24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T473,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Scar Sample 98ccf3a463b8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 98ccf3a463b8…. Malware family: Trojan.Scar. Threat score 100/100. 17/27 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a","keywords":["Malicious","Trojan.Scar","malware analysis","sandbox report","threat intelligence","98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["pedll","executable"],"identifier":"98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Scar","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4be,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "A474D52D-8C44-C67D-BBFB-D513232F8A17" "\Sessions\1\BaseNamedObjects\A474D52D-8C44-C67D-BBFB-D513232F8A17" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!7ecz31c!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!7ecz31c!appdata!roaming!microsoft!windows!cookies!" "\Sessions\1\BaseNamedObjects\Local\c:!users!7ecz31c!appdata!local!microsoft!windows!history!history.ie5!" "\Sessions\1\BaseNamedObjects\Local\WininetStartupMutex" "\Sessions\1\BaseNamedObjects\Local\WininetConnectionMutex" "\Sessions\1\BaseNamedObjects\Local\WininetProxyRegistryMutex" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\!IETld!Mutex" "\Sessions\1\BaseNamedObjects\Local\c:!users!7ecz31c!appdata!roaming!microsoft!windows!ietldcache!" "\Sessions\1\BaseNamedObjects\DBWinMutex"26:T5a6,Spawned process "rundll32.exe" with commandline ""C:\98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll",Run" (UID: 00013320-00003452) Spawned process "cmd.exe" with commandline "/c taskkill /f /im daumcleaner.exe" (UID: 00013467-00003516) Spawned process "taskkill.exe" with commandline "taskkill /f /im daumcleaner.exe" (UID: 00013471-00003868) Spawned process "cmd.exe" with commandline "/c dir "c:\Documents and Settings" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00013476-00003340) Spawned process "cmd.exe" with commandline "/c dir "c:\users" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00013480-00003264) Spawned process "cmd.exe" with commandline "/c dir "%PROGRAMFILES%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00014086-00002504), Spawned process "cmd.exe" with commandline "/c dir "%APPDATA%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00016115-00003092) Spawned process "cmd.exe" with commandline "/c dir "D:\" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00016737-00002864) Spawned process "cmd.exe" with commandline "/c systeminfo >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00017368-00002500) Spawned process "systeminfo.exe" (UID: 00017373-00003064) Spawned process "cmd.exe" with commandline "/c tasklist >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00018050-00002112) Spawned process "tasklist.exe" (UID: 00018054-00003072)27:T5e29,Pattern match: "www.braveprince.com" Pattern match: "http://mail.daum.net" Pattern match: "https://logins.daum.net/accounts/srp.do?slevel=0&rid=%s&srplm1=%s" Pattern match: "https://logins.daum.net/accounts/presrp.do?id=%s&srpla=%s&_=%s" Pattern match: "https://logins.daum.net/accounts/loginform.do?url=http%3A%2F%2Fmail.daum.net%2F" Pattern match: "https://mail.daum.net/login?url=http%3A%2F%2Fmail.daum.net%2F" Pattern match: "https://cmail.daum.net/v2/mails/send" Pattern match: "https://cmail.daum.net/v2/upload/attach/uploadInfo" Pattern match: "https://cmail.daum.net/v2/upload/attach/uploadUrl" Pattern match: "https://cmail.daum.net/v2/addressbook/mostcontacted" Pattern match: "https://cmail.daum.net/v2/addressbook" Pattern match: "http://mail.daum.net/kocl/MailCompose.html" Pattern match: "https://cmail.daum.net/v2/addressbook/favorite" Pattern match: "https://cmail.daum.net/v2/mails/autoSave" Pattern match: "https://cmail.daum.net/v2/mails?offset=0&limit=15&folderId=INBOX&labelIds=" Pattern match: "https://cmail.daum.net/v2/setting/logintime" Pattern match: "https://cmail.daum.net/v2/folders?resultType=list" Pattern match: "http://mail.daum.net/kocl/Top.html" Pattern match: "https://cmail.daum.net/v2/folders/usages" Pattern match: "https://cmail.daum.net/v2/setting/basic" Pattern match: "https://mail.daum.net" Pattern match: "https://cmail.daum.net/v2/mails/modify" Pattern match: "https://cmail.daum.net/v2/mails/%s/attachments/%s/download/%s" Pattern match: "https://cmail.daum.net/v2/mails/%s?headerFields=Date" Pattern match: "https://logins.daum.net/accounts/logout.do?url=http%3A%2F%2Fwww.daum.net%2F%3Fnil_profile%3Dlogout" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Pattern match: "http://www.usertrust.com1" Pattern match: "crl.usertrust.com/UTN-USERFirst-Object.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://crl.thawte.com/ThawtePCA.crl0" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://th.symcb.com/th.crl0" Pattern match: "https://www.thawte.com/cps0/" Pattern match: "https://www.thawte.com/repository0W" Pattern match: "http://th.symcd.com0&" Pattern match: "http://th.symcb.com/th.crt0" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sv.symcb.com/sv.crl0W" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Heuristic match: "mail.daum.net" Heuristic match: "*.daum.net" Pattern match: "https://www.thawte.com/repository0" Pattern match: "http://tj.symcb.com/tj.crl0" Pattern match: "http://tj.symcd.com0&" Pattern match: "http://tj.symcb.com/tj.crt0" Pattern match: "http://t1.symcb.com/ThawtePCA.crl0/" Pattern match: "http://t2.symcb.com0A" Pattern match: "https://www.thawte.com/cps0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQwF4prw9S7mCbCEHD%2Fyl6nWPkczAQUe1tFz6%2FOy3r9MZIaarbzRutXSFACEBaH1oht4jAGhSM9vxG%2FZZc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: t2.symcb.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRvdluGAc%2FlYx1bXFBnllP1ugYHmAQUwk9IV%2FzRT5rAXTh9DgXb2S61UmACEBGXgb1MLNuKtZeWEgz4A1M%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: tj.symcd.com" Heuristic match: "logins.daum.net" Pattern match: "http://sr.symcb.com/sr.crl0" Pattern match: "http://sr.symcd.com0&" Pattern match: "http://sr.symcb.com/sr.crt0" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "https://www.verisign.com/cps0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://ocsp.verisign.com0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRIt2RJ89X%2B%2BhEzqoBeQg8PymQ2UQQUANhaTCXBIuWLMe9tuvPMXynxDWECECUM6OAwYS6fK4n3BU18%2BP0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.verisign.com" Pattern match: "https://d.symcb.com/rpa0#" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBS56bKHAoUD%2BOyl%2B0LhPg9JxyQm4gQUf9Nlp8Ld7LvwMAnzQzn6Aq8zMTMCEH7hSm9v7%2FLTfz%2BtZU062rQ%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: s2.symcb.com" Pattern match: "http://www.symauth.com/rpa0" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBR0JBRnBp%2F14Jg%2FXj4aa6BlKlQVdQQUAVmr5906C1mmZGPWzyAHV9WR52oCEELSNQn0wIadW9%2FAms7ArTE%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: sr.symcd.com" Pattern match: "http://www.symauth.com/cps0*" Heuristic match: "cmail.daum.net" Pattern match: "www.4shared[1].xml" Pattern match: "www.999[1].xml" Pattern match: "www.americanas.com[1].xml" Pattern match: "www.att[1].xml" Pattern match: "www.blogcu[1].xml" Pattern match: "www.brothersoft[1].xml" Pattern match: "www.chip[1].xml" Pattern match: "www.corriere[1].xml" Pattern match: "www.daily.co[1].xml" Pattern match: "www.ebay[1].xml" Pattern match: "www.freeonlinegames[1].xml" Pattern match: "www.gazeta[1].xml" Pattern match: "www.girlsgogames[1].xml" Pattern match: "www.hao123[1].xml" Pattern match: "www.hm[1].xml" Pattern match: "www.hurriyet.com[1].xml" Pattern match: "www.ibm[1].xml" Pattern match: "www.ikea[1].xml" Pattern match: "www.imvu[1].xml" Pattern match: "www.intel[1].xml" Pattern match: "www.intuit[1].xml" Pattern match: "www.irs[1].xml" Pattern match: "www.lowes[1].xml" Pattern match: "www.marca[1].xml" Pattern match: "www.mediafire[1].xml" Pattern match: "www.onlinedown[1].xml" Pattern match: "www.paypal[1].xml" Pattern match: "www.realtor[1].xml" Pattern match: "www.sky[1].xml" Pattern match: "www.sohu[1].xml" Pattern match: "www.songspk[1].xml" Pattern match: "www.sony[1].xml" Pattern match: "www.state[1].xml" Pattern match: "www.symantec[1].xml" Pattern match: "www.technologycraze[1].xml" Pattern match: "www.theguardian[1].xml" Pattern match: "www.tiexue[1].xml" Pattern match: "www.tmall[1].xml" Pattern match: "www.u43.pnc[1].xml" Pattern match: "www.ucoz[1].xml" Pattern match: "www.youku[1].xml" Pattern match: "www.360doc[1].xml" Pattern match: "www.abril.com[1].xml" Pattern match: "www.adp[1].xml" Pattern match: "www.aeriagames[1].xml" Pattern match: "www.amazon[1].xml" Pattern match: "www.apple[1].xml" Pattern match: "www.buenastareas[1].xml" Pattern match: "www.caixa.gov[1].xml" Pattern match: "www.cncn[1].xml" Pattern match: "www.craigslist[1].xml" Pattern match: "www.dailymail.co[1].xml" Pattern match: "www.doctissimo[1].xml" Pattern match: "www.eonline[1].xml" Pattern match: "www.evite[1].xml" Pattern match: "www.ifeng[1].xml" Pattern match: "www.kayak[1].xml" Pattern match: "www.leboncoin[1].xml" Pattern match: "www.lenovo[1].xml" Pattern match: "www.le[1].xml" Pattern match: "www.mapion.co[1].xml" Pattern match: "www.marriott[1].xml" Pattern match: "www.microsoftstore[1].xml" Pattern match: "www.nokia[1].xml" Pattern match: "www.oracle[1].xml" Pattern match: "www.overstock[1].xml" Pattern match: "www.pnc[1].xml" Pattern match: "www.qqtn[1].xml" Pattern match: "www.qq[1].xml" Pattern match: "www.qunar[1].xml" Pattern match: "www.slideshare[1].xml" Pattern match: "www.tenpay[1].xml" Pattern match: "www.today[1].xml" Pattern match: "www.toshiba[1].xml" Pattern match: "www.tvguide[1].xml" Pattern match: "www.washingtonpost[1].xml" Pattern match: "www.xdating[1].xml" Pattern match: "www.y8[1].xml" Pattern match: "www.youtube[1].xml" Pattern match: "www1.euro.dell[1].xml" Pattern match: "www.2345[1].xml" Pattern match: "www.amazon.co[1].xml" Pattern match: "www.baixaki.com[1].xml" Pattern match: "www.barclays.co[1].xml" Pattern match: "www.biglobe.ne[1].xml" Pattern match: "www.blinkx[1].xml" Pattern match: "www.break[1].xml" Pattern match: "www.cox[1].xml" Pattern match: "www.ctrip[1].xml" Pattern match: "www.delta[1].xml" Pattern match: "www.ebay.com[1].xml" Pattern match: "www.gnavi.co[1].xml" Pattern match: "www.ledu[1].xml" Pattern match: "www.liutilities[1].xml" Pattern match: "www.lloydsbank[1].xml" Pattern match: "www.made-in-china[1].xml" Pattern match: "www.minijuegos[1].xml" Pattern match: "www.monster[1].xml" Pattern match: "www.msn[1].xml" Pattern match: "www.nickjr[1].xml" Pattern match: "www.noaa[1].xml" Pattern match: "www.otomoto[1].xml" Pattern match: "www.pagesjaunes[1].xml" Pattern match: "www.pps[1].xml" Pattern match: "www.rakuten.co[1].xml" Pattern match: "www.repubblica[1].xml" Pattern match: "www.rightmove.co[1].xml" Pattern match: "www.sdo[1].xml" Pattern match: "www.searchina[1].xml" Pattern match: "www.shoplocal[1].xml" Pattern match: "www.skycn[1].xml" Pattern match: "www.suning[1].xml" Pattern match: "www.telegraph.co[1].xml" Pattern match: "www.usaa[1].xml" Pattern match: "www.viewster[1].xml" Pattern match: "www.wikia[1].xml" Pattern match: "www.zoosk[1].xml" Pattern match: "www.3suisses[1].xml" Pattern match: "www.61[1].xml" Pattern match: "www.91[1].xml" Pattern match: "www.allocine[1].xml" Pattern match: "www.aol[1].xml" Pattern match: "www.bankofamerica[1].xml" Pattern match: "www.bloomberg[1].xml" Pattern match: "www.chase[1].xml" Pattern match: "www.citi[1].xml" Pattern match: "www.constantcontact[1].xml" Pattern match: "www.da-ads[1].xml" Pattern match: "www.duote[1].xml" Pattern match: "www.etsy[1].xml" Pattern match: "www.euroresidentes[1].xml" Pattern match: "www.goo.ne[1].xml" Pattern match: "www.ig.com[1].xml" Pattern match: "www.jetblue[1].xml" Pattern match: "www.kuwan8[1].xml" Pattern match: "www.last[1].xml" Pattern match: "www.legacy[1].xml" Pattern match: "www.livedoor[1].xml" Pattern match: "www.microsoft[1].xml" Pattern match: "www.mobile[1].xml" Pattern match: "www.mozilla[1].xml" Pattern match: "www.mtime[1].xml" Pattern match: "www.myplaycity[1].xml" Pattern match: "www.pchome[1].xml" Pattern match: "www.real[1].xml" Pattern match: "www.robtex[1].xml" Pattern match: "www.seznam[1].xml" Pattern match: "www.shutterfly[1].xml" Pattern match: "www.sogou[1].xml" Pattern match: "www.t-online[1].xml" Pattern match: "www.thefreedictionary[1].xml" Pattern match: "www.theweathernetwork[1].xml" Pattern match: "www.travelocity[1].xml" Pattern match: "www.united[1].xml" Pattern match: "www.univision[1].xml" Pattern match: "www.uol.com[1].xml" Pattern match: "www.verizonwireless[1].xml" Pattern match: "www.wellsfargo[1].xml" Pattern match: "www.wheretowatch[1].xml" Pattern match: "www.yhd[1].xml" Pattern match: "www.zhenai[1].xml" Pattern match: "www3.hilton[1].xml" Heuristic match: "02/28/2017 01:09 PM 0 ssp[1].ad" Pattern match: "www.636[1].txt" Pattern match: "www.91[1].txt" Pattern match: "www.addthis[1].txt" Pattern match: "www.adnetworkperformance[1].txt" Pattern match: "www.adp[2].txt" Pattern match: "www.aeriagames[1].txt" Pattern match: "www.alexa[2].txt" Pattern match: "www.americanas.com[1].txt" Pattern match: "www.aol[1].txt" Pattern match: "www.aol[3].txt" Pattern match: "www.att[2].txt" Pattern match: "www.baixaki.com[1].txt" Pattern match: "www.barbie[1].txt" Pattern match: "www.biglobe.ne[2].txt" Pattern match: "www.bing[2].txt" Pattern match: "www.bloomberg[2].txt" Pattern match: "www.booking[2].txt" Pattern match: "www.break[2].txt" Pattern match: "www.caixa.gov[1].txt" Pattern match: "www.cbs[1].txt" Pattern match: "www.chase[1].txt" Pattern match: "www.citi[2].txt" Pattern match: "www.cncn[1].txt" Pattern match: "www.corriere[2].txt" Pattern match: "www.daily.co[1].txt" Pattern match: "www.delta[1].txt" Pattern match: "www.delta[2].txt" Pattern match: "www.discovercard[1].txt" Pattern match: "www.eol[1].txt" Pattern match: "www.eonline[1].txt" Pattern match: "www.etsy[1].txt" Pattern match: "www.evite[1].txt" Pattern match: "www.fixya[2].txt" Pattern match: "www.foxsports[1].txt" Pattern match: "www.freeonlinegames[1].txt" Pattern match: "www.gamezer[1].txt" Pattern match: "www.gazeta[2].txt" Pattern match: "www.girlsgogames[2].txt" Pattern match: "www.goo.ne[1].txt" Pattern match: "www.hurriyet.com[2].txt" Pattern match: "www.ichwillkuehe[1].txt" Pattern match: "www.ifeng[2].txt" Pattern match: "www.ig.com[1].txt" Pattern match: "www.ikea[1].txt" Pattern match: "www.immobilienscout24[1].txt" Pattern match: "www.inbox[1].txt" Pattern match: "www.instagram[2].txt" Pattern match: "www.intel[1].txt" Pattern match: "www.itau.com[1].txt" Pattern match: "www.jetblue[1].txt" Pattern match: "www.jiayuan[1].txt" Pattern match: "www.jiayuan[2].txt" Pattern match: "www.kayak[1].txt" Pattern match: "www.kayak[2].txt" Pattern match: "www.kohls[2].txt" Pattern match: "www.last[2].txt" Pattern match: "www.leboncoin[1].txt" Pattern match: "www.lenovo[2].txt" Pattern match: "www.le[1].txt" Pattern match: "www.linkedin[1].txt" Pattern match: "www.liveadexchanger[1].txt" Pattern match: "www.livedoor[1].txt" Pattern match: "www.livestrong[1].txt" Pattern match: "www.lloydsbank[1].txt" Pattern match: "www.lowermybills[1].txt" Pattern match: "www.lowes[2].txt" Pattern match: "www.mapion.co[2].txt" Pattern match: "www.marca[2].txt" Pattern match: "www.marriott[1].txt" Pattern match: "www.maxonclick[1].txt" Pattern match: "www.merriam-webster[1].txt" Pattern match: "www.microsoftstore[1].txt" Pattern match: "www.moonbasa[1].txt" Pattern match: "www.msn[1].txt" Pattern match: "www.msn[3].txt" Pattern match: "www.mtime[1].txt" Pattern match: "www.nate[1].txt" Pattern match: "www.nokia[2].txt" Pattern match: "www.overstock[2].txt" Pattern match: "www.pagesjaunes[2].txt" Pattern match: "www.partypoker[1].txt" Pattern match: "www.paypal[1].txt" Pattern match: "www.pcauto.com[1].txt" Pattern match: "www.pchome[2].txt" Pattern match: "www.pnc[2].txt" Pattern match: "www.pof[1].txt" Pattern match: "www.pof[2].txt" Pattern match: "www.pole-emploi[1].txt" Pattern match: "www.qq[1].txt" Pattern match: "www.rakuten.co[2].txt" Pattern match: "www.realtor[2].txt" Pattern match: "www.repubblica[2].txt" Pattern match: "www.rightmove.co[1].txt" Pattern match: "www.robtex[2].txt" Pattern match: "www.shoplocal[1].txt" Pattern match: "www.shutterfly[2].txt" Pattern match: "www.sogou[1].txt" Pattern match: "www.sohu[2].txt" Pattern match: "www.sony[10].txt" Pattern match: "www.sony[2].txt" Pattern match: "www.sony[3].txt" Pattern match: "www.sony[4].txt" Pattern match: "www.sony[5].txt" Pattern match: "www.sony[6].txt" Pattern match: "www.sony[7].txt" Pattern match: "www.sony[8].txt" Pattern match: "www.sony[9].txt" Pattern match: "www.stumbleupon[2].txt" Pattern match: "www.suning[1].txt" Pattern match: "www.symantec[1].txt" Pattern match: "www.syyx[1].txt" Pattern match: "www.t-online[2].txt" Pattern match: "www.telegraph.co[1].txt" Pattern match: "www.tenpay[1].txt" Pattern match: "www.terra.com[1].txt" Pattern match: "www.thefreedictionary[1].txt" Pattern match: "www.theweathernetwork[1].txt" Pattern match: "www.tiexue[1].txt" Pattern match: "www.tmall[2].txt" Pattern match: "www.today[1].txt" Pattern match: "www.toshiba[2].txt" Pattern match: "www.travelocity[2].txt" Pattern match: "www.trulia[1].txt" Pattern match: "www.united[2].txt" Pattern match: "www.univision[1].txt" Pattern match: "www.uol.com[1].txt" Pattern match: "www.upsellit[1].txt" Pattern match: "www.usaa[1].txt" Pattern match: "www.verizonwireless[1].txt" Pattern match: "www.viewster[1].txt" Pattern match: "www.washingtonpost[1].txt" Pattern match: "www.wheretowatch[1].txt" Pattern match: "www.wwe[1].txt" Pattern match: "www.zergnet[1].txt" Pattern match: "www.zhcw[1].txt" Pattern match: "www.zhenai[1].txt" Pattern match: "www.zoosk[2].txt" Pattern match: "www1.euro.dell[1].txt" Pattern match: "www3.hilton[2].txt" Heuristic match: "01/14/2015 02:55 PM 118 gmpopenh264.info" Heuristic match: "02/15/2015 05:40 AM 192,512 00010007.ci" Heuristic match: "04/21/2016 02:07 PM Microsoft.NET" Heuristic match: "04/21/2016 02:06 PM Proof.es" Heuristic match: "04/21/2016 02:06 PM Proof.fr" Heuristic match: "Directory of c:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es" Heuristic match: "Directory of c:\Program Files\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr" Heuristic match: "02/25/2009 07:32 PM 11,745 1394dbg.cat" Heuristic match: "01/09/2008 11:24 AM 1,036 cv2http.pl" Heuristic match: "01/09/2008 11:24 AM 19,800 cvs.pm" Heuristic match: "01/09/2008 11:24 AM 14,439 p4.pm" Heuristic match: "01/09/2008 11:24 AM 12,509 svn.pm" Heuristic match: "04/14/2008 05:18 PM 19,718 tfs.pm" Heuristic match: "01/09/2008 11:24 AM 13,846 vss.pm" Heuristic match: "02/25/2009 07:32 PM 7,182 usb2dbg.cat" Heuristic match: "11/20/2010 02:29 PM 37,376 audiodepthconverter.ax" Heuristic match: "11/20/2010 02:29 PM 46,592 directshowtap.ax" Heuristic match: "11/20/2010 02:29 PM 31,232 fieldswitch.ax" Heuristic match: "11/20/2010 02:29 PM 32,768 offset.ax" Heuristic match: "11/20/2010 02:29 PM 56,832 rtstreamsink.ax" Heuristic match: "11/20/2010 02:29 PM 39,936 rtstreamsource.ax" Heuristic match: "11/20/2010 02:29 PM 55,808 soniccolorconverter.ax" Heuristic match: "11/20/2010 02:29 PM 39,424 sonicsptransform.ax" Heuristic match: "02/15/2015 05:39 AM 51,236 CIEXYZ.pf" Heuristic match: "02/15/2015 05:39 AM 632 GRAY.pf" Heuristic match: "02/15/2015 05:39 AM 1,044 LINEAR_RGB.pf" Heuristic match: "02/15/2015 05:39 AM 274,474 PYCC.pf" Heuristic match: "02/15/2015 05:39 AM 3,144 sRGB.pf" Heuristic match: "01/20/2010 09:40 PM 7,321 OEMPRINT.CAT" Heuristic match: "07/14/2009 07:52 PM 21,234 isvtier5appsignsdk.cc" Heuristic match: "07/14/2009 11:29 PM 7,501 VirtualLightSensorDriver.cat" Heuristic match: "07/14/2009 11:29 PM 7,436 virtualstorage.cat" Heuristic match: "07/14/2009 07:53 PM 9,117 AqErr.mc" Heuristic match: "07/14/2009 07:53 PM 10,851 CatErr.mc" Heuristic match: "07/14/2009 07:53 PM 26 W32chico.mk" Heuristic match: "02/15/2015 05:53 AM explore.vc" Heuristic match: "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\com\administration\explore.vc" Heuristic match: "07/14/2009 07:54 PM 443 adoprivps.mk" Heuristic match: "07/14/2009 07:55 PM 1,273 binding.pl" Heuristic match: "07/14/2009 07:55 PM 2,426 create.pl" Heuristic match: "07/14/2009 07:55 PM 7,933 modify.pl" Heuristic match: "07/14/2009 07:55 PM 1,521 Messages.mc" Heuristic match: "07/14/2009 07:55 PM 1,478 Messages.mc" Heuristic match: "07/14/2009 07:55 PM 256 resource.hm" Heuristic match: "07/14/2009 07:55 PM 1,103 backupeventlog.pl" Heuristic match: "07/14/2009 07:55 PM 747 cimomid.pl" Heuristic match: "07/14/2009 07:55 PM 1,178 cleareventlog.pl" Heuristic match: "07/14/2009 07:55 PM 758 datetime.pl" Heuristic match: "07/14/2009 07:55 PM 1,430 deleteservice.pl" Heuristic match: "07/14/2009 07:55 PM 849 derivation.pl" Heuristic match: "07/14/2009 07:55 PM 1,297 disabledhcp.pl" Heuristic match: "07/14/2009 07:55 PM 841 dnsdomainname.pl" Heuristic match: "07/14/2009 07:55 PM 764 domainname.pl" Heuristic match: "07/14/2009 07:55 PM 3,068 emptyarray.pl" Heuristic match: "07/14/2009 07:55 PM 1,030 enabledhcp.pl" Heuristic match: "07/14/2009 07:55 PM 1,770 