 00010537-00003504-49439-48-00CA10F0\n FindResourceA@KERNEL32.DLL at 00010537-00003504-49439-112-00CA1200","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"winnit.exe.281298034\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"conhote.dll.562561448\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WINWORD.EXE\" opened \"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (C).LNK\" with delete access\n \"WINWORD.EXE\" opened \"%APPDATA%\\Microsoft\\Office\\Recent\\How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.LNK\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"WINWORD.EXE\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOC\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOC\", Key: \"NEVERSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOTM\", Key: \"ALWAYSSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOTM\", Key: \"NEVERSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOC\", Key: \"ALWAYSSHOWEXT\")\n \"WINWORD.EXE\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.DOC\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"winnit.exe\" claimed CRC 118850 while the actual is CRC 268717","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"ShellExecuteA\n RegCloseKey\n RegOpenKeyExA\n GetModuleHandleW\n LoadLibraryW\n GetProcAddress\n FindResourceA\n LockResource\n CreateFileA\n WriteFile\n GetTempPathA\n CreateDirectoryA\n GetModuleFileNameA\n Sleep\n GetCommandLineA\n GetStartupInfoW\n TerminateProcess\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetModuleFileNameW\n GetTickCount\n CreateFileW\n closesocket (Ordinal #3)\n connect (Ordinal #4)\n socket (Ordinal #23)\n WSAStartup (Ordinal #115)\n send (Ordinal #19)\n InternetReadFile\n InternetOpenUrlA\n InternetOpenA\n HttpSendRequestA\n InternetConnectA\n InternetCloseHandle\n FindNextFileA\n FindFirstFileA\n CreateThread\n LoadLibraryA\n GetFileSize\n MapViewOfFile\n CreateFileMappingA\n DeleteFileA\n SetWindowsHookExW\n GetStartupInfoA\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"WINWORD.EXE\" wrote bytes \"d9fbcb18\" to virtual address \"0x2F781634\" (part of module \"WINWORD.EXE\")\n \"WINWORD.EXE\" wrote bytes \"e92319d5f0\" to virtual address \"0x76C73D01\" (\"SetUnhandledExceptionFilter@KERNEL32.DLL\")\n \"WINWORD.EXE\" wrote bytes \"098f771a\" to virtual address \"0x67F2A980\" (part of module \"MSO.DLL\")\n \"WINWORD.EXE\" wrote bytes \"adac371f\" to virtual address \"0x677F10AC\" (part of module \"MSPTLS.DLL\")\n \"WINWORD.EXE\" wrote bytes \"4bb2841a\" to virtual address \"0x699AEC08\" (part of module \"WWLIB.DLL\")\n \"WINWORD.EXE\" wrote bytes \"d4e5f01a\" to virtual address \"0x68AFE718\" (part of module \"OART.DLL\")\n \"WINWORD.EXE\" wrote bytes \"4053067758580777186a0777653c08770000000000bfc6760000000056ccc676000000007ccac67600000000376820756a2c0877d62d087700000000206920750000000029a6c67600000000a48d207500000000f70ec67600000000\" to virtual address \"0x77171000\" (part of module \"NSI.DLL\")\n \"WINWORD.EXE\" wrote bytes \"ea1f3315\" to virtual address \"0x665DF69C\" (part of module \"RICHED20.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"15/56 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"15/56 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"3/56 Antivirus vendors marked dropped file \"winnit.exe.281298034\" as malicious (classified as \"TrojWare.Injector\" with 5% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated memory in \"%PROGRAMFILES%\\Microsoft Office\\Office12\\WINWORD.EXE\"\n \"\" allocated memory in \"C:\\Windows\\System32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 104960 bytes starting with PE header signature to file \"%LOCALAPPDATA%\\winnit\\winnit.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"\" wrote 40960 bytes starting with PE header signature to file \"%LOCALAPPDATA%\\winnit\\conhote.dll\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":85,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":78,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"593539c0aac2edab4a0bd613","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","submit_name":"2016_94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5","analysis_start_time":"2017-06-05T11:59:51+00:00","indicators_count":{"informative":20,"suspicious":16,"malicious":7},"tags":["Multi-Process","Extracted Files","Sample not shared"],"is_in_unified_schema":true},{"id":"56e95ee1aac2ed6905fa84d2","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","submit_name":"How can North Korean hydrogen bomb wipe out Manhattan.scr","analysis_start_time":"2016-03-16T11:14:09+00:00","indicators_count":{"informative":11,"suspicious":26,"malicious":6},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}],"processes":[{"pid":3504,"ppid":0,"name":"How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.exe","command_line":"","normalized_path":"","uid":"00010537-00003504","icon":"$28"},{"pid":3812,"ppid":0,"name":"WINWORD.EXE","command_line":"/n /dde","normalized_path":"","uid":"00012027-00003812"},{"pid":2596,"ppid":0,"name":"cmd.exe","command_line":"/c del C:\\HOW_CA~1.EXE >> NUL","normalized_path":"","uid":"00015939-00002596"}],"all_imported_dlls":["MSORES.DLL","mscoreei.dll","msi.dll","sfc_os.dll","MSOSTYLE.DLL","ksuser.dll","OSETUPPS.DLL","AcSpecfc.dll","MSOINTL.DLL","msxml5.dll","lpk.dll","cscapi.dll","mpr.dll","RICHED20.DLL","ntdll.dll","devobj.dll","profapi.dll","crypt32.dll","msvcr80.dll","userenv.dll","ws2_32.dll","mscoree.dll","kernel32.dll","advapi32.dll","msctf.dll","clbcatq.dll","nsi.dll","cryptsp.dll","avrt.dll","comctl32.dll","srvcli.dll","urlmon.dll","iertutil.dll","WWINTL.DLL","unidrvui.dll","midimap.dll","ntshrui.dll","sspicli.dll","mxdwdui.dll","msacm32.dll","msvcrt.dll","rpcrt4.dll","ole32.dll","imm32.dll","oleaut32.dll","slc.dll","dwmapi.dll","netutils.dll","cryptbase.dll","shdocvw.dll","sxs.dll","wininet.dll","msasn1.dll","ddraw.dll","KernelBase.dll","shell32.dll","usp10.dll","cfgmgr32.dll","Wldap32.dll","linkinfo.dll","sfc.dll","MSO.DLL","shlwapi.dll","uxtheme.dll","setupapi.dll","MSPTLS.DLL","MMDevAPI.dll","WWLIB.DLL","wintrust.dll","AudioSes.dll","sechost.dll","ntmarta.dll","msiltcfg.dll","version.dll","comdlg32.dll","OART.DLL","RpcRtRemote.dll","gdi32.dll","rsaenh.dll","user32.dll","propsys.dll","apphelp.dll","mscms.dll","winmm.dll","dciman32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"winnit.exe","sha256":"553a475f72819b295927e469c7bf9aef774783f3ae8c34c794f35702023317cc","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"conhote.dll","sha256":"56f159cde3a55ae6e9270d95791ef2f6859aa119ad516c9471010302e1fb5634","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.LNK","sha256":"27ba19e342966bb931b20761b8433d6849367cbde51f882d5d2420dce4c918c7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"Local