24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T47b,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Doina.Generic Sample 94aa827a514d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 94aa827a514d…. Malware family: Doina.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579","keywords":["Malicious","Doina.Generic","malware analysis","sandbox report","threat intelligence","94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["pedll","executable"],"identifier":"94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Doina.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4be,"\Sessions\1\BaseNamedObjects\A474D52D-8C44-C67D-BBFB-D513232F8A17" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!fkhvgy9!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!fkhvgy9!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!fkhvgy9!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!fkhvgy9!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\DBWinMutex" "A474D52D-8C44-C67D-BBFB-D513232F8A17" "\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208"26:T62b,Spawned process "rundll32.exe" with commandline ""C:\94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll",Run" (UID: 00025870-00003484) Spawned process "cmd.exe" with commandline "/c taskkill /f /im daumcleaner.exe" (UID: 00026333-00003644) Spawned process "taskkill.exe" with commandline "taskkill /f /im daumcleaner.exe" (UID: 00026344-00003372) Spawned process "cmd.exe" with commandline "/c dir "c:\Documents and Settings" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00026369-00003348) Spawned process "cmd.exe" with commandline "/c dir "c:\users" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00026428-00001816) Spawned process "cmd.exe" with commandline "/c dir "%PROGRAMFILES%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00028219-00003008), Spawned process "cmd.exe" with commandline "/c dir "%APPDATA%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00032893-00002052) Spawned process "cmd.exe" with commandline "/c dir "D:\" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00033604-00002220) Spawned process "cmd.exe" with commandline "/c dir "Z:\" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00034117-00000272) Spawned process "cmd.exe" with commandline "/c systeminfo >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00034644-00002056) Spawned process "systeminfo.exe" (UID: 00034656-00001504) Spawned process "cmd.exe" with commandline "/c tasklist >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00036863-00002720) Spawned process "tasklist.exe" (UID: 00036875-00002596)27:T4a1,"1060B7ADDE0FF6DE85637BF89FC4CEBC_2F0A0FD6E5FFBDCBA1672A965E30E8EA" has type "data" "Tar45A3.tmp" has type "data" "CabBFA9.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file" "B06FC0C94A5D113109C15E5A5EE1C21E" has type "data" "Tar97C2.tmp" has type "data" "PI_001.dat" has type "ASCII text with CRLF line terminators" "~DA943A.tmp" has type "HTML document UTF-8 Unicode text with very long lines with CRLF LF line terminators" "mg_6334" has type "data" "PI_003.dat" has type "MS Windows shortcut Item id list present ctime=Mon Jan 1 00:06:32 1601 mtime=Mon Jan 1 00:06:32 1601 atime=Mon Jan 1 00:06:32 1601 length=0 window=hide" "TarBFAA.tmp" has type "data" "EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619" has type "data" "378B079587A9184B2E2AB859CB263F40_2B618FC6CF84AEF3C14E129161BF18D9" has type "data" "D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE" has type "data" "C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873" has type "data" "C9E3282A673263848AB7F0C007FD3AF1_B9498D7CA640C12729362A0450F81EFD" has type "data" "Cab97C1.tmp" has type "Microsoft Cabinet archive data 50939 bytes 1 file"28:T5fc1,Pattern match: "www.braveprince.com" Pattern match: "http://mail.daum.net" Pattern match: "https://logins.daum.net/accounts/srp.do?slevel=0&rid=%s&srplm1=%s" Pattern match: "https://logins.daum.net/accounts/presrp.do?id=%s&srpla=%s&_=%s" Pattern match: "https://logins.daum.net/accounts/loginform.do?url=http%3A%2F%2Fmail.daum.net%2F" Pattern match: "https://mail.daum.net/login?url=http%3A%2F%2Fmail.daum.net%2F" Pattern match: "https://cmail.daum.net/v2/mails/send" Pattern match: "https://cmail.daum.net/v2/upload/attach/uploadInfo" Pattern match: "https://cmail.daum.net/v2/upload/attach/uploadUrl" Pattern match: "https://cmail.daum.net/v2/addressbook/mostcontacted" Pattern match: "https://cmail.daum.net/v2/addressbook" Pattern match: "http://mail.daum.net/kocl/MailCompose.html" Pattern match: "https://cmail.daum.net/v2/addressbook/favorite" Pattern match: "https://cmail.daum.net/v2/mails/autoSave" Pattern match: "https://cmail.daum.net/v2/mails?offset=0&limit=15&folderId=INBOX&labelIds=" Pattern match: "https://cmail.daum.net/v2/setting/logintime" Pattern match: "https://cmail.daum.net/v2/folders?resultType=list" Pattern match: "http://mail.daum.net/kocl/Top.html" Pattern match: "https://cmail.daum.net/v2/folders/usages" Pattern match: "https://cmail.daum.net/v2/setting/basic" Pattern match: "https://mail.daum.net" Pattern match: "https://cmail.daum.net/v2/mails/modify" Pattern match: "https://cmail.daum.net/v2/mails/%s/attachments/%s/download/%s" Pattern match: "https://cmail.daum.net/v2/mails/%s?headerFields=Date" Pattern match: "https://logins.daum.net/accounts/logout.do?url=http%3A%2F%2Fwww.daum.net%2F%3Fnil_profile%3Dlogout" Heuristic match: "mail.daum.net" Heuristic match: "*.daum.net" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0" Pattern match: "http://tj.symcb.com/tj.crl0" Pattern match: "http://tj.symcd.com0&" Pattern match: "http://tj.symcb.com/tj.crt0" Pattern match: "http://t1.symcb.com/ThawtePCA.crl0/" Pattern match: "http://t2.symcb.com0A" Pattern match: "https://www.thawte.com/cps0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEBaH1oht4jAGhSM9vxG%2FZZc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: t2.symcb.com" Heuristic match: "GET /tj.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: tj.symcb.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRvdluGAc%2FlYx1bXFBnllP1ugYHmAQUwk9IV%2FzRT5rAXTh9DgXb2S61UmACEBGXgb1MLNuKtZeWEgz4A1M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: tj.symcd.com" Heuristic match: "logins.daum.net" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sr.symcb.com/sr.crl0" Pattern match: "http://sr.symcd.com0&" Pattern match: "http://sr.symcb.com/sr.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.verisign.com/cps0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://ocsp.verisign.com0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18%2BP0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.verisign.com" Pattern match: "https://d.symcb.com/rpa0#" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7%2FLTfz%2BtZU062rQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0JBRnBp%2F14Jg%2FXj4aa6BlKlQVdQQUAVmr5906C1mmZGPWzyAHV9WR52oCEELSNQn0wIadW9%2FAms7ArTE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sr.