26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 99dbad3d1d10… — Score 86/100 — Hybrid Analysis","description":"Malicious verdict for sample 99dbad3d1d10…. Malware family: Trojan.Generic. Threat score 86/100. 24/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9"],"about":{"@type":"SoftwareApplication","name":"wrw.exe","applicationCategory":["peexe","executable"],"identifier":"99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9","additionalType":"Malicious sample"},"threatScore":86,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5f7,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")28:T473,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":86,"unified_at_epoch_ms":1790543884188,"unified_at":"2026-09-27T21:18:04.188Z","metadata":{"hashes":{"sha256":"99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9","sha1":"e06f530bb208952b6bd43d5001c726653755e828","md5":"5be14022a092eec9855e28c2498f5ada","sha512":"a6baa60ff680b1cada0708080e143435b9738a958c0ffad6a00d64160ef057e572d960d13413e9b9d4fe2e93f0169253f90070e847b53b0e88fd210f88f85a83","ssdeep":"1536:DPIBi7hhqjGsTUApczUDqIZ0y3Gp/InlKJHtquFnUJCPWqoQdkg9gZYtBbsknJpq:DQBi9hA1czUDqtP9PWqo/g9gZ6bs8q","ssdeep_chunks":["1536:DPIBi7h","1536:PIBi7hh","1536:IBi7hhq","1536:Bi7hhqj","1536:i7hhqjG","1536:7hhqjGs","1536:hhqjGsT","1536:hqjGsTU","1536:qjGsTUA","1536:jGsTUAp","1536:GsTUApc","1536:sTUApcz","1536:TUApczU","1536:UApczUD","1536:ApczUDq","1536:pczUDqI","1536:czUDqIZ","1536:zUDqIZ0","1536:UDqIZ0y","1536:DqIZ0y3","1536:qIZ0y3G","1536:IZ0y3Gp","1536:Z0y3Gp/","1536:0y3Gp/I","1536:y3Gp/In","1536:3Gp/Inl","1536:Gp/InlK","1536:p/InlKJ","1536:/InlKJH","1536:InlKJHt","1536:nlKJHtq","1536:lKJHtqu","1536:KJHtquF","1536:JHtquFn","1536:HtquFnU","1536:tquFnUJ","1536:quFnUJC","1536:uFnUJCP","1536:FnUJCPW","1536:nUJCPWq","1536:UJCPWqo","1536:JCPWqoQ","1536:CPWqoQd","1536:PWqoQdk","1536:WqoQdkg","1536:qoQdkg9","1536:oQdkg9g","1536:Qdkg9gZ","1536:dkg9gZY","1536:kg9gZYt","1536:g9gZYtB","1536:9gZYtBb","1536:gZYtBbs","1536:ZYtBbsk","1536:YtBbskn","1536:tBbsknJ","1536:BbsknJp","1536:bsknJpq","3072:DPIBi7h","3072:PIBi7hh","3072:IBi7hhq","3072:Bi7hhqj","3072:i7hhqjG","3072:7hhqjGs","3072:hhqjGsT","3072:hqjGsTU","3072:qjGsTUA","3072:jGsTUAp","3072:GsTUApc","3072:sTUApcz","3072:TUApczU","3072:UApczUD","3072:ApczUDq","3072:pczUDqI","3072:czUDqIZ","3072:zUDqIZ0","3072:UDqIZ0y","3072:DqIZ0y3","3072:qIZ0y3G","3072:IZ0y3Gp","3072:Z0y3Gp/","3072:0y3Gp/I","3072:y3Gp/In","3072:3Gp/Inl","3072:Gp/InlK","3072:p/InlKJ","3072:/InlKJH","3072:InlKJHt","3072:nlKJHtq","3072:lKJHtqu","3072:KJHtquF","3072:JHtquFn","3072:HtquFnU","3072:tquFnUJ","3072:quFnUJC","3072:uFnUJCP","3072:FnUJCPW","3072:nUJCPWq","3072:UJCPWqo","3072:JCPWqoQ","3072:CPWqoQd","3072:PWqoQdk","3072:WqoQdkg","3072:qoQdkg9","3072:oQdkg9g","3072:Qdkg9gZ","3072:dkg9gZY","3072:kg9gZYt","3072:g9gZYtB","3072:9gZYtBb","3072:gZYtBbs","3072:ZYtBbsk","3072:YtBbskn","3072:tBbsknJ","3072:BbsknJp","3072:bsknJpq","1536:DQBi9hA","1536:QBi9hA1","1536:Bi9hA1c","1536:i9hA1cz","1536:9hA1czU","1536:hA1czUD","1536:A1czUDq","1536:1czUDqt","1536:czUDqtP","1536:zUDqtP9","1536:UDqtP9P","1536:DqtP9PW","1536:qtP9PWq","1536:tP9PWqo","1536:P9PWqo/","1536:9PWqo/g","1536:PWqo/g9","1536:Wqo/g9g","1536:qo/g9gZ","1536:o/g9gZ6","1536:/g9gZ6b","1536:g9gZ6bs","1536:9gZ6bs8","1536:gZ6bs8q"],"imphash":"3a1bc10e6c494b7ab8a05396dfab3a01"},"file_info":{"file_name":"wrw.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":93184,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297760000,"last_seen":1677379512000,"last_multi_scan":1677379512000}},"detections":{"summary":{"verdict":"malicious","score":86,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":17,"malicious_count":8,"total":33},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dyre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm/Win32.