errmsg.pl" Heuristic match: "07/14/2009 07:55 PM 852 getappboost.pl" Heuristic match: "07/14/2009 07:55 PM 798 getbootconfig.pl" Heuristic match: "07/14/2009 07:55 PM 1,406 getnetworkadapterconfig.pl" Heuristic match: "07/14/2009 07:55 PM 1,230 listeventlogfiles.pl" Heuristic match: "07/14/2009 07:55 PM 1,265 listeventsbycode.pl" Heuristic match: "07/14/2009 07:55 PM 972 listnetworkadapters.pl" Heuristic match: "07/14/2009 07:55 PM 792 listnetworkprotocols.pl" Heuristic match: "07/14/2009 07:55 PM 1,155 listservices.pl" Heuristic match: "07/14/2009 07:55 PM 751 machinename.pl" Heuristic match: "07/14/2009 07:55 PM 1,313 methodex.pl" Heuristic match: "07/14/2009 07:55 PM 1,511 ntevent.pl" Heuristic match: "07/14/2009 07:55 PM 2,234 nvsarray.pl" Heuristic match: "07/14/2009 07:55 PM 866 objset.pl" Heuristic match: "07/14/2009 07:55 PM 1,197 osinfo.pl" Heuristic match: "07/14/2009 07:55 PM 2,077 pathbuild.pl" Heuristic match: "07/14/2009 07:55 PM 1,321 pauseservice.pl" Heuristic match: "07/14/2009 07:55 PM 984 printerstatus.pl" Heuristic match: "07/14/2009 07:55 PM 942 printjobs.pl" Heuristic match: "07/14/2009 07:55 PM 1,900 privilege.pl" Heuristic match: "07/14/2009 07:55 PM 748 process.pl" Heuristic match: "07/14/2009 07:55 PM 910 reboot.pl" Heuristic match: "07/14/2009 07:55 PM 1,521 remotereboot.pl" Heuristic match: "07/14/2009 07:55 PM 1,465 remoteshutdown.pl" Heuristic match: "07/14/2009 07:55 PM 1,357 resumeservice.pl" Heuristic match: "07/14/2009 07:55 PM 1,299 schema.pl" Heuristic match: "07/14/2009 07:55 PM 1,104 service.pl" Heuristic match: "07/14/2009 07:55 PM 964 servicestopped.pl" Heuristic match: "07/14/2009 07:55 PM 933 shutdown.pl" Heuristic match: "07/14/2009 07:55 PM 1,005 spawn.pl" Heuristic match: "07/14/2009 07:55 PM 1,026 startservice.pl" Heuristic match: "07/14/2009 07:55 PM 1,029 stopservice.pl" Heuristic match: "07/14/2009 07:55 PM 896 system.pl" Heuristic match: "07/14/2009 07:55 PM 876 viewpagefilesettings.pl" Heuristic match: "07/14/2009 07:55 PM 1,447 perfmon.pl" Heuristic match: "07/14/2009 07:55 PM 845 registry.pl" Heuristic match: "02/15/2015 05:54 AM VB.NET" Heuristic match: "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\tabletpc\autoclaims\VB.NET" Heuristic match: "07/14/2009 07:55 PM 544 FileRep.mc" Heuristic match: "07/14/2009 07:55 PM 269 eventlogmsgs.mc" Heuristic match: "07/14/2009 07:55 PM 2,188 MemCtrs.Mc" Heuristic match: "07/14/2009 07:55 PM 1,571 GenCtrs.Mc" Heuristic match: "Directory of c:\Program Files\Microsoft.NET" Heuristic match: "08/08/2011 11:13 AM 10,152 bazisvirtualcdbus.cat" Heuristic match: "09/13/2014 12:25 AM 2,046 dictionary.alcatel.sr" Pattern match: "http://daummail.tistory.com/420" Pattern match: "http://daummail.tistory.com/" Pattern match: "https://member.daum.net/join?rtnUrl=http%3A%2F%2Fmail.daum.net%2F" Pattern match: "https://play.google.com/store/apps/details?id=net.daum.android.mail" Pattern match: "http://www.kakaocorp.com/main" Pattern match: "mail1.daumcdn.net/mail_static/mint/dist/ef1584a/js/logout-lib.js" Pattern match: "mail1.daumcdn.net/mail_static/mint/dist/ef1584a/js/logout-common.js" Pattern match: "t1.daumcdn.net/adfit/static/ad.min.js" Pattern match: "m1.daumcdn.net/tiara/js/td.min.js"28:T5fd,"02/28/2017 02:06 PM 13 www.paypal[1].xml" (Indicator: "paypal") "02/28/2017 01:59 PM 13 www.youtube[1].xml" (Indicator: "youtube") "02/28/2017 02:02 PM 36,326 paypal_com[1].htm" (Indicator: "paypal") "02/28/2017 01:27 PM 236,060 myspace_com[1].htm" (Indicator: "myspace") "03/01/2017 01:54 PM 252 HPFeb15_social_Twitter[1].png" (Indicator: "twitter") "02/28/2017 01:29 PM 1,236 pspubws@myspace[1].txt" (Indicator: "myspace") "02/28/2017 02:02 PM 132 pspubws@paypalobjects[2].txt" (Indicator: "paypal") "02/28/2017 02:02 PM 557 pspubws@paypal[2].txt" (Indicator: "paypal") "02/28/2017 01:18 PM 99 pspubws@twitter[1].txt" (Indicator: "twitter") "02/28/2017 02:02 PM 95 pspubws@www.paypal[1].txt" (Indicator: "paypal") "02/28/2017 01:07 PM 176 pspubws@youtube[2].txt" (Indicator: "youtube") "02/28/2017 02:22 PM 116 badoo.com.url" (Indicator: "badoo.com") "02/28/2017 02:22 PM 120 hotfile.com.url" (Indicator: "hotfile.com") "02/28/2017 02:22 PM 122 linkedin.com.url" (Indicator: "linkedin.com") "02/28/2017 02:22 PM 120 netflix.com.url" (Indicator: "netflix.com") "02/28/2017 02:22 PM 118 paypal.com.url" (Indicator: "paypal") "02/28/2017 02:22 PM 120 twitter.com.url" (Indicator: "twitter") "02/01/2017 01:43 AM 23,668 youtube.crx" (Indicator: "youtube")29:T4cc,"02/15/2015 12:50 PM VBoxGuestAdditions" (Indicator: "vbox") "02/15/2015 12:50 PM VBoxGuestAdditions" (Indicator: "vboxguest") "02/15/2015 12:50 PM VBoxGuestAdditions" (Indicator: "vboxguestadditions") "02/15/2015 12:50 PM Oracle VM VirtualBox Guest Additions" (Indicator: "virtualbox") "Directory of c:\users\7EcZ31c\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox Guest Additions" (Indicator: "virtualbox") "05/04/2016 11:23 PM VirtualBox Guest Additions" (Indicator: "virtualbox") "VBoxService.exe 636 Services 0 4,188 K" (Indicator: "vbox") "VBoxService.exe 636 Services 0 4,188 K" (Indicator: "vboxservice") "VBoxTray.exe 1704 Console 1 4,356 K" (Indicator: "vbox") "VBoxTray.exe 1704 Console 1 4,356 K" (Indicator: "vboxtray") "VBoxService.exe 1948 Console 1 2,960 K" (Indicator: "vbox") "VBoxService.exe 1948 Console 1 2,960 K" (Indicator: "vboxservice")2a:T4be,"root\cimv2" (Indicator: "root\cimv2") "07/14/2009 07:55 PM 798 getbootconfig.pl" (Indicator: "bootconfig") "07/14/2009 07:55 PM 573 GetBootConfig.Vbs" (Indicator: "bootconfig") "02/15/2015 05:54 AM bootconfigurationdata" (Indicator: "bootconfig") "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\winbase\bootconfigurationdata" (Indicator: "bootconfig") "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\winbase\bootconfigurationdata\bcdsampleapp" (Indicator: "bootconfig") "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\winbase\bootconfigurationdata\bcdsampleapp\properties" (Indicator: "bootconfig") "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\winbase\bootconfigurationdata\bcdsamplelib" (Indicator: "bootconfig") "Directory of c:\Program Files\Microsoft SDKs\Windows\v7.0\Samples\winbase\bootconfigurationdata\bcdsamplelib\properties" (Indicator: "bootconfig") "WmiPrvSE.exe 3980 Services 0 9,160 K" (Indicator: "wmiprvse.exe") "WmiPrvSE.exe 2668 Services 0 4,308 K" (Indicator: "wmiprvse.exe")2b:T50c,Spawned process "cmd.exe" with commandline "/c taskkill /f /im daumcleaner.exe" (UID: 00013467-00003516) Spawned process "taskkill.exe" with commandline "taskkill /f /im daumcleaner.exe" (UID: 00013471-00003868) Spawned process "cmd.exe" with commandline "/c dir "c:\Documents and Settings" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00013476-00003340) Spawned process "cmd.exe" with commandline "/c dir "c:\users" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00013480-00003264) Spawned process "cmd.exe" with commandline "/c dir "%PROGRAMFILES%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00014086-00002504), Spawned process "cmd.exe" with commandline "/c dir "%APPDATA%\ /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00016115-00003092) Spawned process "cmd.exe" with commandline "/c dir "D:\" /s /a >>"%APPDATA%\Action Center\pre\PI_000.dat"" (UID: 00016737-00002864) Spawned process "cmd.exe" with commandline "/c systeminfo >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00017368-00002500) Spawned process "systeminfo.exe" (UID: 00017373-00003064) Spawned process "cmd.exe" with commandline "/c tasklist >>"%APPDATA%\Action Center\pre\PI_001.dat"" (UID: 00018050-00002112) Spawned process "tasklist.exe" (UID: 00018054-00003072)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791339440956,"unified_at":"2026-10-07T02:17:20.956Z","metadata":{"hashes":{"sha256":"98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a","sha1":"a9eb9a1734bb84bbc60df38d4a1e02a870962857","md5":"92001e9cebec0f0f0ac2b7c7e04f017d","sha512":"a03469f5109e059f4b7682fd2caef016ed168816023ac3306048e9924cd5575a20b21adf6f4fcea3582ba19dcb9fbe6bb6f7f99045a11ef4b7f5efb7c5270fb2","ssdeep":"6144:MlO3aEsyxOS3Y+lWGKUaTQVNWyculdI4:MlOUyxOSXzaVy5","ssdeep_chunks":["6144:MlO3aEs","6144:lO3aEsy","6144:O3aEsyx","6144:3aEsyxO","6144:aEsyxOS","6144:EsyxOS3","6144:syxOS3Y","6144:yxOS3Y+","6144:xOS3Y+l","6144:OS3Y+lW","6144:S3Y+lWG","6144:3Y+lWGK","6144:Y+lWGKU","6144:+lWGKUa","6144:lWGKUaT","6144:WGKUaTQ","6144:GKUaTQV","6144:KUaTQVN","6144:UaTQVNW","6144:aTQVNWy","6144:TQVNWyc","6144:QVNWycu","6144:VNWycul","6144:NWyculd","6144:WyculdI","6144:yculdI4","12288:MlO3aEs","12288:lO3aEsy","12288:O3aEsyx","12288:3aEsyxO","12288:aEsyxOS","12288:EsyxOS3","12288:syxOS3Y","12288:yxOS3Y+","12288:xOS3Y+l","12288:OS3Y+lW","12288:S3Y+lWG","12288:3Y+lWGK","12288:Y+lWGKU","12288:+lWGKUa","12288:lWGKUaT","12288:WGKUaTQ","12288:GKUaTQV","12288:KUaTQVN","12288:UaTQVNW","12288:aTQVNWy","12288:TQVNWyc","12288:QVNWycu","12288:VNWycul","12288:NWyculd","12288:WyculdI","12288:yculdI4","6144:MlOUyxO","6144:lOUyxOS","6144:OUyxOSX","6144:UyxOSXz","6144:yxOSXza","6144:xOSXzaV","6144:OSXzaVy","6144:SXzaVy5"],"imphash":"9adf0d7419a9ef36a0214c1edee97438"},"file_info":{"file_name":"file","file_type":["pedll","executable"],"file_type_id":"dll","file_size":221184,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521407991000,"last_seen":1659954555000,"last_multi_scan":1659954555000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","ransomware"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":23,"suspicious_count":14,"malicious_count":4,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Susnokoma","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Scar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.OlympicDestroyer.fmbdh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.8828","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.8828 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kimsuky.Q trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Scar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Scar.qmkk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXDY-OX!92001E9CEBEC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Scar.exrnfu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_MUADNE.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_MUADNE.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Scar","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Scar","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"systeminfo.exe\" at 00017373-00003064-00000105-46888113\n \"tasklist.exe\" at 00018054-00003072-00000105-48630179","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 31734-830-10011240\n GetProcessHeap@KERNEL32.dll at 31734-833-10010F60\n GetProcessHeap@KERNEL32.dll at 31734-829-10011500","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"taskkill.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"systeminfo.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"systeminfo.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"tasklist.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUNDLL32.EXE\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\RUNDLL32.EXE\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mail.daum.net\"\n \"logins.daum.net\"\n \"cmail.daum.net\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"113.29.186.70:443\"\n \"211.231.99.19:443\"\n \"113.29.186.70:80\"\n \"113.29.186.71:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"details too long to display","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$25","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1Accept-Language: en-us,en;q=0.5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0Host: mail.daum.netConnection: Keep-Alive\"\n \"GET /login?url=http%3A%2F%2Fmail.daum.net%2F HTTP/1.1Accept-Language: en-us,en;q=0.5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0Host: mail.daum.netConnection: Keep-Alive\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Opened the service control manager","description":"\"rundll32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c taskkill /f /im daumcleaner.exe\" on 2018-3-18.14:13:39.456\n \"/c dir \"c:\\Documents and Settings\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-3-18.14:13:39.556\n \"/c dir \"c:\\users\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-3-18.14:13:39.596\n \"/c dir \"%PROGRAMFILES%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-3-18.14:13:45.655, \"/c dir \"%APPDATA%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-3-18.14:14:05.984\n \"/c dir \"D:\\\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"\" on 2018-3-18.14:14:12.203\n \"/c systeminfo >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"\" on 2018-3-18.14:14:18.522\n \"/c tasklist >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"\" on 2018-3-18.14:15:05.352","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$26","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"rundll32.exe\" is creating a new process (Name: \"%APPDATA%\\Action Center\\pro\\ieproxy.dll\", Handle: 252)\n \"rundll32.exe\" is creating a new process (Name: \"C:\\98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll:Zone.Identifier\", Handle: 264)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 276)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 284)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 292)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 300)\n \"rundll32.exe\" is creating a new process (Name: \"%APPDATA%\\Action Center\\pre\\PI_001.dat\", Handle: 308)\n \"rundll32.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 356)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"1060B7ADDE0FF6DE85637BF89FC4CEBC_2F0A0FD6E5FFBDCBA1672A965E30E8EA\" has type \"data\"\n \"Cab5918.tmp\" has type \"Microsoft Cabinet archive data 50939 bytes 1 file\"\n \"PI_001.dat\" has type \"ASCII text with CRLF line terminators\"\n \"mg_6334\" has type \"data\"\n \"PI_003.dat\" has type \"MS Windows shortcut Item id list present ctime=Sun Dec 31 23:50:39 1600 mtime=Sun Dec 31 23:50:39 1600 atime=Sun Dec 31 23:50:39 1600 length=0 window=hide\"\n \"378B079587A9184B2E2AB859CB263F40_2B618FC6CF84AEF3C14E129161BF18D9\" has type \"data\"\n \"D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE\" has type \"data\"\n \"C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873\" has type \"data\"\n \"C9E3282A673263848AB7F0C007FD3AF1_B9498D7CA640C12729362A0450F81EFD\" has type \"data\"\n \"Tar5919.tmp\" has type \"data\"\n \"~DA20A4.tmp\" has type \"HTML document UTF-8 Unicode text with CRLF LF line terminators\"\n \"PI_000.dat\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"cmd.