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "member.daum.net" Pattern match: "www.digicert.com1402" Pattern match: "http://crl3.digicert.com/sha2-ev-server-g2.crl04" Pattern match: "http://crl4.digicert.com/sha2-ev-server-g2.crl0K" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0R" Pattern match: "cacerts.digicert.com/DigiCertSHA2ExtendedValidationServerCA.crt0" Pattern match: "www.digicert.com1+0" Pattern match: "http://ocsp.digicert.com0K" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0=" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEAx5qUSwjBGVIJJhX%2BJrHYM%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRJ9L2KGL92BpjF3kAtaDtxauTmhgQUPdNQpdagre7zSmAKZdMh1Pj41g8CEAaUnx4UH7FKSHa6oFyPZ0g%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.com" Heuristic match: "cmail.daum.net" Pattern match: "http://daummail.tistory.com/420" Pattern match: "http://daummail.tistory.com/" Pattern match: "https://member.daum.net/join?rtnUrl=http%3A%2F%2Fmail.daum.net%2F" Pattern match: "https://play.google.com/store/apps/details?id=net.daum.android.mail" Pattern match: "http://www.kakaocorp.com/main" Pattern match: "mail1.daumcdn.net/mail_static/mint/dist/ef1584a/js/logout-lib.js" Pattern match: "mail1.daumcdn.net/mail_static/mint/dist/ef1584a/js/logout-common.js" Pattern match: "www.4shared[1].xml" Heuristic match: "02/15/2015 04:40 AM 192,512 00010007.ci" Pattern match: "www.999[1].xml" Pattern match: "www.americanas.com[1].xml" Pattern match: "www.att[1].xml" Pattern match: "www.blogcu[1].xml" Pattern match: "www.brothersoft[1].xml" Pattern match: "www.chip[1].xml" Pattern match: "www.corriere[1].xml" Pattern match: "www.daily.co[1].xml" Pattern match: "www.ebay[1].xml" Pattern match: "www.freeonlinegames[1].xml" Pattern match: "www.gazeta[1].xml" Pattern match: "www.girlsgogames[1].xml" Pattern match: "www.hao123[1].xml" Pattern match: "www.hm[1].xml" Pattern match: "www.hurriyet.com[1].xml" Pattern match: "www.ibm[1].xml" Pattern match: "www.ikea[1].xml" Pattern match: "www.imvu[1].xml" Pattern match: "www.intel[1].xml" Pattern match: "www.intuit[1].xml" Pattern match: "www.irs[1].xml" Pattern match: "www.lowes[1].xml" Pattern match: "www.marca[1].xml" Pattern match: "www.mediafire[1].xml" Pattern match: "www.onlinedown[1].xml" Pattern match: "www.paypal[1].xml" Pattern match: "www.realtor[1].xml" Pattern match: "www.sky[1].xml" Pattern match: "www.sohu[1].xml" Pattern match: "www.songspk[1].xml" Pattern match: "www.sony[1].xml" Pattern match: "www.state[1].xml" Pattern match: "www.symantec[1].xml" Pattern match: "www.technologycraze[1].xml" Pattern match: "www.theguardian[1].xml" Pattern match: "www.tiexue[1].xml" Pattern match: "www.tmall[1].xml" Pattern match: "www.u43.pnc[1].xml" Pattern match: "www.ucoz[1].xml" Pattern match: "www.youku[1].xml" Pattern match: "www.360doc[1].xml" Pattern match: "www.abril.com[1].xml" Pattern match: "www.adp[1].xml" Pattern match: "www.aeriagames[1].xml" Pattern match: "www.amazon[1].xml" Pattern match: "www.apple[1].xml" Pattern match: "www.buenastareas[1].xml" Pattern match: "www.caixa.gov[1].xml" Pattern match: "www.cncn[1].xml" Pattern match: "www.craigslist[1].xml" Pattern match: "www.dailymail.co[1].xml" Pattern match: "www.doctissimo[1].xml" Pattern match: "www.eonline[1].xml" Pattern match: "www.evite[1].xml" Pattern match: "www.ifeng[1].xml" Pattern match: "www.kayak[1].xml" Pattern match: "www.leboncoin[1].xml" Pattern match: "www.lenovo[1].xml" Pattern match: "www.le[1].xml" Pattern match: "www.mapion.co[1].xml" Pattern match: "www.marriott[1].xml" Pattern match: "www.microsoftstore[1].xml" Pattern match: "www.nokia[1].xml" Pattern match: "www.oracle[1].xml" Pattern match: "www.overstock[1].xml" Pattern match: "www.pnc[1].xml" Pattern match: "www.qqtn[1].xml" Pattern match: "www.qq[1].xml" Pattern match: "www.qunar[1].xml" Pattern match: "www.slideshare[1].xml" Pattern match: "www.tenpay[1].xml" Pattern match: "www.today[1].xml" Pattern match: "www.toshiba[1].xml" Pattern match: "www.tvguide[1].xml" Pattern match: "www.washingtonpost[1].xml" Pattern match: "www.xdating[1].xml" Pattern match: "www.y8[1].xml" Pattern match: "www.youtube[1].xml" Pattern match: "www1.euro.dell[1].xml" Pattern match: "www.2345[1].xml" Pattern match: "www.amazon.co[1].xml" Pattern match: "www.baixaki.com[1].xml" Pattern match: "www.barclays.co[1].xml" Pattern match: "www.biglobe.ne[1].xml" Pattern match: "www.blinkx[1].xml" Pattern match: "www.break[1].xml" Pattern match: "www.cox[1].xml" Pattern match: "www.ctrip[1].xml" Pattern match: "www.delta[1].xml" Pattern match: "www.ebay.com[1].xml" Pattern match: "www.gnavi.co[1].xml" Pattern match: "www.ledu[1].xml" Pattern match: "www.liutilities[1].xml" Pattern match: "www.lloydsbank[1].xml" Pattern match: "www.made-in-china[1].xml" Pattern match: "www.minijuegos[1].xml" Pattern match: "www.monster[1].xml" Pattern match: "www.msn[1].xml" Pattern match: "www.nickjr[1].xml" Pattern match: "www.noaa[1].xml" Pattern match: "www.otomoto[1].xml" Pattern match: "www.pagesjaunes[1].xml" Pattern match: "www.pps[1].xml" Pattern match: "www.rakuten.co[1].xml" Pattern match: "www.repubblica[1].xml" Pattern match: "www.rightmove.co[1].xml" Pattern match: "www.sdo[1].xml" Pattern match: "www.searchina[1].xml" Pattern match: "www.shoplocal[1].xml" Pattern match: "www.skycn[1].xml" Pattern match: "www.suning[1].xml" Pattern match: "www.telegraph.co[1].xml" Pattern match: "www.usaa[1].xml" Pattern match: "www.viewster[1].xml" Pattern match: "www.wikia[1].xml" Pattern match: "www.zoosk[1].xml" Pattern match: "www.3suisses[1].xml" Pattern match: "www.61[1].xml" Pattern match: "www.91[1].xml" Pattern match: "www.allocine[1].xml" Pattern match: "www.aol[1].xml" Pattern match: "www.bankofamerica[1].xml" Pattern match: "www.bloomberg[1].xml" Pattern match: "www.chase[1].xml" Pattern match: "www.citi[1].xml" Pattern match: "www.constantcontact[1].xml" Pattern match: "www.da-ads[1].xml" Pattern match: "www.duote[1].xml" Pattern match: "www.etsy[1].xml" Pattern match: "www.euroresidentes[1].xml" Pattern match: "www.goo.ne[1].xml" Pattern match: "www.ig.com[1].xml" Pattern match: "www.jetblue[1].xml" Pattern match: "www.kuwan8[1].xml" Pattern match: "www.last[1].xml" Pattern match: "www.legacy[1].xml" Pattern match: "www.livedoor[1].xml" Pattern match: "www.microsoft[1].xml" Pattern match: "www.mobile[1].xml" Pattern match: "www.mozilla[1].xml" Pattern match: "www.mtime[1].xml" Pattern match: "www.myplaycity[1].xml" Pattern match: "www.pchome[1].xml" Pattern match: "www.real[1].xml" Pattern match: "www.robtex[1].xml" Pattern match: "www.seznam[1].xml" Pattern match: "www.shutterfly[1].xml" Pattern match: "www.sogou[1].xml" Pattern match: "www.t-online[1].xml" Pattern match: "www.thefreedictionary[1].xml" Pattern match: "www.theweathernetwork[1].xml" Pattern match: "www.travelocity[1].xml" Pattern