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.274359","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2600600","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Backdoor.XCTV-7414","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2600600 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004beaac1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Cridex.qty","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Cridex.duncec","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_99","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-FS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Worm/W32.Cridex.93184","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_DR.119FD45F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_DR.119FD45F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Zyx.ANY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Worm.Cridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Cridex.Win32.764","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00560031-00002916-4660-215-01008EAF\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00560031-00002916-9174-215-01008EAF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"93.171.132.5:743\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabCFBC.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarCFCD.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabD368.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarD378.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\ce4b1180b0bb52588665f2573b593215\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 77530000\n \"\" loaded module \"CRYPTSP.DLL\" at base 756F0000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\RSAENH.DLL\" at base 75490000\n \"\" loaded module \"ADVAPI32.DLL\" at base 76340000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 75BC0000\n \"\" loaded module \"NORMALIZ.DLL\" at base 76810000\n \"\" loaded module \"CRYPT32.DLL\" at base 75E50000\n \"\" loaded module \"USERENV.DLL\" at base 752D0000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 76520000\n \"\" loaded module \"WINTRUST.DLL\" at base 75CF0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CryptAcquireContextW@ADVAPI32.dll\"\n \"CryptAcquireContextW@CRYPTSP.dll\"\n \"CPAcquireContext@rsaenh.dll\"\n \"CPReleaseContext@rsaenh.dll\"\n \"CPGenKey@rsaenh.dll\"\n \"CPDeriveKey@rsaenh.dll\"\n \"CPDestroyKey@rsaenh.dll\"\n \"CPSetKeyParam@rsaenh.dll\"\n \"CPGetKeyParam@rsaenh.dll\"\n \"CPExportKey@rsaenh.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00560031-00002916-77B8228D-570786","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"CabCFBC.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"TarCFCD.tmp\" has type \"data\"\n \"CabD368.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"TarD378.tmp\" has type \"data\"\n \"93_171_132_5[1].htm\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"ycan{s}[\n CONST\n :s\n _%#~( !- with unusual entropies 7.87152536973\n 7.72892044874\n 7.93232381042\n 7.87425942184","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RasRpcGetVersion@RASMAN.DLL at 00560031-00002916-77B8228D-570083","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting a value in the registry","description":"\"\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"RasPortListen@RASMAN.DLL at 00560031-00002916-77B8228D-569814","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-77B8228D-666750\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-4660-100-01007E06\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-4660-68-010015C8\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-4660-76-01007C0B\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-9174-68-010015C8\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-9174-100-01007E06\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00560031-00002916-9174-76-01007C0B","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"Z:\\99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabCFBC.tmp\" for deletion\n \"Z:\\99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarCFCD.tmp\" for deletion\n \"Z:\\99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabD368.tmp\" for deletion\n \"Z:\\99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9\" marked \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarD378.tmp\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabCFBC.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarCFCD.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabD368.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarD378.