34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 47:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample 9988a6579fb0… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample 9988a6579fb0…. Malware family: Win/malicious_confidence_60%. Threat score 87/100. 4/27 AV engines flagged this file. 6 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9988a6579fb0432dca97d0a006b50652f6bde4652913bc6f27eae2670ccfc155","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","9988a6579fb0432dca97d0a006b50652f6bde4652913bc6f27eae2670ccfc155"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"9988a6579fb0432dca97d0a006b50652f6bde4652913bc6f27eae2670ccfc155","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T91a," HTTP/1.1 200 OK\nServer: nginx/1.29.8\nDate: Tue\n 05 May 2026 14:33:48 GMT\nContent-Type: application/json; charset=utf-8\nContent-Length: 38\nConnection: keep-alive\nX-Powered-By: Express\nAccess-Control-Allow-Origin: *\nETag: W/\"26-yTM6iSxmALkdgwBsb02nswi8d+g\" with response body ==>7B2273756363657373223A747275652C2264617461223A7B22646F6D61696E73223A5B5D7D7D.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\taskkill.exe\" launched with commandline \"taskkill /F /IM chrome.exe /T\" (UID: 00000000-00006416)\n Process \"%WINDIR%\\system32\\taskkill.exe\" launched with commandline \"taskkill /F /IM msedge.exe /T\" (UID: 00000000-00008016)\n Process \"%WINDIR%\\system32\\taskkill.exe\" launched with commandline \"taskkill /F /IM msedgewebview2.exe /T\" (UID: 00000000-00001604)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"May check for the presence of a forensics/monitoring tool","description":"Found string \"%WINDIR%\\System32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00007916-00000BC0-747051806\")\n Found string \"%WINDIR%\\system32\\taskkill.exe\" (Indicator: \"taskkill.exe\"; Source: \"00000000-00007916-00000C47-3296314276\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-45","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"Network Related","name":"Malicious User Agent(s) detected","description":"Found malicious User Agent: (\"Go-http-client/1.1\")","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-106","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"Network Related","name":"Spawned process connects to a network","description":"Process \"C:\\9988a6579fb0432dca97d0a006b50652f6bde4652913bc6f27eae2670ccfc155.bin.exe\" connects to 130.12.180.135 on port 3000 (TCP)","origin":"Monitored Target","mitre_attack_id":"T1071","relevance":5,"id":"target-412","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetSystemDirectoryA\n VirtualAlloc\n GetThreadContext\n LoadLibraryExW\n WriteFile\n LoadLibraryW\n GetSystemInfo\n CreateThread","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"9988a6579fb0432dca97d0a006b50652f6bde4652913bc6f27eae2670ccfc155.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Terminates other processes using tskill/taskkill","description":"Process \"taskkill.exe\" with commandline \"taskkill /F /IM chrome.exe /T\" (UID: 00000000-00006416)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM msedge.exe /T\" (UID: 00000000-00008016)\n Process \"taskkill.exe\" with commandline \"taskkill /F /IM msedgewebview2.exe /T\" (UID: 00000000-00001604)","origin":"Monitored Target","mitre_attack_id":"T1489","relevance":9,"id":"target-9","sources":[{"report_type":"sandbox","report_id":"69f9ffac39b828d02f0b4bf7"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"