23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T489,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 94c18df50d4e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 94c18df50d4e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb"],"about":{"@type":"SoftwareApplication","name":"malware1.exe","applicationCategory":["peexe","executable"],"identifier":"94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":29},"behavioralIndicators":{"malicious":10,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T472,"" loaded module "KERNEL32.DLL" at base 76E10000 "" loaded module "NORMALIZ.DLL" at base 76FD0000 "" loaded module "CRYPT32.DLL" at base 75E50000 "" loaded module "USERENV.DLL" at base 75320000 "" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77CB0000 "" loaded module "WINTRUST.DLL" at base 75E20000 "" loaded module "WININET.DLL" at base 76090000 "" loaded module "RASAPI32.DLL" at base 736D0000 "" loaded module "RTUTILS.DLL" at base 74290000 "" loaded module "RASMAN.DLL" at base 736B0000 "" loaded module "PROFAPI.DLL" at base 75CC0000 "" loaded module "SHLWAPI.DLL" at base 775C0000 "" loaded module "SENSAPI.DLL" at base 70CE0000 "" loaded module "RPCRT4.DLL" at base 77440000 "" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 74190000 "" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 77CB0000 "" loaded module "IPHLPAPI.DLL" at base 7529000025:T901,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS")26:T11c5,"" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\SMARTCARDROOT\CTLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")27:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790346570640,"unified_at":"2026-09-25T14:29:30.640Z","metadata":{"hashes":{"sha256":"94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb","sha1":"0ba9053328f21cb250ca5000c3033dc8ee5f7953","md5":"8503d0f6bfa7f6b14a2525f4fa41ddfc","sha512":"e2bf21e151855f1312e65c29e7e0c2ae6c13f26f1a8fd9bbbf8ff69baa039da9a1c5021e4217a91aedeb78e6a81db076efb4ce3481882340dabe6f073f2df823","ssdeep":"3072:jxssbKv4Akrgfa0swc+xHFRsCX3c2xeR/kx/fdqwWp1C1+wSBPM:jxTKQVg6CbsQcYetid4g4","ssdeep_chunks":["3072:jxssbKv","3072:xssbKv4","3072:ssbKv4A","3072:sbKv4Ak","3072:bKv4Akr","3072:Kv4Akrg","3072:v4Akrgf","3072:4Akrgfa","3072:Akrgfa0","3072:krgfa0s","3072:rgfa0sw","3072:gfa0swc","3072:fa0swc+","3072:a0swc+x","3072:0swc+xH","3072:swc+xHF","3072:wc+xHFR","3072:c+xHFRs","3072:+xHFRsC","3072:xHFRsCX","3072:HFRsCX3","3072:FRsCX3c","3072:RsCX3c2","3072:sCX3c2x","3072:CX3c2xe","3072:X3c2xeR","3072:3c2xeR/","3072:c2xeR/k","3072:2xeR/kx","3072:xeR/kx/","3072:eR/kx/f","3072:R/kx/fd","3072:/kx/fdq","3072:kx/fdqw","3072:x/fdqwW","3072:/fdqwWp","3072:fdqwWp1","3072:dqwWp1C","3072:qwWp1C1","3072:wWp1C1+","3072:Wp1C1+w","3072:p1C1+wS","3072:1C1+wSB","3072:C1+wSBP","3072:1+wSBPM","6144:jxssbKv","6144:xssbKv4","6144:ssbKv4A","6144:sbKv4Ak","6144:bKv4Akr","6144:Kv4Akrg","6144:v4Akrgf","6144:4Akrgfa","6144:Akrgfa0","6144:krgfa0s","6144:rgfa0sw","6144:gfa0swc","6144:fa0swc+","6144:a0swc+x","6144:0swc+xH","6144:swc+xHF","6144:wc+xHFR","6144:c+xHFRs","6144:+xHFRsC","6144:xHFRsCX","6144:HFRsCX3","6144:FRsCX3c","6144:RsCX3c2","6144:sCX3c2x","6144:CX3c2xe","6144:X3c2xeR","6144:3c2xeR/","6144:c2xeR/k","6144:2xeR/kx","6144:xeR/kx/","6144:eR/kx/f","6144:R/kx/fd","6144:/kx/fdq","6144:kx/fdqw","6144:x/fdqwW","6144:/fdqwWp","6144:fdqwWp1","6144:dqwWp1C","6144:qwWp1C1","6144:wWp1C1+","6144:Wp1C1+w","6144:p1C1+wS","6144:1C1+wSB","6144:C1+wSBP","6144:1+wSBPM","3072:jxTKQVg","3072:xTKQVg6","3072:TKQVg6C","3072:KQVg6Cb","3072:QVg6Cbs","3072:Vg6CbsQ","3072:g6CbsQc","3072:6CbsQcY","3072:CbsQcYe","3072:bsQcYet","3072:sQcYeti","3072:QcYetid","3072:cYetid4","3072:Yetid4g","3072:etid4g4"],"imphash":"2d70c849209ba5575ab8638f5c4cbb1c"},"file_info":{"file_name":"malware1.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":153600,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294939000,"last_seen":1665404773000,"last_multi_scan":1665404773000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":19,"malicious_count":10,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.juyc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3170276","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dridex.CCTA-5450","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.3170276 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.AA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Banker.