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\systeminfo.exe\"\n \"systeminfo.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\tasklist.exe\"\n \"tasklist.exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \"tasklist.exe\" touched file \"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"iWZi\"","origin":"Network Traffic","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"$28","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"taskkill.exe\" opened \"\\Device\\KsecDD\"\n \"systeminfo.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops a text file that contains suspicious strings (e.g. shell/ActiveX/DOM related)","description":"\"PI_000.dat\" contains indicator \"WinHTTP\" (Line: 28604; Offset: 39)","origin":"Binary File","relevance":8,"id":"binary-4","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"taskkill.exe\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")\n \"systeminfo.exe\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")\n \"tasklist.exe\" wrote bytes \"40537e7758587f77186a7f77653c80770000000000bf93770000000056cc9377000000007cca93770000000037689b756a2c8077d62d80770000000020699b750000000029a6937700000000a48d9b7500000000f70e937700000000\" to virtual address \"0x779D1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll.bin\" was detected as \"Armadillo v1.xx - v2.xx\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"rundll32.exe\" created file \"%APPDATA%\\Action Center\\pro\\ieproxy.dll:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /f /im daumcleaner.exe\" (UID: 00013471-00003868)","origin":"Monitored Target","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for the presence of a forensics/monitoring tool","description":"\"09/16/2014 09:13 AM 320,400 capinfos.exe\" (Indicator: \"capinfos.exe\")\n \"09/16/2014 09:13 AM 374,672 dumpcap.exe\" (Indicator: \"dumpcap.exe\")\n \"09/16/2014 09:13 AM 332,176 editcap.exe\" (Indicator: \"editcap.exe\")\n \"09/16/2014 09:13 AM 311,184 mergecap.exe\" (Indicator: \"mergecap.exe\")\n \"09/16/2014 09:13 AM 3,233,280 qtshark.exe\" (Indicator: \"tshark.exe\")\n \"09/16/2014 09:13 AM 342,416 rawshark.exe\" (Indicator: \"rawshark.exe\")\n \"09/16/2014 09:13 AM 335,248 text2pcap.exe\" (Indicator: \"text2pcap.exe\")\n \"09/16/2014 09:13 AM 503,696 tshark.exe\" (Indicator: \"tshark.exe\")\n \"09/16/2014 09:13 AM 2,705,808 Wireshark.exe\" (Indicator: \"wireshark.exe\")\n \"tshark.exe 2332 Console 1 41,396 K\" (Indicator: \"tshark.exe\")\n \"dumpcap.exe 2736 Console 1 4,948 K\" (Indicator: \"dumpcap.exe\")","origin":"File/Memory","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Win32_NetworkAdapter\" (Indicator: \"win32_networkadapter\"; File: \"00017373-00003064.00000000.17876.00291000.00000020.mdmp\")\n \"Win32_NetworkAdapterConfiguration.Index=%d\" (Indicator: \"win32_networkadapterconfiguration\"; File: \"00017373-00003064.00000000.17876.00291000.00000020.mdmp\")\n \"Win32_ComputerSystem\" (Indicator: \"win32_computersystem\"; File: \"00017373-00003064.00000000.17876.00291000.00000020.mdmp\")\n \"Win32_Processor\" (Indicator: \"win32_process\"; File: \"00017373-00003064.00000000.17876.00291000.00000020.mdmp\")\n \"Win32_BIOS\" (Indicator: \"win32_bios\"; File: \"00017373-00003064.00000000.17876.00291000.00000020.mdmp\")","origin":"File/Memory","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$29","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Contains escaped byte string (often part of obfuscated shellcode)","description":"details too long to display","origin":"File/Memory","relevance":10,"id":"string-15","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"https://logins.daum.net\" as malicious (1% detection rate)\n 1/69 reputation engines marked \"https://logins.daum.net/accounts/srp.do\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"https://logins.daum.net/accounts/loginform.do\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"pspubws@127.0.0\"\n Pattern match: \"pspubws@2013561.fls.doubleclick\"\n Pattern match: \"pspubws@246059135.log.optimizely\"\n Pattern match: \"pspubws@24h.com\"\n Pattern match: \"pspubws@a.qunar\"\n Pattern match: \"pspubws@a.twiago\"\n Pattern match: \"pspubws@a4.bing\"\n Pattern match: \"pspubws@abcnews.go\"\n Pattern match: \"pspubws@abril.com\"\n Pattern match: \"pspubws@accounts.google\"\n Pattern match: \"pspubws@ad.360yield\"\n Pattern match: \"pspubws@ad.dyntracker\"\n Pattern match: \"pspubws@ad.zanox\"\n Pattern match: \"pspubws@ad1.adfarm1.adition\"\n Pattern match: \"pspubws@ad2.adfarm1.adition\"\n Pattern match: \"pspubws@ad4.adfarm1.adition\"\n Pattern match: \"pspubws@ad9.adfarm1.adition\"\n Pattern match: \"pspubws@adfarm1.adition\"\n Pattern match: \"pspubws@admaster.com\"\n Pattern match: \"pspubws@admatic.com\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"02/15/2015 06:00 AM 1,356 VxAnalysisData (192.168.56.1).lnk\"\n Heuristic match: \"03/01/2017 12:44 PM 1.3.32.7\"\n Heuristic match: \"Directory of %PROGRAMFILES%\\Google\\Update\\1.3.32.7\"\n Heuristic match: \"12/11/2017 01:07 PM 1.3.32.7\"\n Heuristic match: \"Directory of %PROGRAMFILES%\\Google\\Update\\Download\\{430FD4D0-B729-4F61-AA34-91526481799D}\\1.3.32.7\"\n Heuristic match: \"[01]: 192.168.56.20\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains many references to file extensions (often found in ransomware)","description":"Found reference to a lot of file extensions within a single string: .001\n .002\n .3gp\n .7z\n .csv\n .doc\n .dot\n .myd\n .ppt\n .rtf\n .xls\n .acr\n .act\n .adp\n .ads\n .ai\n .al\n .asc\n .asf\n .asm\n .asp\n .aspx\n .avi\n .bak\n .bank\n .bar\n .bat\n .bay\n .big\n .bin\n .bmp\n .cer\n .cfg\n .cgm\n .class\n .cls\n .cmd\n .config\n .contact\n .cpp\n .crt\n .crw\n .cs\n .csh\n .css\n .csv\n .dat\n .db\n .dds\n .der\n .des\n .desc\n .design\n .doc\n .docx\n .dot\n .dotm\n .dotx\n .dtd\n .edb\n .eps\n .fla\n .frm\n .gif\n .hpp\n .html\n .idx\n .jar\n .jpg\n .js\n .key\n .lay\n .layout\n .lit\n .log\n .lua\n .map\n .mapimail\n .max\n .md\n .mid\n .mlb\n .mml\n .mmw\n .mp3\n .msg\n .myd\n .obj\n .odb\n .odc\n .odf\n .pages\n .pak\n .pas\n .pat\n .pdb\n .pdf\n .pfx\n .php\n .pl\n .png\n .pot\n .potx\n .pps\n .ppt\n .prf\n .ps\n .psd\n .rar\n .rb\n .rtf\n .safe\n .sb\n .sch\n .sdf\n .sh\n .sql\n .sqlite\n .std\n .tar\n .tex\n .thm\n .tif\n .txt\n .vb\n .vbs\n .wav\n .wma\n .wmv\n .xla\n .xlam\n .xls\n .xlt\n .xltx\n .xml\n .zip","origin":"File/Memory","relevance":10,"id":"string-52","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$2a","origin":"File/Memory","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegOpenKeyExA\n RegCloseKey\n GetFileAttributesA\n