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"System Security","name":"Alters Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10013000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10012000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10011000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10010000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10014000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10002000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10003000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10000000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10001000\"\n \"Explorer.EXE\" wrote bytes \"00\" to virtual address \"0x10006000\"","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"PE claims program is from Thu Jan 1 18:12:16 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/55 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00004695 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00308224 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00668281-00000384)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 308224 bytes to a foreign process \"explorer.exe\" (PID: 00000384)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"System Security","name":"Alters System Certificates Settings","description":"$28","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00560031-00002916-77B8228D-579284\n NtQueryInformationProcess@NTDLL.DLL at 00560031-00002916-77B8228D-666922\n NtQueryVirtualMemory@NTDLL.DLL at 00560031-00002916-77B8228D-670286","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint points to uncommon section","description":".text0","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Modifies auto-execute functionality by setting a value in the registry"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":184,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"55b7343b0e316d216e65c149","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":86,"malware_family":"Trojan.FakeMS","contacted_countries":["CZE"],"submit_name":"wrw.exe","analysis_start_time":"2015-07-28T02:51:12+00:00","indicators_count":{"informative":8,"suspicious":27,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"93.171.132.5","port":743,"protocol":"TCP","country":"Czech Republic","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}],"processes":[{"pid":2916,"ppid":0,"name":"99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9","command_line":"","normalized_path":"","uid":"00560031-00002916","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAJiSURBVFhH7Ze5bsJAEIbzhghBx6PwGggJ4zLQU/AGiI4CiUsIkTScSWwX+D4mnt0s6xO8dtJlpRGLYP1/c1r78vK//iOQiMByuYTT6QTX6xXO53NBo/8/HA4wnU6hVqtB6cCuVisIggDKLNd1Ac8jRKPRKAeBD7Btm+gjSBD44Pt55oHnccMzu90OttstLBYLqNfrCCEGEgfIF/b9uDiC4Hp/f4Pj8UjA5vM5tFotMYgoQLbnaWEaBZcAoPf7/Z7sVVWFyWQCzWazOAQCWJZFHpAFEA0537t3gPV6DcPha2hDGAwGMBqNYDweM4Dn6XgMkOU9FccCRGPrcrkAwsxmMwLxUwtlAbwwGtniTJh/OuA4TqyTNptNFYDnXkfFXZcCUMNUBqDrelmAKuJ2CIDtHICmaaIAJglhuuB4rqnXDjHuMe6pMM4SNHyOpqliAKaZBIgXWlFx27bIIKsIICbOvbfCCFQGqCbOAHAgCbWhaRokdHktxnNO8x3NOc099R4HGg4zVVXEAfBgHCBZcFniVJiJUwBPHMAwDEKe39/FxC3LrApAvY632mNx6r15twoR8J72eDTf0bAnARRFsAYwBTiE8ouN5zpPGCFwnuCLSlG+xIowDpAMeZY4DzkTRnHspgoA6bGabDGs8mi42R6FmZUE0Al5vL/TLZYtTj3/FQD2QmG9/SjfPPRcvFQK8F5wu91IAVIA8z5cKICRMqwZw9AzzXFc+Pz8KF6ECPAXq/C7oN1uQ7fbBVnuQ79PTZLYXgq/c5MkKfytl2m9Xg/QZFmGTqdTPAI/V6rogd/ex25t39gL/fGAj31gAAAAAElFTkSuQmCC"},{"pid":384,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00668281-00000384","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAJiSURBVFhH7Ze5bsJAEIbzhghBx6PwGggJ4zLQU/AGiI4CiUsIkTScSWwX+D4mnt0s6xO8dtJlpRGLYP1/c1r78vK//iOQiMByuYTT6QTX6xXO53NBo/8/HA4wnU6hVqtB6cCuVisIggDKLNd1Ac8jRKPRKAeBD7Btm+gjSBD44Pt55oHnccMzu90OttstLBYLqNfrCCEGEgfIF/b9uDiC4Hp/f4Pj8UjA5vM5tFotMYgoQLbnaWEaBZcAoPf7/Z7sVVWFyWQCzWazOAQCWJZFHpAFEA0537t3gPV6DcPha2hDGAwGMBqNYDweM4Dn6XgMkOU9FccCRGPrcrkAwsxmMwLxUwtlAbwwGtniTJh/OuA4TqyTNptNFYDnXkfFXZcCUMNUBqDrelmAKuJ2CIDtHICmaaIAJglhuuB4rqnXDjHuMe6pMM4SNHyOpqliAKaZBIgXWlFx27bIIKsIICbOvbfCCFQGqCbOAHAgCbWhaRokdHktxnNO8x3NOc099R4HGg4zVVXEAfBgHCBZcFniVJiJUwBPHMAwDEKe39/FxC3LrApAvY632mNx6r15twoR8J72eDTf0bAnARRFsAYwBTiE8ouN5zpPGCFwnuCLSlG+xIowDpAMeZY4DzkTRnHspgoA6bGabDGs8mi42R6FmZUE0Al5vL/TLZYtTj3/FQD2QmG9/SjfPPRcvFQK8F5wu91IAVIA8z5cKICRMqwZw9AzzXFc+Pz8KF6ECPAXq/C7oN1uQ7fbBVnuQ79PTZLYXgq/c5MkKfytl2m9Xg/QZFmGTqdTPAI/V6rogd/ex25t39gL/fGAj31gAAAAAElFTkSuQmCC"}],"all_imported_dlls":["ole32.dll