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.bscs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.ys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.ebttts","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-ARGH","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Yakes.153600.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.EY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.EY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt_s.LBI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanPSW.Papras","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Yakes.Win32.49618","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"193.90.12.221:8043\"\n \"200.159.128.144:2443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\CabEAE3.tmp\"\n \"\" created file \"%TEMP%\\TarEB03.tmp\"\n \"\" created file \"%TEMP%\\CabEEEC.tmp\"\n \"\" created file \"%TEMP%\\TarEEED.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"{eb48a255-aa2d-57ed-7a27-1a73208c141e}\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$24","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"AddMandatoryAce@ADVAPI32.dll\"\n \"wvnsprintfA@SHLWAPI.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"\n \"CPImportKey@rsaenh.dll\"\n \"CPEncrypt@rsaenh.dll\"\n \"CPDecrypt@rsaenh.dll\"\n \"CPCreateHash@rsaenh.dll\"\n \"CPHashData@rsaenh.dll\"\n \"CPHashSessionKey@rsaenh.dll\"\n \"CPDestroyHash@rsaenh.dll\"\n \"CPSignHash@rsaenh.dll\"\n \"CPVerifySignature@rsaenh.dll\"\n \"CPGenRandom@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00125015-00003604-77BD228D-139752","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"CabEAE3.tmp\" has type \"Microsoft Cabinet archive data 50006 bytes 1 file\"\n \"TarEB03.tmp\" has type \"data\"\n \"CabEEEC.tmp\" has type \"Microsoft Cabinet archive data 50006 bytes 1 file\"\n \"TarEEED.tmp\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"[3\n ~ qYHA!\n CONST\n u]tOYU\n 0n*S\n !fQ/uVw\n .crt\n OydTO\n Ktq6\n .rdata with unusual entropies 7.74735145577\n 7.78420852475\n 7.91470727468\n 7.76718509997\n 7.76131083645\n 7.83820854078\n 7.76332764919\n 7.96219441078\n 7.9721879012\n 7.57587843941","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00125015-00003604-77BD228D-138473","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00125015-00003604-77BD228D-131594\n RasPortListen@RASMAN.DLL at 00125015-00003604-77BD228D-138112","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\malware1.exe\" marked \"%TEMP%\\CabEAE3.tmp\" for deletion\n \"Z:\\malware1.exe\" marked \"%TEMP%\\TarEB03.tmp\" for deletion\n \"Z:\\malware1.exe\" marked \"%TEMP%\\CabEEEC.tmp\" for deletion\n \"Z:\\malware1.exe\" marked \"%TEMP%\\TarEEED.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%TEMP%\\CabEAE3.tmp\" with delete access\n \"\" opened \"%TEMP%\\TarEB03.tmp\" with delete access\n \"\" opened \"%TEMP%\\CabEEEC.tmp\" with delete access\n \"\" opened \"%TEMP%\\TarEEED.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$25","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"malware1.exe.bin\" claimed CRC 210010 while the actual is CRC 213611","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetDriveTypeA\n GetFileAttributesExA\n GetModuleFileNameW\n LoadLibraryW\n WriteProcessMemory","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"malware1.exe.bin\" claims program is from Thu Jan 1 02:16:34 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/55 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 193.90.12.221 on port 8043\n TCP traffic to 200.159.128.144 on port 2443","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\"; Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$26","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00125015-00003604-77BD228D-192768","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"malware1.exe.bin\" has