26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T414,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 94495aafed65… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 94495aafed65…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","keywords":["malware analysis","sandbox report","threat intelligence","94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201"],"about":{"@type":"SoftwareApplication","name":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","applicationCategory":["peexe","executable"],"identifier":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":0,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T1731,Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SuspendThread"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), Found reference to API (Indicator: "DeregisterEventSource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcatA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceCtrlDispatcherA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "ResumeThread"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RevertToSelf"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "QueryServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToDosDateTime"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "IsBadReadPtr"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceObjectSecurity"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "CompareFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessTimes"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "LogonUserA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcpyA"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "ControlService"; Source: "sample.bin"), Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocalTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerA"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceA"; Source: "sample.bin")28:T51c,Found reference to API "JobEngineThread::Failed to create the RPC ready event, GetLastError() returns %u" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "RunJob: FileTimeToDosDateTime() returns error, GetLastError(): %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "RunJob: GetProcessTimes() returns error, GetLastError(): %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "JOBENG: RefreshJobWindowConfig() exiting. GetLastError: %d, return: FALSE" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "JOBENG: LoadJobWindowFile():ReadFile() failed. GetLastError: %d. exiting the function with -2" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "RunJob(): InitializeSecurityDescriptor(): failed for job: %d, GetLastErrorRet: %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "RunJob(): SetSecurityDescriptorDacl(): failed for job: %d, GetLastErrorRet: %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "RunJob: CreateProcess() failed for job: %d, cmdline: %s, GetLastErrorRet: %d" (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "sample.bin")29:T43f," PPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADDINGXXPADDINGPADD" (Indicator: "requestedExecutionLevel level="highestAvailable"")2a:T10e8,Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 10842-290-00417460 Assembly shows XOR instruction xor eax ebp in Stream UID: 10842-290-00417460 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10842-290-00417460 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 10842-291-00416740 Assembly shows XOR instruction xor eax ebp in Stream UID: 10842-291-00416740 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10842-291-00416740 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-293-00414E90 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-293-00414E90 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-294-00411390 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-294-00411390 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-303-00412F70 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-303-00412F70 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-306-004138B0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-306-004138B0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-321-00412630 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-321-00412630 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-322-0040EC10 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-322-0040EC10 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 10842-333-00415CE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 10842-333-00415CE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10842-333-00415CE0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 10842-339-00413010 Assembly shows XOR instruction xor eax ebp in Stream UID: 10842-339-00413010 Assembly shows XOR instruction xor ecx ebp in Stream UID: 10842-339-00413010 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-341-00403A10 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-341-00403A10 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-343-0040FE80 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-343-0040FE80 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-351-0040FC10 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-351-0040FC10 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-361-0040F870 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-361-0040F870 