match: "www.united[1].xml" Pattern match: "www.univision[1].xml" Pattern match: "www.uol.com[1].xml" Pattern match: "www.verizonwireless[1].xml" Pattern match: "www.wellsfargo[1].xml" Pattern match: "www.wheretowatch[1].xml" Pattern match: "www.yhd[1].xml" Pattern match: "www.zhenai[1].xml" Pattern match: "www3.hilton[1].xml" Heuristic match: "02/28/2017 12:09 PM 0 ssp[1].ad" Pattern match: "www.636[1].txt" Pattern match: "www.91[1].txt" Pattern match: "www.addthis[1].txt" Pattern match: "www.adnetworkperformance[1].txt" Pattern match: "www.adp[2].txt" Pattern match: "www.aeriagames[1].txt" Pattern match: "www.alexa[2].txt" Pattern match: "www.americanas.com[1].txt" Pattern match: "www.aol[1].txt" Pattern match: "www.aol[3].txt" Pattern match: "www.att[2].txt" Pattern match: "www.baixaki.com[1].txt" Pattern match: "www.barbie[1].txt" Pattern match: "www.biglobe.ne[2].txt" Pattern match: "www.bing[2].txt" Pattern match: "www.bloomberg[2].txt" Pattern match: "www.booking[2].txt" Pattern match: "www.break[2].txt" Pattern match: "www.caixa.gov[1].txt" Pattern match: "www.cbs[1].txt" Pattern match: "www.chase[1].txt" Pattern match: "www.citi[2].txt" Pattern match: "www.cncn[1].txt" Pattern match: "www.corriere[2].txt" Pattern match: "www.daily.co[1].txt" Pattern match: "www.delta[1].txt" Pattern match: "www.delta[2].txt" Pattern match: "www.discovercard[1].txt" Pattern match: "www.eol[1].txt" Pattern match: "www.eonline[1].txt" Pattern match: "www.etsy[1].txt" Pattern match: "www.evite[1].txt" Pattern match: "www.fixya[2].txt" Pattern match: "www.foxsports[1].txt" Pattern match: "www.freeonlinegames[1].txt" Pattern match: "www.gamezer[1].txt" Pattern match: "www.gazeta[2].txt" Pattern match: "www.girlsgogames[2].txt" Pattern match: "www.goo.ne[1].txt" Pattern match: "www.hurriyet.com[2].txt" Pattern match: "www.ichwillkuehe[1].txt" Pattern match: "www.ifeng[2].txt" Pattern match: "www.ig.com[1].txt" Pattern match: "www.ikea[1].txt" Pattern match: "www.immobilienscout24[1].txt" Pattern match: "www.inbox[1].txt" Pattern match: "www.instagram[2].txt" Pattern match: "www.intel[1].txt" Pattern match: "www.itau.com[1].txt" Pattern match: "www.jetblue[1].txt" Pattern match: "www.jiayuan[1].txt" Pattern match: "www.jiayuan[2].txt" Pattern match: "www.kayak[1].txt" Pattern match: "www.kayak[2].txt" Pattern match: "www.kohls[2].txt" Pattern match: "www.last[2].txt" Pattern match: "www.leboncoin[1].txt" Pattern match: "www.lenovo[2].txt" Pattern match: "www.le[1].txt" Pattern match: "www.linkedin[1].txt" Pattern match: "www.liveadexchanger[1].txt" Pattern match: "www.livedoor[1].txt" Pattern match: "www.livestrong[1].txt" Pattern match: "www.lloydsbank[1].txt" Pattern match: "www.lowermybills[1].txt" Pattern match: "www.lowes[2].txt" Pattern match: "www.mapion.co[2].txt" Pattern match: "www.marca[2].txt" Pattern match: "www.marriott[1].txt" Pattern match: "www.maxonclick[1].txt" Pattern match: "www.merriam-webster[1].txt" Pattern match: "www.microsoftstore[1].txt" Pattern match: "www.moonbasa[1].txt" Pattern match: "www.msn[1].txt" Pattern match: "www.msn[3].txt" Pattern match: "www.mtime[1].txt" Pattern match: "www.nate[1].txt" Pattern match: "www.nokia[2].txt" Pattern match: "www.overstock[2].txt" Pattern match: "www.pagesjaunes[2].txt" Pattern match: "www.partypoker[1].txt" Pattern match: "www.paypal[1].txt" Pattern match: "www.pcauto.com[1].txt" Pattern match: "www.pchome[2].txt" Pattern match: "www.pnc[2].txt" Pattern match: "www.pof[1].txt" Pattern match: "www.pof[2].txt" Pattern match: "www.pole-emploi[1].txt" Pattern match: "www.qq[1].txt" Pattern match: "www.rakuten.co[2].txt" Pattern match: "www.realtor[2].txt" Pattern match: "www.repubblica[2].txt" Pattern match: "www.rightmove.co[1].txt" Pattern match: "www.robtex[2].txt" Pattern match: "www.shoplocal[1].txt" Pattern match: "www.shutterfly[2].txt" Pattern match: "www.sogou[1].txt" Pattern match: "www.sohu[2].txt" Pattern match: "www.sony[10].txt" Pattern match: "www.sony[2].txt" Pattern match: "www.sony[3].txt" Pattern match: "www.sony[4].txt" Pattern match: "www.sony[5].txt" Pattern match: "www.sony[6].txt" Pattern match: "www.sony[7].txt" Pattern match: "www.sony[8].txt" Pattern match: "www.sony[9].txt" Pattern match: "www.stumbleupon[2].txt" Pattern match: "www.suning[1].txt" Pattern match: "www.symantec[1].txt" Pattern match: "www.syyx[1].txt" Pattern match: "www.t-online[2].txt" Pattern match: "www.telegraph.co[1].txt" Pattern match: "www.tenpay[1].txt" Pattern match: "www.terra.com[1].txt" Pattern match: "www.thefreedictionary[1].txt" Pattern match: "www.theweathernetwork[1].txt" Pattern match: "www.tiexue[1].txt" Pattern match: "www.tmall[2].txt" Pattern match: "www.today[1].txt" Pattern match: "www.toshiba[2].txt" Pattern match: "www.travelocity[2].txt" Pattern match: "www.trulia[1].txt" Pattern match: "www.united[2].txt" Pattern match: "www.univision[1].txt" Pattern match: "www.uol.com[1].txt" Pattern match: "www.upsellit[1].txt" Pattern match: "www.usaa[1].txt" Pattern match: "www.verizonwireless[1].txt" Pattern match: "www.viewster[1].txt" Pattern match: "www.washingtonpost[1].txt" Pattern match: "www.wheretowatch[1].txt" Pattern match: "www.wwe[1].txt" Pattern match: "www.zergnet[1].txt" Pattern match: "www.zhcw[1].txt" Pattern match: "www.zhenai[1].txt" Pattern match: "www.zoosk[2].txt" Pattern match: "www1.euro.dell[1].txt" Pattern match: "www3.hilton[2].txt" Heuristic match: "01/14/2015 01:55 PM 118 gmpopenh264.info" Heuristic match: "04/21/2016 01:07 PM Microsoft.NET" Heuristic match: "04/21/2016 01:06 PM Proof.es" Heuristic match: "04/21/2016 01:06 PM Proof.fr" Heuristic match: "Directory of c:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es" Heuristic match: "Directory of c:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr" Heuristic match: "02/25/2009 06:32 PM 11,745 1394dbg.cat" Heuristic match: "01/09/2008 10:24 AM 1,036 cv2http.pl" Heuristic match: "01/09/2008 10:24 AM 19,800 cvs.pm" Heuristic match: "01/09/2008 10:24 AM 14,439 p4.pm" Heuristic match: "01/09/2008 10:24 AM 12,509 svn.pm" Heuristic match: "04/14/2008 04:18 PM 19,718 tfs.pm" Heuristic match: "01/09/2008 10:24 AM 13,846 vss.pm" Heuristic match: "02/25/2009 06:32 PM 7,182 usb2dbg.cat" Heuristic match: "11/20/2010 01:29 PM 37,376 audiodepthconverter.ax" Heuristic match: "11/20/2010 01:29 PM 46,592 directshowtap.ax" Heuristic match: "11/20/2010 01:29 PM 31,232 fieldswitch.ax" Heuristic match: "11/20/2010 01:29 PM 32,768 offset.ax" Heuristic match: "11/20/2010 01:29 PM 56,832 rtstreamsink.ax" Heuristic match: "11/20/2010 01:29 PM 39,936 rtstreamsource.ax" Heuristic match: "11/20/2010 01:29 PM 55,808 soniccolorconverter.ax" Heuristic match: "11/20/2010 01:29 PM 39,424 sonicsptransform.ax" Heuristic match: "02/15/2015 04:39 AM 51,236 CIEXYZ.pf" Heuristic match: "02/15/2015 04:39 AM 632 GRAY.pf" Heuristic match: "02/15/2015 04:39 AM 1,044 LINEAR_RGB.pf" Heuristic match: "02/15/2015 04:39 AM 