FindNextFileA\n GetTempPathA\n WriteFile\n CopyFileA\n GetModuleFileNameA\n GetModuleHandleA\n CreateThread\n TerminateProcess\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetFileSize\n DeleteFileA\n DeleteFileW\n GetProcAddress\n FindNextFileW\n GetTempFileNameA\n FindFirstFileW\n CreateFileW\n CreateFileA\n GetCommandLineA\n FindFirstFileA\n CreateProcessA\n Sleep\n VirtualAlloc\n HttpSendRequestA\n InternetQueryDataAvailable\n InternetWriteFile\n InternetCloseHandle\n InternetOpenA\n InternetReadFile\n InternetConnectA\n HttpQueryInfoA\n HttpSendRequestExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$2b","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"43/65 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"43/65 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"malicious","category":"Installation/Persistance","name":"Found an indicator for a scheduled task trigger","description":"details too long to display","origin":"File/Memory","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"details too long to display","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}],"incidents":[{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"Contains escaped byte string (often part of obfuscated shellcode)"}],"sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}]},"activity":{"stats":{"process_count":13,"spawned_processes_count":13,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":105,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":60,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":4,"dns_resolutions_count":3,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"sandbox_reports":[{"id":"5aaed5ef7ca3e10ce24d1d86","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Scar","contacted_countries":["KOR"],"submit_name":"98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll","analysis_start_time":"2018-03-18T22:11:00+00:00","indicators_count":{"informative":23,"suspicious":18,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"113.29.186.70","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"address":"211.231.99.19","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"address":"113.29.186.70","port":80,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"address":"113.29.186.71","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}],"dns_resolutions":[{"domain":"mail.daum.net","address":"113.29.186.70","ttl":299,"country":"Korea Republic of","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"domain":"logins.daum.net","ttl":492,"country":"-","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"domain":"cmail.daum.net","address":"113.29.186.71","ttl":460,"country":"Korea Republic of","registrar_name":"Netpia.com, Inc.","registrar_organization":"Kakao Corp.","registrar_creation_date":"1996-03-05T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}],"http_requests":[{"host":"mail.daum.net","host_ip":"113.29.186.70:80","url":"/","method":"GET","header":"GET / HTTP/1.1\nAccept-Language: en-us,en;q=0.5\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0\nHost: mail.daum.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"host":"mail.daum.net","host_ip":"113.29.186.70:80","url":"/login?url=http%3A%2F%2Fmail.daum.net%2F","method":"GET","header":"GET /login?url=http%3A%2F%2Fmail.daum.net%2F HTTP/1.1\nAccept-Language: en-us,en;q=0.5\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nUser-Agent: Mozilla/5.0 (Windows NT 5.2; rv:12.0) Gecko/20100101 Firefox/12.0\nHost: mail.daum.net\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}],"processes":[{"pid":3404,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00011645-00003404"},{"pid":3452,"ppid":3404,"name":"rundll32.exe","command_line":"\"C:\\98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll\",Run","sha256":"5ad3c37e6f2b9db3ee8b5aeedc474645de90c66e3d95f8620c48102f1eba4124","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00011645-00003404","uid":"00013320-00003452"},{"pid":3516,"ppid":3452,"name":"cmd.exe","command_line":"/c taskkill /f /im daumcleaner.exe","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00013467-00003516"},{"pid":3868,"ppid":3516,"name":"taskkill.exe","command_line":"taskkill /f /im daumcleaner.exe","sha256":"cb1822a981e9821d571af16b7e37beba5feb8e3dedcdd0461119af9aac0358b3","normalized_path":"%WINDIR%\\System32\\taskkill.exe","parent_uid":"00013467-00003516","uid":"00013471-00003868"},{"pid":3340,"ppid":3452,"name":"cmd.exe","command_line":"/c dir \"c:\\Documents and Settings\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00013476-00003340"},{"pid":3264,"ppid":3452,"name":"cmd.exe","command_line":"/c dir \"c:\\users\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00013480-00003264"},{"pid":2504,"ppid":3452,"name":"cmd.exe","command_line":"/c dir \"%PROGRAMFILES%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00014086-00002504"},{"pid":3092,"ppid":3452,"name":"cmd.exe","command_line":"/c dir \"%APPDATA%\\ /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00016115-00003092"},{"pid":2864,"ppid":3452,"name":"cmd.exe","command_line":"/c dir \"D:\\\" /s /a >>\"%APPDATA%\\Action Center\\pre\\PI_000.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00016737-00002864"},{"pid":2500,"ppid":3452,"name":"cmd.exe","command_line":"/c systeminfo >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00017368-00002500"},{"pid":3064,"ppid":2500,"name":"systeminfo.exe","command_line":"","sha256":"dce2c5ea1da23e63eeff2620141fbc2ca45fc4a64f40af89e722f4b5fafed27c","normalized_path":"%WINDIR%\\System32\\systeminfo.exe","parent_uid":"00017368-00002500","uid":"00017373-00003064"},{"pid":2112,"ppid":3452,"name":"cmd.exe","command_line":"/c tasklist >>\"%APPDATA%\\Action Center\\pre\\PI_001.dat\"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00013320-00003452","uid":"00018050-00002112"},{"pid":3072,"ppid":2112,"name":"tasklist.exe","command_line":"","sha256":"ad3e811249da750d80f2762c3aeb403780c1b69d05911e3c9950a7daed9e6670","normalized_path":"%WINDIR%\\System32\\tasklist.exe","parent_uid":"00018050-00002112","uid":"00018054-00003072"}],"all_imported_dlls":["cryptnet.dll","wmiutils.dll","ws2_32.dll","rasapi32.dll","msctf.dll","wininet.dll","user32.dll","usp10.dll","wship6.dll","npmproxy.dll","urlmon.dll","browcli.dll","Wldap32.dll","dnsapi.dll","tzres.dll","framedynos.dll","imm32.dll","98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll","crypt32.dll","dwmapi.dll","winsta.dll","davclnt.dll","wkscli.dll","cscapi.dll","oleaut32.dll","msasn1.dll","nsi.dll","nlaapi.dll","dhcpcsvc.dll","srvcli.dll","dbghelp.dll","cryptbase.dll","devobj.dll","winbrand.dll","ntdsapi.dll","kernel32.dll","rpcrt4.dll","rasman.dll","rasadhlp.dll","credssp.dll","setupapi.dll","rpcss.dll","mlang.dll","KernelBase.dll","sspicli.dll","iertutil.dll","comctl32.dll","NapiNSP.dll","clbcatq.dll","version.dll","wbemcomn.dll","AcLayers.dll","RpcRtRemote.dll","msxml3.dll","cfgmgr32.dll","mpr.dll","gdi32.dll","shlwapi.dll","ole32.dll","userenv.dll","rsaenh.dll","msxml3r.dll","winhttp.dll","ntdll.dll","msvcrt.dll","pnrpnsp.dll","netprofm.dll","dhcpcsvc6.dll","bcrypt.dll","devrtl.dll","imagehlp.dll","sechost.dll","drprov.dll","ntmarta.dll","WSHTCPIP.DLL","gpapi.dll","wtsapi32.dll","netapi32.dll","winrnr.dll","ncrypt.dll","wbemprox.dll","apphelp.dll","uxtheme.dll","winnsi.dll","wintrust.dll","cabinet.dll","profapi.dll","advapi32.dll","netutils.dll","IPHLPAPI.DLL","schannel.dll","rtutils.dll","mswsock.dll","cryptsp.dll","lpk.dll","davhlpr.dll","SensApi.dll","secur32.dll","bcryptprimitives.dll","webio.dll","wbemsvc.dll","fastprox.dll","shell32.dll","ntlanman.