Disk (C).LNK","sha256":"00f0d658d10d3254d0c30704f5343dbf4fd8ae71e23573c0725e4a353e7051de","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"index.dat","sha256":"22881e08fc7777b6572ba18438d1930541d7a4ef2cffb6ef727e6d8cc805ee77","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"Anti virus service.lnk","sha256":"1442914e35c9a3db4bf3b644379371210748e811975249429134147e2be41f09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"~WRS{E7E4EEC7-EAA8-43EA-B4B3-2997DAAF8437}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"opa12.dat","sha256":"49238204cec8b8df2616a03da8ce381ff86c21d6ad10bb27e88488668c7ecaa2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc","sha256":"2ffe2622710e92704ea1467f54f5f1fbe09dd76b2463e01450f621ccae37dc08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"~$w_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc","sha256":"74fa966651bf6e841312447a1da7be38e9da71844fdbeb7749baa36ca9d56c87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\winnit\\conhote.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\winnit\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\winnit\\winnit.exe","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\Anti virus service.lnk","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"C:\\How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%SAMPLEDIR%\\How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\WINWORD.EXE","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office12\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office12\\Cultures\\office.odf","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office12\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Word12.pip","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\OPA12.BAK","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.BUD","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.gpd","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\StdNames.gpd","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\mxdwdui.ini","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE11\\1031\\msxml5r.dll","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{E7E4EEC7-EAA8-43EA-B4B3-2997DAAF8437}.tmp","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\en-US\\wdmaud.drv.mui","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\system32\\en-US\\MMDevAPI.DLL.mui","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%WINDIR%\\System32\\wdmaud.drv","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"pci#ven_8086&dev_100e&subsys_001e8086&rev_02#3&267a616a&0&18#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{d0b53124-e232-49fc-9ea9-75fa32c7c6c3}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#*isatap#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{9c9c1d9a-e45a-41f9-8d98-d3b6ea5d768d}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#*teredo#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{72d885c2-0aec-4510-95d5-bf120a963535}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_agilevpnminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{dcb14c61-690d-46f7-8a89-150432fa5c44}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_l2tpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{483c9ff8-503d-414b-b402-e4c1f1f568cb}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_ndiswanbh#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanbh","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_ndiswanip#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanip","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_ndiswanipv6#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\ndiswanipv6","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_pppoeminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{db2b4279-b5cf-4626-9dba-32d0ece44c87}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_pptpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{c0de3e38-8ba7-479f-8b75-833f294c5aa8}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#ms_sstpminiport#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{e28d896f-9ea8-433a-9c10-66c97c19a921}","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"root#system#0000#{ad498944-762f-11d0-8dcb-00c04fc3358c}\\{eeab7790-c514-11d1-b42b-00805fc1270e}&asyncmac","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%PROGRAMFILES(X86)%\\MICROS~1\\OFFICE\\DATA\\opa12.dat","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%TEMP%\\~DFDFA976FA6445B1D3.TMP","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"C:\\~$w_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%SAMPLEDIR%\\~$w_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.doc","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{CCE423B7-3D34-454B-A9A0-69B39891B044}.tmp","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (C)","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\Local Disk (C).LNK","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\How_can_North_Korean_hydrogen_bomb_wipe_out_Manhattan.scr.LNK","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\STARTUPITEMS\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\12.0\\WORD\\RESILIENCY\\","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYIMEShareCachedData.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\KYTransactionServer.MutexObject.PSPUBWS","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"56e95ee1aac2ed6905fa84d2"}]}]}},"report_ids":{"sandbox_job_ids":["593539c0aac2edab4a0bd613","56e95ee1aac2ed6905fa84d2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Spy.Virkonni Sample 94113c9968db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 94113c9968db…. Malware family: Spy.Virkonni. Threat score 100/100. 20/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5"}],["$","meta","4",{"property":"og:title","content":"Malicious Spy.Virkonni Sample 94113c9968db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 94113c9968db…. Malware family: Spy.Virkonni. Threat score 100/100. 20/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/94113c9968db13e3412c1b9c1c882592481c559c0613dbccfed2fcfc80e77dc5"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Spy.Virkonni Sample 94113c9968db… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 94113c9968db…. Malware family: Spy.Virkonni. Threat score 100/100. 20/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]