274,474 PYCC.pf" Heuristic match: "02/15/2015 04:39 AM 3,144 sRGB.pf" Heuristic match: "01/20/2010 08:40 PM 7,321 OEMPRINT.CAT" Heuristic match: "07/14/2009 06:52 PM 21,234 isvtier5appsignsdk.cc" Heuristic match: "07/14/2009 10:29 PM 7,501 VirtualLightSensorDriver.cat" Heuristic match: "07/14/2009 10:29 PM 7,436 virtualstorage.cat" Heuristic match: "07/14/2009 06:53 PM 9,117 AqErr.mc" Heuristic match: "07/14/2009 06:53 PM 10,851 CatErr.mc" Heuristic match: "07/14/2009 06:53 PM 26 W32chico.mk" Heuristic match: "02/15/2015 04:53 AM explore.vc" Heuristic match: "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\com\administration\explore.vc" Heuristic match: "07/14/2009 06:54 PM 443 adoprivps.mk" Heuristic match: "07/14/2009 06:55 PM 1,273 binding.pl" Heuristic match: "07/14/2009 06:55 PM 2,426 create.pl" Heuristic match: "07/14/2009 06:55 PM 7,933 modify.pl" Heuristic match: "07/14/2009 06:55 PM 1,521 Messages.mc" Heuristic match: "07/14/2009 06:55 PM 1,478 Messages.mc" Heuristic match: "07/14/2009 06:55 PM 256 resource.hm" Heuristic match: "07/14/2009 06:55 PM 1,103 backupeventlog.pl" Heuristic match: "07/14/2009 06:55 PM 747 cimomid.pl" Heuristic match: "07/14/2009 06:55 PM 1,178 cleareventlog.pl" Heuristic match: "07/14/2009 06:55 PM 758 datetime.pl" Heuristic match: "07/14/2009 06:55 PM 1,430 deleteservice.pl" Heuristic match: "07/14/2009 06:55 PM 849 derivation.pl" Heuristic match: "07/14/2009 06:55 PM 1,297 disabledhcp.pl" Heuristic match: "07/14/2009 06:55 PM 841 dnsdomainname.pl" Heuristic match: "07/14/2009 06:55 PM 764 domainname.pl" Heuristic match: "07/14/2009 06:55 PM 3,068 emptyarray.pl" Heuristic match: "07/14/2009 06:55 PM 1,030 enabledhcp.pl" Heuristic match: "07/14/2009 06:55 PM 1,770 errmsg.pl" Heuristic match: "07/14/2009 06:55 PM 852 getappboost.pl" Heuristic match: "07/14/2009 06:55 PM 798 getbootconfig.pl" Heuristic match: "07/14/2009 06:55 PM 1,406 getnetworkadapterconfig.pl" Heuristic match: "07/14/2009 06:55 PM 1,230 listeventlogfiles.pl" Heuristic match: "07/14/2009 06:55 PM 1,265 listeventsbycode.pl" Heuristic match: "07/14/2009 06:55 PM 972 listnetworkadapters.pl" Heuristic match: "07/14/2009 06:55 PM 792 listnetworkprotocols.pl" Heuristic match: "07/14/2009 06:55 PM 1,155 listservices.pl" Heuristic match: "07/14/2009 06:55 PM 751 machinename.pl" Heuristic match: "07/14/2009 06:55 PM 1,313 methodex.pl" Heuristic match: "07/14/2009 06:55 PM 1,511 ntevent.pl" Heuristic match: "07/14/2009 06:55 PM 2,234 nvsarray.pl" Heuristic match: "07/14/2009 06:55 PM 866 objset.pl" Heuristic match: "07/14/2009 06:55 PM 1,197 osinfo.pl" Heuristic match: "07/14/2009 06:55 PM 2,077 pathbuild.pl" Heuristic match: "07/14/2009 06:55 PM 1,321 pauseservice.pl" Heuristic match: "07/14/2009 06:55 PM 984 printerstatus.pl" Heuristic match: "07/14/2009 06:55 PM 942 printjobs.pl" Heuristic match: "07/14/2009 06:55 PM 1,900 privilege.pl" Heuristic match: "07/14/2009 06:55 PM 748 process.pl" Heuristic match: "07/14/2009 06:55 PM 910 reboot.pl" Heuristic match: "07/14/2009 06:55 PM 1,521 remotereboot.pl" Heuristic match: "07/14/2009 06:55 PM 1,465 remoteshutdown.pl" Heuristic match: "07/14/2009 06:55 PM 1,357 resumeservice.pl" Heuristic match: "07/14/2009 06:55 PM 1,299 schema.pl" Heuristic match: "07/14/2009 06:55 PM 1,104 service.pl" Heuristic match: "07/14/2009 06:55 PM 964 servicestopped.pl" Heuristic match: "07/14/2009 06:55 PM 933 shutdown.pl" Heuristic match: "07/14/2009 06:55 PM 1,005 spawn.pl" Heuristic match: "07/14/2009 06:55 PM 1,026 startservice.pl" Heuristic match: "07/14/2009 06:55 PM 1,029 stopservice.pl" Heuristic match: "07/14/2009 06:55 PM 896 system.pl" Heuristic match: "07/14/2009 06:55 PM 876 viewpagefilesettings.pl" Heuristic match: "07/14/2009 06:55 PM 1,447 perfmon.pl" Heuristic match: "07/14/2009 06:55 PM 845 registry.pl" Heuristic match: "02/15/2015 04:54 AM VB.NET" Heuristic match: "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\tabletpc\autoclaims\VB.NET" Heuristic match: "07/14/2009 06:55 PM 544 FileRep.mc" Heuristic match: "07/14/2009 06:55 PM 269 eventlogmsgs.mc" Heuristic match: "07/14/2009 06:55 PM 2,188 MemCtrs.Mc" Heuristic match: "07/14/2009 06:55 PM 1,571 GenCtrs.Mc" Heuristic match: "Directory of c:\Program Files\Microsoft.NET" Heuristic match: "08/08/2011 10:13 AM 10,152 bazisvirtualcdbus.cat" Heuristic match: "09/12/2014 11:25 PM 2,046 dictionary.alcatel.sr"29:T5fd,"02/28/2017 01:06 PM 13 www.paypal[1].xml" (Indicator: "paypal") "02/28/2017 12:59 PM 13 www.youtube[1].xml" (Indicator: "youtube") "02/28/2017 01:02 PM 36,326 paypal_com[1].htm" (Indicator: "paypal") "02/28/2017 12:27 PM 236,060 myspace_com[1].htm" (Indicator: "myspace") "03/01/2017 12:54 PM 252 HPFeb15_social_Twitter[1].png" (Indicator: "twitter") "02/28/2017 12:29 PM 1,236 pspubws@myspace[1].txt" (Indicator: "myspace") "02/28/2017 01:02 PM 132 pspubws@paypalobjects[2].txt" (Indicator: "paypal") "02/28/2017 01:02 PM 557 pspubws@paypal[2].txt" (Indicator: "paypal") "02/28/2017 12:18 PM 99 pspubws@twitter[1].txt" (Indicator: "twitter") "02/28/2017 01:02 PM 95 pspubws@www.paypal[1].txt" (Indicator: "paypal") "02/28/2017 12:07 PM 176 pspubws@youtube[2].txt" (Indicator: "youtube") "02/28/2017 01:22 PM 116 badoo.com.url" (Indicator: "badoo.com") "02/28/2017 01:22 PM 120 hotfile.com.url" (Indicator: "hotfile.com") "02/28/2017 01:22 PM 122 linkedin.com.url" (Indicator: "linkedin.com") "02/28/2017 01:22 PM 120 netflix.com.url" (Indicator: "netflix.com") "02/28/2017 01:22 PM 118 paypal.com.url" (Indicator: "paypal") "02/28/2017 01:22 PM 120 twitter.com.url" (Indicator: "twitter") "02/01/2017 12:43 AM 23,668 youtube.crx" (Indicator: "youtube")2a:T4da,"rundll32.exe" is creating a new process (Name: "C:\Users\PSPUBWS\AppData\Roaming\Action Center\pro\ieproxy.dll", Handle: 252) "rundll32.exe" is creating a new process (Name: "C:\94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll:Zone.Identifier", Handle: 264) "rundll32.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 280) "rundll32.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 276) "rundll32.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 292) "rundll32.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 300) "rundll32.