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-363-004139F0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-363-004139F0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-368-00412470 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-368-00412470 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-371-00411FB0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-371-00411FB0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-372-00411E00 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-372-00411E00 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-380-0040F1A0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-380-0040F1A0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-409-0040C2D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-409-0040C2D0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-411-004029C0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-411-004029C0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-412-00402840 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-412-00402840 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-414-00406CD0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-414-00406CD0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-416-0040A0D0 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-416-0040A0D0 Assembly shows XOR instruction xor eax esp in Stream UID: 10842-427-00403850 Assembly shows XOR instruction xor ecx esp in Stream UID: 10842-427-004038502b:T400,The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 19:7A:4A:EB:DB:25:F0:17:00:79:BB:8C:73:CB:2D:65:5E:00:18:A4; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2004 CA, OU=Terms of use at https://www.verisign.com/rpa c04, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 30:8E:37:EB:C9:59:D0:C0:C3:8E:CB:CF:78:43:38:1C:79:C5:29:D7; see report for more information)2c:T421,"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")2d:T7c4,"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\WSOCK32.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\system32\WSOCK32.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\system32\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\system\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\ProgramData\Oracle\Java\javapath\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\System32\Wbem\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\System32\WindowsPowerShell\v1.0\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\WSOCK32.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\System32\wsock32.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\System32\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\system\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\Windows\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to touch file "C:\ProgramData\Oracle\Java\javapath\ASDCEN.DLL"2e:T8cc,"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\WSOCK32.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\system32\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\system\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\System32\Wbem\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\asdcen.dll" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\WSOCK32.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\System32\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\system\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_623756\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\System32\wbem\ASDCEN.DLL" "94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\ASDCEN.DLL"2f:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1792863686854,"unified_at":"2026-10-24T17:41:26.854Z","metadata":{"hashes":{"sha256":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","sha1":"13e650897c5dd8f07e6e966e638b9a2f8639a253","md5":"56a16dd3e11df6c4d85171b64310a8a3","sha512":"bbc346928a90d5916d314822cb4c16cf1f3ddf96d2b214256aaf19dd483bde21bc239cf6466a792bb54e1dd163fed3aa4fed8e2cd9a7ee0c486b6a0b0d152c4f","ssdeep":"3072:JAq5QU/UY3Z5WhBR5Wzzaocxn1lD33n9n8z5+2fOQmgVi:JLi5gIxwzuocxnTD345+2fOQmn","ssdeep_chunks":["3072:JAq5QU/","3072:Aq5QU/U","3072:q5QU/UY","3072:5QU/UY3","3072:QU/UY3Z","3072:U/UY3Z5","3072:/UY3Z5W","3072:UY3Z5Wh","3072:Y3Z5WhB","3072:3Z5WhBR","3072:Z5WhBR5","3072:5WhBR5W","3072:WhBR5Wz","3072:hBR5Wzz","3072:BR5Wzza","3072:R5Wzzao","3072:5Wzzaoc","3072:Wzzaocx","3072:zzaocxn","3072:zaocxn1","3072:aocxn1l","3072:ocxn1lD","3072:cxn1lD3","3072:xn1lD33","3072:n1lD33n","3072:1lD33n9","3072:lD33n9n","3072:D33n9n8","3072:33n9n8z","3072:3n9n8z5","3072:n9n8z5+","3072:9n8z5+2","3072:n8z5+2f","3072:8z5+2fO","3072:z5+2fOQ","3072:5+2fOQm","3072:+2fOQmg","3072:2fOQmgV","3072:fOQmgVi","6144:JAq5QU/","6144:Aq5QU/U","6144:q5QU/UY","6144:5QU/UY3","6144:QU/UY3Z","6144:U/UY3Z5","6144:/UY3Z5W","6144:UY3Z5Wh","6144:Y3Z5WhB","6144:3Z5WhBR","6144:Z5WhBR5","6144:5WhBR5W","6144:WhBR5Wz","6144:hBR5Wzz","6144:BR5Wzza","6144:R5Wzzao","6144:5Wzzaoc","6144:Wzzaocx","6144:zzaocxn","6144:zaocxn1","6144:aocxn1l","6144:ocxn1lD","6144:cxn1lD3","6144:xn1lD33","6144:n1lD33n","6144:1lD33n9","6144:lD33n9n","6144:D33n9n8","6144:33n9n8z","6144:3n9n8z5","6144:n9n8z5+","6144:9n8z5+2","6144:n8z5+2f","6144:8z5+2fO","6144:z5+2fOQ","6144:5+2fOQm","6144:+2fOQmg","6144:2fOQmgV","6144:fOQmgVi","3072:JLi5gIx","3072:Li5gIxw","3072:i5gIxwz","3072:5gIxwzu","3072:gIxwzuo","3072:Ixwzuoc","3072:xwzuocx","3072:wzuocxn","3072:zuocxnT","3072:uocxnTD","3072:ocxnTD3","3072:cxnTD34","3072:xnTD345","3072:nTD345+","3072:TD345+2","3072:D345+2f","3072:345+2fO","3072:45+2fOQ","3072:+2fOQmn"],"imphash":"93815027a90d6499cda034b4a48928b7","pehash":"c2a38bb7014956938d32e0b503bdd4676e04ce7c"},"file_info":{"file_name":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","file_type":["peexe","executable"],"file_type_id":"exe","file_size":169224,"entropy":6.32,"compile_timestamp":"2010-03-31T20:24:50","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792863613000,"last_seen":1792863613000,"last_multi_scan":1792863613000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":4,"import_count":0,"export_count":0,"embedded_file_count":3,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":96768,"raw_size":98304},{"name":".rdata","virtual_address":"0x19000","virtual_size":50428,"raw_size":53248},{"name":".data","virtual_address":"0x26000","virtual_size":8432,"raw_size":4096},{"name":".rsrc","virtual_address":"0x29000","virtual_size":1604,"raw_size":4096}],"section_names":[".text",".rdata",".data",".rsrc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":38},"sandbox_signatures":{"informative_count":89,"suspicious_count":9,"malicious_count":0,"total":98},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to create a service (API string)"},{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"suspicious","value":"Contains ability to elevate privileges"},{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"suspicious","value":"Tries to obtain the highest possible privilege level without UAC dialog"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"suspicious","value":"Contains ability to enumerate services"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"@(#) BAB_EM_3DES enabled \n\" (Indicator: \"3des\"; Source: \"sample.bin\"), Found string \"@(#) BAB_SQL_3DES enabled \n\" (Indicator: \"3des\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"JobEng_ADRCheckSession::Unable to get session hostname for DR session. id=%d path=%s\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"JOBENG: JobEngInitializeVMNodeInfo: ASDB_GetVMListByProxy(): hyperv hostname = %s, rc = %d.\" (Indicator: \"hostname\"; Source: \"sample.bin\"), Found string \"JobEng_ADRCheckSession::session hostname is NULL, unable to call pfnADRCheckSession.\" (Indicator: \"hostname\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Empty password for secure Migration\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"jobscripts\\stagingpolicy\\securemigration\\password\\\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"don't find password for Secure Migration\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\"), Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\"), Found reference to API \"SpawnPurgeCopyThread:: CreateThread failed. error = 0x%x\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\ComputerAssociates\\CA ARCserve Backup\\Products\" in Source: sample.bin, \"SOFTWARE\\ComputerAssociates\\InoculateIT\\CurrentVersion\\Path\" in Source: sample.bin, \"SOFTWARE\\ComputerAssociates\\ScanEngine\\Path\" in Source: sample.bin, \"SOFTWARE\\Cheyenne\\Inoculan\\CurrentVersion\\Path\" in Source: sample.bin, \"SOFTWARE\\ComputerAssociates\\CA ARCserve Backup\\ProductsConfigInfo\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"sample.bin\"), Found reference to API \"StartServiceCtrlDispatcherA\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartService %s SUCCESS.\n\" (Indicator: \"StartService\"; Source: \"sample.bin\"), Found reference to API \"StartServiceA\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\"), Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"e:\\AB14\\BB\\JobEng.Exe\\x86.rel\\jobeng.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManagerA\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"RunJob: CreateProcess() failed for job: %d, cmdline: %s, GetLastErrorRet: %d\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserA\" (Indicator: \"LogonUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-225","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"sample.bin\"), Found reference to API \"InitializeSecurityDescriptor\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"sample.bin\"), Found reference to API \"RevertToSelf\" (Indicator: \"RevertToSelf\"; Source: \"sample.bin\"), Found reference to API \"RunJob(): InitializeSecurityDescriptor(): failed for job: %d, GetLastErrorRet: %d\" (Indicator: \"InitializeSecurityDescriptor\"; Source: \"sample.bin\"), Found reference to API \"RunJob(): SetSecurityDescriptorDacl(): failed for job: %d, GetLastErrorRet: %d\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"sample.bin\"), Found reference to API \"SetSecurityDescriptorDacl\" (Indicator: \"SetSecurityDescriptorDacl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"ImpersonateLoggedOnUser\" (Indicator: \"ImpersonateLoggedOnUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"System Security","name":"Tries to obtain the highest possible privilege level without UAC dialog","description":"$29","origin":"sample.bin","mitre_attack_id":"T1548.002","id":"string-31","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; Source: \"sample.bin\"), Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"JobEngineThread::WaitForSingleObject(hEventRPCReady) returns, dwWaitResult = 0x%x\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"RegisterQSIJobProcs(): Unable to do FreeLibrary for %s,error=%s\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"RegisterQSIJobProcs(): Unable to do LoadLibrary %s,error=%s\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"JOBENG: Unable to do FreeLibrary for %s,error=%s\n\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\"), Found reference to API \"JOBENG: Unable to do LoadLibrary %s,error=%s\n\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\"), Found reference to API \"SpawnPurgeCopyThread:: CreateThread failed. error = 0x%x\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"ControlService\" (Indicator: \"ControlService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"RegisterQSIJobProcs(): Unable to do LoadLibrary %s,error=%s\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"JOBENG: Unable to do LoadLibrary %s,error=%s\n\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerA\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"DBGHELP.DLL\" (Indicator: \"dbghelp.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://www.verisign.com/rpa0\", Pattern match: \"http://crl.verisign.com/pca3.crl0\", Pattern match: \"http://ocsp.verisign.com0\", Pattern match: \"https://www.verisign.com/rpa01\", Pattern match: \"http://crl.verisign.com/tss-ca.crl0\", Pattern match: \"csc3-2004-aia.verisign.com/csc3-2004-aia.cer0\", Pattern match: \"https://www.verisign.com/rpa\", Pattern match: \"crl.verisign.com/thawtetimestampingca.crl0\", Pattern match: \"http://csc3-2004-crl.verisign.com/csc3-2004.crl0d\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.verisign.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 10842-408-0040C8D0\n SetUnhandledExceptionFilter@KERNEL32.dll at 10842-753-004185D3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 102611; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 103431; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 149223; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 150043; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 167717; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"AsTaskCheckLicense::Register on the primary server (%s), pMachineName (%s) asRc=%d, ulProductID=%0x.\" (Source: \"00000000-00000176.00000001.109329.0041A000.00000002.mdmp\")\n Found string \"AsTaskCheckLicense::ASCPca_license_check_for_serverRetryWrapper failed. asRet=%d, szPrimaryServer=%s, pMachineName=%s\" (Source: \"00000000-00000176.00000001.109329.0041A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.dll at 10842-351-0040FC10\n FindFirstFileA@KERNEL32.dll at 10842-371-00411FB0\n FindFirstFileA@KERNEL32.dll at 10842-372-00411E00","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 10842-371-00411FB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 10842-371-00411FB0\n GetLocalTime@KERNEL32.dll at 10842-442-00401440\n GetLocalTime@KERNEL32.dll at 10842-477-004020D7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 10842-417-00404D30","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 10842-291-00416740\n GetProcessHeap@KERNEL32.dll at 10842-296-004110B0\n GetProcessHeap@KERNEL32.dll at 10842-306-004138B0\n GetProcessHeap@KERNEL32.dll at 10842-308-00412C20\n GetProcessHeap@KERNEL32.dll at 10842-336-0040F520\n GetProcessHeap@KERNEL32.dll at 10842-338-004173D3\n OpenProcess@KERNEL32.dll at 10842-430-004033C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetLocalTime@KERNEL32.dll directly followed by \"cmp word ptr [00426796h], bx\" and \"jbe 0040231Bh\" at 10842-477-004020D7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" queried token user identity (UID: 00000000-00000176)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 10842-1-00418482\n Sleep@KERNEL32.dll at 10842-290-00417460\n WaitForSingleObject@KERNEL32.dll at 10842-409-0040C2D0\n Sleep@KERNEL32.dll at 10842-416-0040A0D0\n Sleep@KERNEL32.dll at 10842-422-00403DB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 10842-351-0040FC10\n LoadLibraryA@KERNEL32.dll at 10842-432-00403060","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"SOFTWARE\\ComputerAssociates\\ScanEngine\\Path\" in Source: 00000000-00000176.00000001.109329.0041A000.00000002.mdmp\n \"SOFTWARE\\ComputerAssociates\\InoculateIT\\CurrentVersion\\Path\" in Source: 00000000-00000176.00000001.109329.0041A000.00000002.mdmp\n \"SOFTWARE\\Cheyenne\\Inoculan\\CurrentVersion\\Path\" in Source: 00000000-00000176.00000001.109329.0041A000.00000002.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77010000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" file has an entrypoint instructions - \"call\t0x418918,jmp\t0x4181ce,push\tebp,mov\tebp, esp,sub\tesp, 0x328,mov\tdword ptr [0x4278e8], eax,mov\tdword ptr [0x4278e4], ecx,mov\tdword ptr [0x4278e0], edx,mov\tdword ptr [0x4278dc], ebx,mov\tdword ptr [0x4278d8], esi,mov\tdword ptr [0x4278d4], edi,mov\tword ptr [0x427900], ss,mov\tword ptr [0x4278f4], cs,mov\tword ptr [0x4278d0], ds,mov\tword ptr [0x4278cc], es,mov\tword ptr [0x4278c8], fs,mov\tword ptr [0x4278c4], gs,pushfd\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2b","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"CWDILLEGALINDLLSEARCH\"; Value: \"\")\n \"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\"; Value: \"\")\n \"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\"; Value: \"\")\n \"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Makes a code branch decision directly after an API that is environment aware","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"ImpersonateLoggedOnUser\" which can \"let the calling thread impersonate the security context of a logged-on user\" [Source: 94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201]\n Observed import api \"InitializeSecurityDescriptor\" which can \"initialize a new security descriptor\" [Source: 94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201]\n Observed import api \"RevertToSelf\" which can \"terminate the impersonation of a client application\" [Source: 94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201]\n Observed import api \"SetSecurityDescriptorDacl\" which can \"set information in a discretionary access control list (DACL)\" [Source: 94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.dll at 10842-719-004189E4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Contains ability to open/control a service","description":"OpenServiceA@ADVAPI32.dll at 10842-419-00403FD0\n OpenServiceA@ADVAPI32.dll at 10842-422-00403DB0\n OpenServiceA@ADVAPI32.dll at 10842-424-004041D0\n OpenServiceA@ADVAPI32.dll at 10842-425-00404090","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to enumerate services","description":"OpenSCManagerA@ADVAPI32.dll at 10842-419-00403FD0\n OpenSCManagerA@ADVAPI32.dll at 10842-422-00403DB0\n OpenSCManagerA@ADVAPI32.dll at 10842-424-004041D0\n OpenSCManagerA@ADVAPI32.dll at 10842-425-00404090","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1007","relevance":7,"id":"stream-27","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"SuspendThread@KERNEL32.dll at 10842-418-00407EC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 10842-409-0040C2D0\n SetSecurityDescriptorDacl@ADVAPI32.dll at 10842-424-004041D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"InitializeSecurityDescriptor@ADVAPI32.dll at 10842-409-0040C2D0\n InitializeSecurityDescriptor@ADVAPI32.dll at 10842-424-004041D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"StartServiceCtrlDispatcherA\n RegOpenKeyA\n StartServiceA\n SetSecurityDescriptorDacl\n RegCloseKey\n RegOpenKeyExA\n CreateFileA\n OpenProcess\n FindFirstFileA\n CopyFileA\n GetSystemInfo\n GetVersionExA\n Sleep\n UnhandledExceptionFilter\n GetFileAttributesA\n GetProcAddress\n CreateProcessA\n CreateThread\n GetComputerNameW\n TerminateProcess\n GetModuleFileNameA\n GetComputerNameA\n GetTickCount\n DeleteFileA\n LoadLibraryA\n FindNextFileA\n IsDebuggerPresent","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}]}],"intel_graph":{"map":{"File:94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201":{"type":"File","value":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 4 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:d45d02f86044118377ebd96e1487a693d9e570b9c36f6c8dae5ab56dd301da9f":{"type":"File","value":"d45d02f86044118377ebd96e1487a693d9e570b9c36f6c8dae5ab56dd301da9f","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/vnd.ms-cab-compressed"}},"chains":[{"id":"1563608097559366186","root":"File:94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","to_key":"File:d45d02f86044118377ebd96e1487a693d9e570b9c36f6c8dae5ab56dd301da9f"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","edges":[{"edge_kind":"extracted","from_key":"File:94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","to_key":"File:d45d02f86044118377ebd96e1487a693d9e570b9c36f6c8dae5ab56dd301da9f"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":8,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6adced7cb7c5fb0f8406f94f","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","analysis_start_time":"2026-10-24T17:40:13+00:00","indicators_count":{"informative":89,"suspicious":9,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6adced7cb7c5fb0f8406f94f"}],"processes":[{"pid":176,"ppid":0,"name":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe","command_line":"","sha256":"94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201","normalized_path":"C:\\94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201.exe","uid":"00000000-00000176","icon":"$2f"}],"all_imported_dlls":["wsock32.dll","ws2_32.dll","msvcrt.dll","rpcrt4.dll","nsi.dll","ntdll.dll","kernel32.dll","KernelBase.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"d45d02f86044118377ebd96e1487a693d9e570b9c36f6c8dae5ab56dd301da9f","sha256":"d45d02f86044118377ebd96e1487a693d9e570b9c36f6c8dae5ab56dd301da9f","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6adced7cb7c5fb0f8406f94f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample 94495aafed65… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample 94495aafed65…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201"}],["$","meta","4",{"property":"og:title","content":"Sample 94495aafed65… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample 94495aafed65…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/94495aafed6562811e948c742a619891a9a5e5c8d87c6cd801c3ffe5b5c6c201"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample 94495aafed65… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample 94495aafed65…. Threat score 0/100. 0/24 AV engines flagged this file. 0 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]