","dnsapi.DLL","EhStorShell.dll","IMM32.dll","IPHLPAPI.DLL","NLAapi.dll","credssp.dll","NSI.dll","ieframe.dll","shell32.dll","CRYPTUI.dll","WINSTA.dll","msxml5.dll","DEVOBJ.dll","rasadhlp.dll","USER32.dll","kernel32.dll","pnidui.dll","ieproxy.dll","ksuser.dll","PortableDeviceApi.dll","rsaenh.dll","MMDevApi.dll","SSPICLI.DLL","srchadmin.dll","WTSAPI32.dll","WINMM.dll","EhStorAPI.dll","rtutils.dll","dhcpcsvc.DLL","ntdll.dll","wercplsupport.dll","Normaliz.dll","wshtcpip.DLL","WINHTTP.dll","iertutil.dll","slc.dll","netutils.dll","VBoxMRXNP.dll","DUser.dll","secur32.dll","GPAPI.dll","DEVRTL.dll","drprov.dll","WSCAPI.dll","FXSRESM.DLL","PortableDeviceTypes.dll","syncui.dll","iphlpapi.DLL","PSAPI.DLL","msi.dll","shacct.dll","gameux.dll","wer.dll","werconcpl.dll","LPK.dll","davclnt.dll","wkscli.dll","MSACM32.dll","Cabinet.dll","winrnr.dll","QAgent.dll","PROPSYS.dll","SHELL32.dll","fxsst.dll","OLEACC.dll","IMM32.DLL","cryptnet.dll","AUDIOSES.DLL","POWRPROF.dll","RPCRT4.dll","BatMeter.dll","actxprxy.dll","dxp.dll","Actioncenter.dll","msvcrt.dll","ATL.DLL","DAVHLPR.dll","npmproxy.dll","hgcpl.dll","StructuredQuery.dll","WINTRUST.dll","USP10.dll","MLANG.dll","wevtapi.dll","SYNCENG.dll","MSCTF.dll","rasman.dll","urlmon.dll","authui.dll","wwanapi.dll","midimap.dll","msiltcfg.dll","gdiplus.dll","wscinterop.dll","CLBCatQ.DLL","GDI32.dll","sechost.dll","EXPLORERFRAME.dll","UIAnimation.dll","QUtil.dll","ehSSO.dll","srvcli.dll","wshqos.dll","KERNELBASE.dll","wininet.dll","WS2_32.dll","wlanutil.dll","AltTab.dll","HID.DLL","RpcRtRemote.dll","nlaapi.dll","dsrole.dll","AVRT.dll","tquery.dll","VERSION.dll","CRYPTBASE.dll","ncrypt.dll","sensapi.dll","WLDAP32.dll","WINNSI.DLL","MSASN1.dll","Wlanapi.dll","CRYPTSP.dll","SAMLIB.dll","ntshrui.dll","cscapi.dll","IconCodecService.dll","Syncreg.dll","RASAPI32.dll","MsftEdit.dll","stobject.dll","SndVolSSO.DLL","XmlLite.dll","tiptsf.dll","pnrpnsp.dll","SETUPAPI.dll","comctl32.dll","ADVAPI32.dll","dhcpcsvc6.DLL","ntlanman.dll","dwmapi.dll","zipfldr.dll","LINKINFO.dll","MPR.dll","es.dll","SXS.DLL","ntmarta.dll","wintrust.dll","wship6.dll","NetworkExplorer.dll","netshell.dll","framedynos.dll","hcproviders.dll","imapi2.dll","CFGMGR32.dll","msls31.dll","CRYPT32.dll","USERENV.dll","bcryptprimitives.dll","SHLWAPI.dll","WININET.dll","apphelp.dll","schannel.DLL","netprofm.dll","Secur32.dll","SyncCenter.dll","DUI70.dll","samcli.dll","wwapi.dll","prnfldr.dll","napinsp.dll","ws2_32.DLL","OLEAUT32.dll","fwpuclnt.dll","mswsock.dll","profapi.dll","wpdshserviceobj.dll","provsvc.dll","shdocvw.dll","WindowsCodecs.dll","FXSAPI.dll","UxTheme.dll","SspiCli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"94308059B57B3142E455B38A6EB92015","sha256":"60716e979221a25343e8e86f724c22a9fad5b224c81d0b02249d779ee03031cc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"93_171_132_5[1].htm","sha256":"a96b478f4629e02587005f7431cbaa0e95fc1e92962bd3734cd2e4983f3c8616","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"CabCFBC.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"CabD368.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"TarCFCD.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"TarD378.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\S9Y0GKU4\\93_171_132_5[1].htm","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]},{"name":"Global\\ce4b1180b0bb52588665f2573b593215","sources":[{"report_type":"sandbox","report_id":"55b7343b0e316d216e65c149"}]}]}},"report_ids":{"sandbox_job_ids":["55b7343b0e316d216e65c149"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 99dbad3d1d10… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 99dbad3d1d10…. Malware family: Trojan.Generic. Threat score 86/100. 24/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 99dbad3d1d10… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 99dbad3d1d10…. Malware family: Trojan.Generic. Threat score 86/100. 24/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/99dbad3d1d100e36424f87d19837a83c3df2444810ccf53a7e7b44e2861b83c9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 99dbad3d1d10… — Score 86/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 99dbad3d1d10…. Malware family: Trojan.Generic. Threat score 86/100. 24/28 AV engines flagged this file. 8 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]