26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9b56cf91316d… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9b56cf91316d…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761"],"about":{"@type":"SoftwareApplication","name":"Credit Note CN-83607.exe","applicationCategory":["peexe","executable"],"identifier":"9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":11,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5d9,"svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")28:T53f,"svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "svchost.exe" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")29:T45b,"svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "svchost.exe" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")2a:T7f0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAWHSURBVFhHtZd9TNVlFMevLrdmzVqBLkkxFKwgdSxarfVP6//W1l/V1mq9uJranOYsk2ajoRYtr4aRiGG1CgsFYhY4QzNeKhga5mukyIsgr/eKXLhw+n3O5fz6mcS9rcV2dp633/l+z/c5z3MffD7n72BShhxKuV8OJ9wn+5PThX5xeobjl+h4vTNelpquc9Xz7lVjnD6e9Wb0LVbJ7p1SdeCgjI2IODDYxH8H0h7SYBHwJfJ9/CL5eelqqX96pUuq6akVOrZ3boRY5TMvSMOzy3WMvpcEccrnp0nhu5tk354iGZXw5CQ+T1wspfMixscQgHVL7S8yNCpSdEeq9k9WVKoHsPVsk3Q0HpdGJ8OCxFQFxIpnL9Q4EDUCw+EhJTE8FJ5YCRZDwuyb+MUK/OFdiTIYHJL8xAUKjCcQgO2nTsuva7P1GwhibJMlwvjH/hxVoO9yhABGvGu2g4DY7tsivjAuWQHJ0IBlOCTFCWkaZOs9D8j5oxF1ZHRECuIi5L0xaEPgq+I9ErwS0DguidDlq0nkJqXLtrkpGgC/Y0aKBi977AnZdusC+Wj2ndr33zRHfV7CIlWgdsUr+o19h2etEYEARfh2dpYsfelFWb1mlVuUbIurxFszU+T92fM1MAQANUD/nLvdPhm0HmkUxs6eOC6Hlq+Tjbcn67deIw5EjADbAIk3MtcpCbzf/95fBPgYFSBiZCDhDY4qrHvHGcczD5HN8RGzb7NmJQnGmnJ/nhxrbNKsIYExtj3vA8kv2KHjdi6NzTV+w/IVkrlymeCx11YtU7M+czZvbZv/tvo7aT73uxxrOuoSqamrVuDDRw7p2D/eDTbR0dkuXT2dgg90X9KK7r3Yof2evu6IDQWkYlay/LFqvc6bsaa/N+iuveC0IYRdaGuRzrb22AgQyAtoQW38xKdf6sXU1fCTkm0L9l5FxAhBliT4nrHxIzm5CAbiBSUQ4wShfWZXod6Kg539CsAYRFSt/h7t4weCfToWCgy4PqYtABwz6WkbCZ2rrZOa1EVysvYHDQw4xhoDg4ARClwe0OxHrwxG3wLL3LIlQ9tbggIUHAtJlfNjw6mxbFnHPATIHPO2uZzoR1WAIJgVoGVnwU1SCDQ/+IgrrX3HPBlrDMcDSva0Y1bAC07b+ngL+LVvuhZh6FJknowBsuwBpA2oFqBzHcekgLeQvMVD2/aYbSqcEi+5vhulMzTi7rtXdoCRXS0UVg+JqFsAkMlJW4vRU1CAdIWDUjpjppROvV4VMGA7fihhwErEIQD4+O/B5BwM3Ht2aZsaSFv18KMSbm+RseCIkuDCYd4yVT9uEOB3BgIx1QCB7NhY4dG34uMW3OWbosqQOT9QW1LSXLl5hADmVYAxfaTEcgwJagWExwhmJD5bmKH3gBUVc1VvZmtNcDz7nScDJE013gUQ6JYYCdjZxausFI+zpxiSb546XcGNwI9lX6gCOdPidA5fl58np8v3qn3y5PNS9vJafaDwyIlahMhk22AFZGQ2JiTKQE+zlDz+nL6KuAl5M5A1AJDqO9Usm3y3SOa0G5QAijbU1uj8yOhwbAQ0EO86hwzy6S3mVDuPDshwChhnXkk60rPHKDQWDmjRQartfIs+5S62npGa3PzYCFC9VkjsJRlU5mzXjOy5bQUFuGWGvLQBJ1OTnLXE5IXNezKmLeADAuzfslWqdxZKyetZWmgAGpAXAFDrA45BFkDWY/ZAjUoA+QlWX1QkFWs26CPi1etu1jFX6vH9VtmdtoEbiHnvy/hfEYDxeqeQKCi8FZn7D4cD7JXaCzwRqHc+qgImIQDnyitdcLJnjGD2/8HfM46lH5UAwQ3Iio699MpqskfLdiJCUQn8drJJMF6wvG7dPi/d/2jEikqAs/t/2p+MynTGr7G2rAAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790473703384,"unified_at":"2026-09-27T01:48:23.384Z","metadata":{"hashes":{"sha256":"9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761","sha1":"e41c54286ede8f5545fd1fcf1b63f64b46fecaf2","md5":"b54631341b8d60f764efa49208f31a4b","sha512":"19a823e5ff2d5b74b7da9c7b843674f4fc792a7bbe9483c9f62db99cedda3b194bacf0159793b0691cb845b895e7addfcbfc48a62ae0b19b82b7f9b555102456","ssdeep":"768:fGNS6/+j3xqhksVo5HdDnEH+QvZ50xuDajbleHq:8SY+7xq2wo5HdDnEeQvZ50QDajbsHq","ssdeep_chunks":["768:fGNS6/+","768:GNS6/+j","768:NS6/+j3","768:S6/+j3x","768:6/+j3xq","768:/+j3xqh","768:+j3xqhk","768:j3xqhks","768:3xqhksV","768:xqhksVo","768:qhksVo5","768:hksVo5H","768:ksVo5Hd","768:sVo5HdD","768:Vo5HdDn","768:o5HdDnE","768:5HdDnEH","768:HdDnEH+","768:dDnEH+Q","768:DnEH+Qv","768:nEH+QvZ","768:EH+QvZ5","768:H+QvZ50","768:+QvZ50x","768:QvZ50xu","768:vZ50xuD","768:Z50xuDa","768:50xuDaj","768:0xuDajb","768:xuDajbl","768:uDajble","768:DajbleH","768