an entrypoint in section \".text0\"","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Reads System Certificates Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\109F1CAED645BB78B3EA2B94C0697C740733031C\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\D559A586669B08F46A30A133F8A9ED3D038E2EA8\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\FEE449EE0E3965A5246F000E87FDE2A065FD89D4\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\A377D1B1C0538833035211F4083D00FECC414DAB\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\637162CC59A3A1E25956FA5FA8F60D2E1C52EAC6\"; Key: \"BLOB\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\7D7F4414CCEF168ADF6BF40753B5BECD78375931\"; Key: \"BLOB\")","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{91e41913-45b5-94e0-f68c-cfd5ab8ca5b9}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\ahi34A9.tmp ko3DyUCGGjM6G2XLe0E5\"\" on 2016-4-21.05:11:49.312","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{91e41913-45b5-94e0-f68c-cfd5ab8ca5b9}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\ahi34A9.tmp ko3DyUCGGjM6G2XLe0E5\"\" (UID: 00017648-00003732)\n Spawned process \"taskhost.exe\" (UID: 00017657-00001512)\n Spawned process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{91e41913-45b5-94e0-f68c-cfd5ab8ca5b9}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\ahi34A9.tmp ko3DyUCGGjM6G2XLe0E5\"\" (UID: 00017660-00003660)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00010643-00001384-35616-134-00693CB0\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00010643-00001384-42120-134-00693CB0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00017504-00001576)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Shedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{91e41913-45b5-94e0-f68c-cfd5ab8ca5b9}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\ahi34A9.tmp ko3DyUCGGjM6G2XLe0E5\"\" (UID: 00017660-00003660)","origin":"Monitored Target","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00010643-00001384)\n Spawned process \"explorer.exe\" with commandline \"%WINDIR%\\Explorer.EXE\" (UID: 00017504-00001576)\n Spawned process \"cmd.exe\" with commandline \"/c schtasks.exe /Create /F /TN \"User_Feed_Synchronization-{91e41913-45b5-94e0-f68c-cfd5ab8ca5b9}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\ahi34A9.tmp ko3DyUCGGjM6G2XLe0E5\"\" (UID: 00017648-00003732)\n Spawned process \"taskhost.exe\" (UID: 00017657-00001512)\n Spawned process \"schtasks.exe\" with commandline \"/Create /F /TN \"User_Feed_Synchronization-{91e41913-45b5-94e0-f68c-cfd5ab8ca5b9}\" /SC minute /MO 10 /TR \"rundll32.exe %LOCALAPPDATA%\\ow\\ahi34A9.tmp ko3DyUCGGjM6G2XLe0E5\"\" (UID: 00017660-00003660)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Contains ability to listen for incoming connections"},{"detail":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":28,"imported_dlls_count":112,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5718c23aaac2ed31506c88b3","environment_id":4,"environment_description":"Windows 7 32 bit - Kernelmode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM19.1.0000.Malware","contacted_countries":["BRA","NOR"],"submit_name":"malware1.exe","analysis_start_time":"2016-04-21T07:06:31+00:00","indicators_count":{"informative":9,"suspicious":28,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"5718c23aaac2ed31506c88b1","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":96,"malware_family":"QVM19.1.0000.Malware","contacted_countries":["BRA","NOR"],"submit_name":"malware1.exe","analysis_start_time":"2016-04-21T07:06:49+00:00","indicators_count":{"informative":7,"suspicious":25,"malicious":7},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"193.90.12.221","port":8043,"protocol":"TCP","country":"Norway","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"address":"200.159.128.144","port":2443,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}],"processes":[{"pid":1384,"ppid":0,"name":"malware1.exe","command_line":"","normalized_path