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 308) "rundll32.exe" is creating a new process (Name: "C:\Users\PSPUBWS\AppData\Roaming\Action Center\pre\PI_001.dat", Handle: 316) "rundll32.exe" is creating a new process (Name: "C:\Windows\System32\cmd.exe", Handle: 364) "cmd.exe" is creating a new process (Name: "C:\Windows\System32\taskkill.exe", Handle: 84) "cmd.exe" is creating a new process (Name: "C:\Windows\System32\systeminfo.exe", Handle: 88) "cmd.exe" is creating a new process (Name: "C:\Windows\System32\tasklist.exe", Handle: 88)2b:T591,Spawned process "cmd.exe" with commandline "/c taskkill /f /im daumcleaner.exe" (UID: 00026333-00003644) Spawned process "taskkill.exe" with commandline "taskkill /f /im daumcleaner.exe" (UID: 00026344-00003372) Spawned process "cmd.exe" with commandline "/c dir "c:\Documents and Settings" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00026369-00003348) Spawned process "cmd.exe" with commandline "/c dir "c:\users" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00026428-00001816) Spawned process "cmd.exe" with commandline "/c dir "%PROGRAMFILES%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00028219-00003008), Spawned process "cmd.exe" with commandline "/c dir "%APPDATA%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00032893-00002052) Spawned process "cmd.exe" with commandline "/c dir "D:\" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00033604-00002220) Spawned process "cmd.exe" with commandline "/c dir "Z:\" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00034117-00000272) Spawned process "cmd.exe" with commandline "/c systeminfo >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00034644-00002056) Spawned process "systeminfo.exe" (UID: 00034656-00001504) Spawned process "cmd.exe" with commandline "/c tasklist >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00036863-00002720) Spawned process "tasklist.exe" (UID: 00036875-00002596)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790742319336,"unified_at":"2026-09-30T04:25:19.336Z","metadata":{"hashes":{"sha256":"94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579","sha1":"539acd9145befd7e670fe826c248766f46f0d041","md5":"33df74cbb60920d63fe677c6f90b63f9","sha512":"89b25317aceaaf79269b0a9dbcd78b57f63bd3d31ff8ed538c7a23b4267af07442fd1feda60cdd3b041eb43121c0ee57261add8ee73b7e1e3f85df9eea728cd6","ssdeep":"6144:4Qa2QI3n/aZz+c54yA2hxuLULElHaCnvTIW:4QaQn/aZzfe2hgUAl6Mv","ssdeep_chunks":["6144:4Qa2QI3","6144:Qa2QI3n","6144:a2QI3n/","6144:2QI3n/a","6144:QI3n/aZ","6144:I3n/aZz","6144:3n/aZz+","6144:n/aZz+c","6144:/aZz+c5","6144:aZz+c54","6144:Zz+c54y","6144:z+c54yA","6144:+c54yA2","6144:c54yA2h","6144:54yA2hx","6144:4yA2hxu","6144:yA2hxuL","6144:A2hxuLU","6144:2hxuLUL","6144:hxuLULE","6144:xuLULEl","6144:uLULElH","6144:LULElHa","6144:ULElHaC","6144:LElHaCn","6144:ElHaCnv","6144:lHaCnvT","6144:HaCnvTI","6144:aCnvTIW","12288:4Qa2QI3","12288:Qa2QI3n","12288:a2QI3n/","12288:2QI3n/a","12288:QI3n/aZ","12288:I3n/aZz","12288:3n/aZz+","12288:n/aZz+c","12288:/aZz+c5","12288:aZz+c54","12288:Zz+c54y","12288:z+c54yA","12288:+c54yA2","12288:c54yA2h","12288:54yA2hx","12288:4yA2hxu","12288:yA2hxuL","12288:A2hxuLU","12288:2hxuLUL","12288:hxuLULE","12288:xuLULEl","12288:uLULElH","12288:LULElHa","12288:ULElHaC","12288:LElHaCn","12288:ElHaCnv","12288:lHaCnvT","12288:HaCnvTI","12288:aCnvTIW","6144:4QaQn/a","6144:QaQn/aZ","6144:aQn/aZz","6144:Qn/aZzf","6144:n/aZzfe","6144:/aZzfe2","6144:aZzfe2h","6144:Zzfe2hg","6144:zfe2hgU","6144:fe2hgUA","6144:e2hgUAl","6144:2hgUAl6","6144:hgUAl6M","6144:gUAl6Mv"],"imphash":"7b51530bc71d796dddfb3192350cb3e9"},"file_info":{"file_name":"file","file_type":["pedll","executable"],"file_type_id":"dll","file_size":225280,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1515555816000,"last_seen":1659954536000,"last_multi_scan":1659954536000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":16,"suspicious_count":17,"malicious_count":8,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Susnokoma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1237311","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.8828","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.8828 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kimsuky.Q trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Scar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Scar.qmdy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDY-OX!33DF74CBB609","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Scar.ewgryr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_MUADNE.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_MUADNE.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Worm.Mantas","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Doina.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 15684-829-10011240\n GetProcessHeap@KERNEL32.dll at 15684-832-10010F60\n GetProcessHeap@KERNEL32.dll at 15684-828-10011500","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUNDLL32.EXE\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUNDLL32.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mail.daum.net\"\n \"member.daum.net\"\n \"logins.daum.net\"\n \"cmail.daum.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"113.29.186.70:443\"\n \"211.231.99.19:443\"\n \"211.231.99.169:443\"\n \"113.29.186.70:80\"\n \"211.231.108.135:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"details too long to display","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1Accept-Language: en-us,en;q=0.5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0Host: mail.daum.netConnection: Keep-Alive\"\n \"GET /login?url=http%3A%2F%2Fmail.daum.net%2F HTTP/1.1Accept-Language: en-us,en;q=0.5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0Host: mail.daum.netConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c taskkill /f /im daumcleaner.exe\" on 2018-1-10.04:49:00.380\n \"/c dir \"c:\\Documents and Settings\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-1-10.04:50:00.060\n \"/c dir \"c:\\users\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-1-10.04:50:00.320\n \"/c dir \"%PROGRAMFILES%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-1-10.05:08:00.170, \"/c dir \"%APPDATA%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-1-10.05:54:00.400\n \"/c dir \"D:\\\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-1-10.06:01:00.450\n \"/c dir \"Z:\\\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-1-10.06:06:00.540\n \"/c systeminfo >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"\" on 2018-1-10.06:11:00.751\n \"/c tasklist >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"\" on 2018-1-10.06:33:00.030","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"cmd.exe\" touched file \"%WINDIR%\\System32\\en-US\\cmd.exe.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"taskkill.exe\" touched file \"%WINDIR%\\System32\\en-US\\taskkill.exe.mui\"\n \"taskkill.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"taskkill.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\systeminfo.exe\"\n \"systeminfo.exe\" touched file \"%WINDIR%\\System32\\en-US\\systeminfo.exe.mui\"\n \"systeminfo.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"systeminfo.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"systeminfo.exe\" touched file \"%WINDIR%\\System32\\mlang.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"iWZi\"","origin":"Network Traffic","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$29","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"taskkill.exe\" opened \"\\Device\\KsecDD\"\n \"systeminfo.