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"PI_000.dat","sha256":"486b8ebe93d37b1b92fb99ff06f8fbc7e17025e5d3b61015ae4a13af9ed79538","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"PI_001.dat","sha256":"8a8e34b04648afeb97e54486c789b8b6d661143df2ccd2350417f940818c2f7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"1060B7ADDE0FF6DE85637BF89FC4CEBC_2F0A0FD6E5FFBDCBA1672A965E30E8EA","sha256":"82e7d7c7c36ff91eacac2555998653377c92cdee26cf3df5ce1b8160ebc957cf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"Cab5918.tmp","sha256":"c929701c67a05f90827563eedccf5eba8e65b2da970189a0371f28cd896708b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"mg_6334","sha256":"4855631778efb34deb10d26cb654f9be316f03ea9abdb1acfc851eb56d123399","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"PI_003.dat","sha256":"e64c755dd182163be0bfe2d680932ae60db36431c4ac72febbaa601f495fb755","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"378B079587A9184B2E2AB859CB263F40_2B618FC6CF84AEF3C14E129161BF18D9","sha256":"ce05c0b12d6916e3f85db55a668a4b5a14b121ff0c30030c234f8e59ea155d6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"D47DBD2F9E3365FBBE008D71FB06716F_D33192D58AA9CA2B9097E848E9FE86DE","sha256":"c65f83b811b6cee263385cbd034d1b140558727276a1980645b157a80751850a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"C46E7B0F942663A1EDC8D9D6D7869173_42820CDFEA41DC84AAB89A6B63561873","sha256":"c8afb1ee4c74a3bf93df19806db6325343e0a85429fd215db4f50d5827d5283c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"C9E3282A673263848AB7F0C007FD3AF1_B9498D7CA640C12729362A0450F81EFD","sha256":"6cd39212efd1b14fb17f7fa58fe805ab3ad2c91d5e4b8eaf40efa23a9c2d909b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"Tar5919.tmp","sha256":"7e58975a4e1e86940f84e744709426939b85ae174dbbf020da3c893a54fd1da2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"~DA20A4.tmp","sha256":"2cb7f0c752ac357fd97ea80ef1523bbb6b0fa365889c3a2aa33c15c608be1d15","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}],"files_written":[{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\pre","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\fin","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\pro","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"C:\\98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\pro\\ieproxy.dll","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"C:\\98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a.dll:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\pro\\ieproxy.dll:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\taskkill.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"C:\\Users\\7EcZ31c","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"C:\\Users\\All Users","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"C:\\Users\\Default User","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Desktop","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Templates","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\java.exe","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\javaw.exe","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%ALLUSERSPROFILE%\\Oracle\\Java\\javapath\\javaws.exe","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Cookies","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Local Settings","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\My Documents","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\NetHood","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\PrintHood","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Recent","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\SendTo","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Start Menu","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Templates","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%LOCALAPPDATA%\\Application Data","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%LOCALAPPDATA%\\History","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%TEMP%\\rary Internet Files","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Documents\\My Music","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Documents\\My Pictures","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%USERPROFILE%\\Documents\\My Videos","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%PUBLIC%\\Documents\\My Music","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%PUBLIC%\\Documents\\My Pictures","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%PUBLIC%\\Documents\\My Videos","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\pre\\PI_000.dat","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\mpr.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\systeminfo.exe","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\systeminfo.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\mlang.dll","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\mlang.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%APPDATA%\\Action Center\\pre\\PI_001.dat","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\tasklist.exe","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\tasklist.exe.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\wmiutils.dll.mui","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"A474D52D-8C44-C67D-BBFB-D513232F8A17","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\A474D52D-8C44-C67D-BBFB-D513232F8A17","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!7ecz31c!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!7ecz31c!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!7ecz31c!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!7ecz31c!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5aaed5ef7ca3e10ce24d1d86"}]}]}},"report_ids":{"sandbox_job_ids":["5aaed5ef7ca3e10ce24d1d86"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Scar Sample 98ccf3a463b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 98ccf3a463b8…. Malware family: Trojan.Scar. Threat score 100/100. 17/27 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Scar Sample 98ccf3a463b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 98ccf3a463b8…. Malware family: Trojan.Scar. Threat score 100/100. 17/27 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/98ccf3a463b81a47fdf4275e228a8f2266e613e08baae8bdcd098e49851ed49a"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Scar Sample 98ccf3a463b8… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 98ccf3a463b8…. Malware family: Trojan.Scar. Threat score 100/100. 17/27 AV engines flagged this file. 4 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]