:ajbleHq","1536:fGNS6/+","1536:GNS6/+j","1536:NS6/+j3","1536:S6/+j3x","1536:6/+j3xq","1536:/+j3xqh","1536:+j3xqhk","1536:j3xqhks","1536:3xqhksV","1536:xqhksVo","1536:qhksVo5","1536:hksVo5H","1536:ksVo5Hd","1536:sVo5HdD","1536:Vo5HdDn","1536:o5HdDnE","1536:5HdDnEH","1536:HdDnEH+","1536:dDnEH+Q","1536:DnEH+Qv","1536:nEH+QvZ","1536:EH+QvZ5","1536:H+QvZ50","1536:+QvZ50x","1536:QvZ50xu","1536:vZ50xuD","1536:Z50xuDa","1536:50xuDaj","1536:0xuDajb","1536:xuDajbl","1536:uDajble","1536:DajbleH","1536:ajbleHq","768:8SY+7xq","768:SY+7xq2","768:Y+7xq2w","768:+7xq2wo","768:7xq2wo5","768:xq2wo5H","768:q2wo5Hd","768:2wo5HdD","768:wo5HdDn","768:5HdDnEe","768:HdDnEeQ","768:dDnEeQv","768:DnEeQvZ","768:nEeQvZ5","768:EeQvZ50","768:eQvZ50Q","768:QvZ50QD","768:vZ50QDa","768:Z50QDaj","768:50QDajb","768:0QDajbs","768:QDajbsH","768:DajbsHq"],"imphash":"5e135903af2c6ca94a5b0223af75dd7a"},"file_info":{"file_name":"Credit Note CN-83607.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":34304,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297249000,"last_seen":1677379881000,"last_multi_scan":1677379881000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":20,"malicious_count":11,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Yarwi.Y.2746","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2820623","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.LLKM-8323","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2820623 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Waski.Z trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d4ee51 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.Win32.Upatre.ffey","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.xk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Upatre.efguha","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Upatre-SQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_UP.FF6B08CD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_UP.FF6B08CD","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dropper.RM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanDownloader.Upatre","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Adware.BetterSurf.Win32.10855","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\source\\1245\\main.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"562a3e820e316dc35c33c808"},{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcess\n TerminateProcess\n UnhandledExceptionFilter","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"562a3e820e316dc35c33c808"},{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/55 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"562a3e820e316dc35c33c808"},{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"myip.dnsomatic.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"67.215.92.215:80\"\n \"197.149.90.166:12280\"\n \"184.51.147.65:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nAccept: text/*, application/*\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36\nHost: myip.dnsomatic.com\nCache-Control: no-cache\"\n \"GET /23Q77/j8PFgIbH7E/0/61-SP1/0/FDMBEFJBMKBEMM HTTP/1.1\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36\nHost: 197.149.90.166:12280\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"USER32.DLL\" at base 76E80000\n \"\" loaded module \"NTDLL.DLL\" at base 77450000\n \"\" loaded module \"KERNEL32.DLL\" at base 76150000\n \"\" loaded module \"C:\\WINDOWS\\SYSTEM32\\APPHELP.DLL\" at base 748B0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"svchost.exe\" (UID: 00179531-00001900)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"myip_dnsomatic_com[1].htm\" has type \"ASCII text, with no line terminators\"\n \"CabEFD4.