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll.bin\" was detected as \"Armadillo v1.xx - v2.xx\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"systeminfo.exe\" at 00034656-00001504-00000105-76030536\n \"tasklist.exe\" at 00036875-00002596-00000105-80288997","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"rundll32.exe\" queried SystemProcessInformation at 00025870-00003484-00000105-56341943","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"\"09/16/2014 08:13 AM 320,400 capinfos.exe\" (Indicator: \"capinfos.exe\")\n \"09/16/2014 08:13 AM 374,672 dumpcap.exe\" (Indicator: \"dumpcap.exe\")\n \"09/16/2014 08:13 AM 332,176 editcap.exe\" (Indicator: \"editcap.exe\")\n \"09/16/2014 08:13 AM 311,184 mergecap.exe\" (Indicator: \"mergecap.exe\")\n \"09/16/2014 08:13 AM 3,233,280 qtshark.exe\" (Indicator: \"tshark.exe\")\n \"09/16/2014 08:13 AM 342,416 rawshark.exe\" (Indicator: \"rawshark.exe\")\n \"09/16/2014 08:13 AM 335,248 text2pcap.exe\" (Indicator: \"text2pcap.exe\")\n \"09/16/2014 08:13 AM 503,696 tshark.exe\" (Indicator: \"tshark.exe\")\n \"09/16/2014 08:13 AM 2,705,808 Wireshark.exe\" (Indicator: \"wireshark.exe\")","origin":"File/Memory","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"02/15/2015 11:50 AM VBoxGuestAdditions\" (Indicator: \"vbox\")\n \"02/15/2015 11:50 AM VBoxGuestAdditions\" (Indicator: \"vboxguest\")\n \"02/15/2015 11:50 AM VBoxGuestAdditions\" (Indicator: \"vboxguestadditions\")\n \"02/15/2015 11:50 AM Oracle VM VirtualBox Guest Additions\" (Indicator: \"virtualbox\")\n \"Directory of %APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Oracle VM VirtualBox Guest Additions\" (Indicator: \"virtualbox\")\n \"05/04/2016 10:23 PM VirtualBox Guest Additions\" (Indicator: \"virtualbox\")\n \"Volume in drive D is VBOXADDITIONS_5.\" (Indicator: \"vbox\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques using MAC address detection","description":"\"03/01/2017 01:19 PM 4,608 RecoveryStore.{91BA4BDF-B50F-11E4-ADE1-0800270E0C5C}.dat\" (Indicator: \"080027\")\n \"02/15/2015 11:13 AM 65,536 UsrClass.dat{bf7ac54f-b53f-11e4-9ab5-0800270e0c5c}.TM.blf\" (Indicator: \"080027\")\n \"02/15/2015 11:13 AM 524,288 UsrClass.dat{bf7ac54f-b53f-11e4-9ab5-0800270e0c5c}.TMContainer00000000000000000001.regtrans-ms\" (Indicator: \"080027\")\n \"02/15/2015 11:13 AM 524,288 UsrClass.dat{bf7ac54f-b53f-11e4-9ab5-0800270e0c5c}.TMContainer00000000000000000002.regtrans-ms\" (Indicator: \"080027\")","origin":"File/Memory","relevance":10,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"systeminfo.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"details too long to display","origin":"File/Memory","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/66 reputation engines marked \"https://logins.daum.net\" as malicious (1% detection rate)\n 1/69 reputation engines marked \"https://logins.daum.net/accounts/srp.do\" as malicious (1% detection rate)\n 1/64 reputation engines marked \"https://logins.daum.net/accounts/loginform.do\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"rundll32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"$2a","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\"taskkill.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"systeminfo.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \"tasklist.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)","origin":"API Call","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"02/15/2015 05:00 AM 1,356 VxAnalysisData (192.168.56.1).lnk\"\n Heuristic match: \"03/01/2017 11:44 AM 1.3.32.7\"\n Heuristic match: \"Directory of %PROGRAMFILES%\\Google\\Update\\1.3.32.7\"\n Heuristic match: \"03/01/2017 11:39 AM 1.3.32.7\"\n Heuristic match: \"Directory of %PROGRAMFILES%\\Google\\Update\\Download\\{430FD4D0-B729-4F61-AA34-91526481799D}\\1.3.32.7\"\n Heuristic match: \"[01]: 192.168.56.13\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions within a single string: .001\n .002\n .3gp\n .7z\n .csv\n .doc\n .dot\n .myd\n .ppt\n .rtf\n .xls\n .acr\n .act\n .adp\n .ads\n .ai\n .al\n .asc\n .asf\n .asm\n .asp\n .aspx\n .avi\n .bak\n .bank\n .bar\n .bat\n .bay\n .big\n .bin\n .bmp\n .cer\n .cfg\n .cgm\n .class\n .cls\n .cmd\n .config\n .contact\n .cpp\n .crt\n .crw\n .cs\n .csh\n .css\n .csv\n .dat\n .db\n .dds\n .der\n .des\n .desc\n .design\n .doc\n .docx\n .dot\n .dotm\n .dotx\n .dtd\n .edb\n .eps\n .fla\n .frm\n .gif\n .hpp\n .html\n .idx\n .jar\n .jpg\n .js\n .key\n .lay\n .layout\n .lit\n .log\n .lua\n .map\n .mapimail\n .max\n .md\n .mid\n .mlb\n .mml\n .mmw\n .mp3\n .msg\n .myd\n .obj\n .odb\n .odc\n .odf\n .pages\n .pak\n .pas\n .pat\n .pdb\n .pdf\n .pfx\n .php\n .pl\n .png\n .pot\n .potx\n .pps\n .ppt\n .prf\n .ps\n .psd\n .rar\n .rb\n .rtf\n .safe\n .sb\n .sch\n .sdf\n .sh\n .sql\n .sqlite\n .std\n .tar\n .tex\n .thm\n .tif\n .txt\n .vb\n .vbs\n .wav\n .wma\n .wmv\n .xla\n .xlam\n .xls\n .xlt\n .xltx\n .xml\n .zip","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"root\\cimv2\" (Indicator: \"root\\cimv2\")\n \"07/14/2009 06:55 PM 798 getbootconfig.pl\" (Indicator: \"bootconfig\")\n \"07/14/2009 06:55 PM 573 GetBootConfig.Vbs\" (Indicator: \"bootconfig\")\n \"02/15/2015 04:54 AM bootconfigurationdata\" (Indicator: \"bootconfig\")\n \"Directory of %PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.0\\Samples\\winbase\\bootconfigurationdata\" (Indicator: \"bootconfig\")\n \"Directory of %PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.0\\Samples\\winbase\\bootconfigurationdata\\bcdsampleapp\" (Indicator: \"bootconfig\")\n \"Directory of %PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.0\\Samples\\winbase\\bootconfigurationdata\\bcdsampleapp\\properties\" (Indicator: \"bootconfig\")\n \"Directory of %PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.0\\Samples\\winbase\\bootconfigurationdata\\bcdsamplelib\" (Indicator: \"bootconfig\")\n \"Directory of %PROGRAMFILES%\\Microsoft SDKs\\Windows\\v7.0\\Samples\\winbase\\bootconfigurationdata\\bcdsamplelib\\properties\" (Indicator: \"bootconfig\")","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetFileAttributesA\n FindNextFileA\n GetTempPathA\n WriteFile\n CopyFileA\n GetModuleFileNameA\n GetModuleHandleA\n CreateThread\n TerminateProcess\n CreateToolhelp32Snapshot\n GetTickCount\n LoadLibraryA\n Process32Next\n GetStartupInfoA\n GetFileSize\n Process32First\n DeleteFileA\n DeleteFileW\n GetProcAddress\n FindNextFileW\n GetTempFileNameA\n FindFirstFileW\n CreateFileW\n CreateFileA\n GetCommandLineA\n FindFirstFileA\n CreateProcessA\n Sleep\n VirtualAlloc\n GetWindowThreadProcessId\n HttpSendRequestA\n InternetQueryDataAvailable\n InternetWriteFile\n InternetCloseHandle\n InternetOpenA\n InternetReadFile\n InternetConnectA\n HttpQueryInfoA\n HttpSendRequestExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"taskkill.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")\n \"systeminfo.