":"C:\\malware1.exe","uid":"00010643-00001384","icon":"$27"},{"pid":1576,"ppid":1384,"name":"explorer.exe","command_line":"%WINDIR%\\Explorer.EXE","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00010643-00001384","uid":"00017504-00001576"}],"all_imported_dlls":["schannel.DLL","GPAPI.dll","wshqos.dll","wshtcpip.DLL","secur32.dll","IMM32.DLL","RPCRT4.dll","MSASN1.dll","ncrypt.dll","dhcpcsvc6.DLL","urlmon.dll","ole32.dll","CRYPTSP.dll","CRYPTBASE.dll","comctl32.dll","cryptnet.dll","CFGMGR32.dll","SHLWAPI.dll","ws2_32.DLL","fwpuclnt.dll","KERNELBASE.dll","SspiCli.dll","LPK.dll","napinsp.dll","NSI.dll","kernel32.dll","Normaliz.dll","rtutils.dll","sensapi.dll","wship6.dll","USER32.dll","sechost.dll","VERSION.dll","profapi.dll","MSCTF.dll","mswsock.dll","pnrpnsp.dll","iertutil.dll","DEVOBJ.dll","OLEAUT32.dll","rsaenh.dll","USERENV.dll","iphlpapi.DLL","rasadhlp.dll","ntdll.dll","msvcrt.dll","ntmarta.dll","WINHTTP.dll","CRYPT32.dll","SETUPAPI.dll","bcryptprimitives.dll","pdh.dll","wintrust.dll","NLAapi.dll","dnsapi.DLL","winrnr.dll","credssp.dll","ADVAPI32.dll","WININET.dll","rasman.dll","DEVRTL.dll","SHELL32.dll","Cabinet.dll","USP10.dll","PSAPI.DLL","GDI32.dll","dhcpcsvc.DLL","RASAPI32.dll","usp10.dll","msctf.dll","user32.dll","Wldap32.dll","nsi.dll","cryptsp.dll","winhttp.dll","ws2_32.dll","dnsapi.dll","schannel.dll","setupapi.dll","gdi32.dll","bcrypt.dll","cfgmgr32.dll","rpcrt4.dll","cryptbase.dll","IPHLPAPI.DLL","winnsi.dll","userenv.dll","imm32.dll","dhcpcsvc.dll","wininet.dll","gpapi.dll","rasapi32.dll","devobj.dll","KernelBase.dll","advapi32.dll","lpk.dll","crypt32.dll","NapiNSP.dll","oleaut32.dll","normaliz.dll","cabinet.dll","shlwapi.dll","webio.dll","sspicli.dll","WSHTCPIP.DLL","devrtl.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","shell32.dll","msasn1.dll","nlaapi.dll","SensApi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"CabEAE3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"CabEEEC.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"TarEB03.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"TarEEED.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sha256":"9afe338ce59fc820e7212b5664fe9edb7d3ffff2c47e0cd0185793a988967dc4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"94308059B57B3142E455B38A6EB92015","sha256":"25ced06c056a03c6918f68da5ac9cd3bdbfeca68ed5bf74730b2efee63f43b3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Cab7541.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Cab77D3.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Cab9B7A.tmp","sha256":"0c14c3c231978d326fd3cda052987290867e67eb5b7eaebc52bf2696ea11f65a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Tar7551.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Tar77D4.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"Tar9B7B.tmp","sha256":"d3f9f7ca9baf937199375fd8a7caa6904aeb25e7ae21b598c1c8bb1de57dceb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"},{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"{eb48a255-aa2d-57ed-7a27-1a73208c141e}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b1"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{1e686239-299f-180e-e2dd-30d0d3f065dd}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{1b660d5f-263c-fe1e-a681-2f6f458b5bb5}","sources":[{"report_type":"sandbox","report_id":"5718c23aaac2ed31506c88b3"}]}]}},"report_ids":{"sandbox_job_ids":["5718c23aaac2ed31506c88b3","5718c23aaac2ed31506c88b1"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 94c18df50d4e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 94c18df50d4e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 94c18df50d4e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 94c18df50d4e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/94c18df50d4e4fa7607e3d04a5627d68befa095fe30e0e8481262aea9cd486bb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 94c18df50d4e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 94c18df50d4e…. Malware family: Trojan.Generic. Threat score 100/100. 23/29 AV engines flagged this file. 10 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]