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")\n \"tasklist.exe\" wrote bytes \"4053597758585a77186a5a77653c5b770000000000bfb8760000000056ccb876000000007ccab87600000000376873756a2c5b77d62d5b7700000000206973750000000029a6b87600000000a48d737500000000f70eb87600000000\" to virtual address \"0x76911000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"rundll32.exe\" created file \"%APPDATA%\\Action Center\\pro\\ieproxy.dll:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im daumcleaner.exe\" (UID: 00026344-00003372)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/66 Antivirus vendors marked sample as malicious (16% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/66 Antivirus vendors marked sample as malicious (16% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found an indicator for a scheduled task trigger","description":"details too long to display","origin":"File/Memory","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 84)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\taskkill.exe\" (Handle: 84)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\systeminfo.exe\" (Handle: 88)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\systeminfo.exe\" (Handle: 88)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\systeminfo.exe\" (Handle: 88)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\tasklist.exe\" (Handle: 88)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\tasklist.exe\" (Handle: 88)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\tasklist.exe\" (Handle: 88)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"details too long to display","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2b","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}],"incidents":[{"name":"Persistence","details_count":2,"details":[{"detail":"Writes data to a remote process"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}]},"activity":{"stats":{"process_count":14,"spawned_processes_count":14,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":59,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"sandbox_reports":[{"id":"5a5588d17ca3e150033481a7","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Scar","contacted_countries":["KOR"],"submit_name":"94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579","analysis_start_time":"2018-01-10T04:30:48+00:00","indicators_count":{"informative":16,"suspicious":23,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"113.29.186.70","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"address":"211.231.99.19","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"address":"211.231.99.169","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"address":"113.29.186.70","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"address":"211.231.108.135","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}],"dns_resolutions":[{"domain":"member.daum.net","country":"-","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"domain":"mail.daum.net","address":"113.29.186.70","country":"Korea Republic of","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"domain":"logins.daum.net","address":"203.133.167.18","country":"Korea Republic of","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"domain":"cmail.daum.net","address":"211.231.108.135","country":"Korea Republic of","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}],"http_requests":[{"host":"mail.daum.net","host_ip":"113.29.186.70:80","url":"/","method":"GET","response_code":"302","response_phrase":"Found","header":"GET / HTTP/1.1\nAccept-Language: en-us,en;q=0.5\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0\nHost: mail.daum.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"host":"mail.daum.net","host_ip":"113.29.186.70:80","url":"/login?url=http%3A%2F%2Fmail.daum.net%2F","method":"GET","response_code":"302","response_phrase":"Found","header":"GET /login?url=http%3A%2F%2Fmail.daum.net%2F HTTP/1.1\nAccept-Language: en-us,en;q=0.5\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0\nHost: mail.daum.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}],"processes":[{"pid":3284,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00021242-00003284"},{"pid":3484,"ppid":3284,"name":"rundll32.exe","command_line":"\"C:\\94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll\",Run","sha256":"5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00021242-00003284","uid":"00025870-00003484"},{"pid":3644,"ppid":3484,"name":"cmd.exe","command_line":"/c taskkill /f /im daumcleaner.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00026333-00003644"},{"pid":3372,"ppid":3644,"name":"taskkill.exe","command_line":"taskkill /f /im daumcleaner.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00026333-00003644","uid":"00026344-00003372"},{"pid":3348,"ppid":3484,"name":"cmd.exe","command_line":"/c dir \"c:\\Documents and Settings\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00026369-00003348"},{"pid":1816,"ppid":3484,"name":"cmd.exe","command_line":"/c dir \"c:\\users\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00026428-00001816"},{"pid":3008,"ppid":3484,"name":"cmd.exe","command_line":"/c dir \"%PROGRAMFILES%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00028219-00003008"},{"pid":2052,"ppid":3484,"name":"cmd.exe","command_line":"/c dir \"%APPDATA%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00032893-00002052"},{"pid":2220,"ppid":3484,"name":"cmd.exe","command_line":"/c dir \"D:\\\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00033604-00002220"},{"pid":272,"ppid":3484,"name":"cmd.exe","command_line":"/c dir \"Z:\\\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00034117-00000272"},{"pid":2056,"ppid":3484,"name":"cmd.exe","command_line":"/c systeminfo >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00034644-00002056"},{"pid":1504,"ppid":2056,"name":"systeminfo.exe","command_line":"","sha256":"dce2c5ea1da23e63eeff2620141fbc2ca45fc4a64f40af89e722f4b5fafed27c","normalized_path":"%WINDIR%\\System32\\systeminfo.exe","parent_uid":"00034644-00002056","uid":"00034656-00001504"},{"pid":2720,"ppid":3484,"name":"cmd.exe","command_line":"/c tasklist >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00025870-00003484","uid":"00036863-00002720"},{"pid":2596,"ppid":2720,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00036863-00002720","uid":"00036875-00002596"}],"all_imported_dlls":["netprofm.dll","msxml3r.dll","ncrypt.dll","devrtl.dll","shell32.dll","msasn1.dll","cscapi.dll","ntmarta.dll","rsaenh.dll","rpcrt4.dll","ole32.dll","rasapi32.dll","winhttp.dll","wtsapi32.dll","gdi32.dll","usp10.dll","iertutil.dll","WSHTCPIP.DLL","secur32.dll","dbghelp.dll","wbemprox.dll","fastprox.dll","KernelBase.dll","apphelp.dll","ntlanman.dll","browcli.dll","schannel.dll","winrnr.dll","FWPUCLNT.DLL","winbrand.dll","advapi32.dll","ws2_32.dll","wintrust.dll","cryptsp.dll","oleaut32.dll","imm32.dll","94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll","crypt32.dll","IPHLPAPI.DLL","SensApi.dll","srvcli.dll","userenv.dll","Wldap32.dll","wship6.dll","dhcpcsvc.dll","webio.dll","wbemsvc.dll","ntdsapi.dll","lpk.dll","drprov.dll","nsi.dll","rasman.dll","version.dll","credssp.dll","gpapi.dll","setupapi.dll","sspicli.dll","profapi.dll","wininet.dll","bcrypt.dll","wbemcomn.dll","mlang.dll","msvcrt.dll","winsta.dll","netutils.dll","rasadhlp.dll","pnrpnsp.dll","cfgmgr32.dll","rpcss.dll","user32.dll","imagehlp.dll","AcLayers.dll","shlwapi.dll","urlmon.dll","cryptbase.dll","davclnt.dll","nlaapi.dll","kernel32.dll","mpr.dll","comctl32.dll","dnsapi.dll","NapiNSP.dll","npmproxy.dll","dhcpcsvc6.dll","bcryptprimitives.dll","msctf.dll","davhlpr.dll","mswsock.dll","RpcRtRemote.dll","framedynos.dll","netapi32.dll","wmiutils.dll","ntdll.dll","sechost.dll","dwmapi.dll","rtutils.dll","clbcatq.dll","cryptnet.dll","devobj.dll","uxtheme.dll","msxml3.dll","cabinet.dll","wkscli.dll","winnsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PI_000.dat","sha256":"a753d716a8f0e73900621b9de43f1d865ab4f1bd0d920e585ea1efeab357edec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"PI_001.dat","sha256":"aa1a77940706cb45faa853831fa1746192a0cd89a6dc4d1b4a4af97d2305f9eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Tar97C2.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"TarBFAA.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"1060B7ADDE0FF6DE85637BF89FC4CEBC_2F0A0FD6E5FFBDCBA1672A965E30E8EA","sha256":"211325452170bcd8e19b3074bbc77c5df58e0204cbbae5180b22210bff892894","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Tar45A3.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"CabBFA9.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"B06FC0C94A5D113109C15E5A5EE1C21E","sha256":"09e88b791294036272826581c72214fd36c0827227abc00373e97458c77d01f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"~DA943A.tmp","sha256":"8c9df3de884c0498d3e944cf1d99c4f34f9df2e747a0be76d5a477877a29de50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"mg_6334","sha256":"c3f2e8bb3464f0af8f2feb6144a1866c3abd941ca19f711a6928581b30d3a31c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"PI_003.dat","sha256":"e64c755dd182163be0bfe2d680932ae60db36431c4ac72febbaa601f495fb755","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"EDC238BFF48A31D55A97E1E93892934B_C31B2498754E340573F1336DE607D619","sha256":"80dad540f4e3f8d505583578563c8b3343dbc7400cf738c09ca6987faebc78a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"378B079587A9184B2E2AB859CB263F40_2B618FC6CF84AEF3C14E129161BF18D9","sha256":"c5ec0b3796027b5003f0c6466ced5b107f7985dfcddf2a8148d37915ee323056","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE","sha256":"f33e9b853287ef0fa763f38e0bc137e80ed26f93a235ac0217f2e818309d38f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873","sha256":"f461e747bf2efadbdf023f6f030d8154df14daf76660e2fed603411a3f82a5cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"C9E3282A673263848AB7F0C007FD3AF1_B9498D7CA640C12729362A0450F81EFD","sha256":"a3d093b59e379ab080ec26bd27715d55d2a11bee04e949ab00d9e8dd776e890f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"Cab97C1.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\pre","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\fin","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\pro","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"C:\\94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\pro\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"C:\\94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579.dll:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\pro\\ieproxy.dll:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"C:\\Users\\All Users","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"C:\\Users\\Default User","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"C:\\Users\\fKHVGY9","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Templates","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\java.exe","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\javaw.exe","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Cookies","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Local Settings","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\My Documents","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\NetHood","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\PrintHood","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Recent","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\SendTo","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Templates","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%LOCALAPPDATA%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%LOCALAPPDATA%\\History","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%TEMP%\\rary Internet Files","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Documents\\My Music","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Documents\\My Pictures","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%USERPROFILE%\\Documents\\My Videos","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%PUBLIC%\\Documents\\My Music","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%PUBLIC%\\Documents\\My Pictures","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%PUBLIC%\\Documents\\My Videos","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\pre\\PI_000.dat","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\mpr.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\systeminfo.exe","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\systeminfo.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\mlang.dll","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%APPDATA%\\Action Center\\pre\\PI_001.dat","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\A474D52D-8C44-C67D-BBFB-D513232F8A17","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!fkhvgy9!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!fkhvgy9!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!fkhvgy9!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!fkhvgy9!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"A474D52D-8C44-C67D-BBFB-D513232F8A17","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5a5588d17ca3e150033481a7"}]}]}},"report_ids":{"sandbox_job_ids":["5a5588d17ca3e150033481a7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Doina.Generic Sample 94aa827a514d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 94aa827a514d…. Malware family: Doina.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"}],["$","meta","4",{"property":"og:title","content":"Malicious Doina.Generic Sample 94aa827a514d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 94aa827a514d…. Malware family: Doina.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/94aa827a514d7aa70c404ec326edaaad4b2b738ffaea5a66c0c9f246738df579"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Doina.Generic Sample 94aa827a514d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 94aa827a514d…. Malware family: Doina.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]