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"TarEFD5.tmp\" has type \"data\"\n \"SCHEDLGU.TXT\" has type \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\"\n \"setupact.log\" has type \"ASCII text, with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\", Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\system32\\svchost.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Installation/Persistance","name":"File system monitor detected changes at critical system location","description":"Found a system modification for file \"SCHEDLGU.TXT\" (Context: \"C:\\Windows\\Tasks\\SCHEDLGU.TXT\", Type: \"Little-endian UTF-16 Unicode text, with CRLF, CR line terminators\", Additional Info: Existing file modified)\n Found a system modification for file \"setupact.log\" (Context: \"C:\\Windows\\setupact.log\", Type: \"ASCII text, with CRLF line terminators\", Additional Info: Existing file modified)","origin":"Binary File","relevance":5,"id":"binary-13","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"209.126.97.199\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 67.215.92.215 on port 80 is sent without HTTP header\n TCP traffic to 184.51.147.65 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.99 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"svchost.exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"svchost.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"CabEFD4.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"","origin":"Binary File","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$28","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"svchost.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"svchost.exe\" (PID: 00001900)\n \"\" wrote 52 bytes to a foreign process \"svchost.exe\" (PID: 00001900)\n \"\" wrote 4 bytes to a foreign process \"svchost.exe\" (PID: 00001900)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"myip.dnsomatic.com\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 197.149.90.166 on port 12280","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"svchost.exe\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$29","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlGetVersion@NTDLL.DLL at 00157250-00002040-2804-15-00401680\n Found reference to API NtQueueApcThread@NTDLL.DLL at 00157250-00002040-2804-22-00402AF0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"RtlGetVersion@NTDLL.DLL at 00157250-00002040-2804-15-00401680","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"dkPKMLPu.exe\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00157250-00002040-2804-11-004027E0\n FindResourceW@KERNEL32.DLL at 00157250-00002040-2804-13-00402720\n FindResourceW@KERNEL32.DLL at 00157250-00002040-2804-12-00402780","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 77.72.169.212\" with description \"Payload with 20 bytes: 00010000B2BE0200A6A0FEFFA61240FD14AC42FD\"\n \"UDP connection to 77.72.169.213\" with description \"Payload with 20 bytes: 00010000E90303000B7EFEFF0B97FDFCE294FEFC\"","origin":"Network Traffic","relevance":7,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"homebast.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows\"\n \"dkPKMLPu.exe\" has type \"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"vncP\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00157250-00002040-61730-34-00402834\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00157250-00002040-2804-9-00402870","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"2/55 Antivirus vendors marked dropped file \"homebast.exe\" as malicious (classified as \"HW32.Packed\" with 3% detection rate)\n 2/55 Antivirus vendors marked dropped file \"dkPKMLPu.exe\" as malicious (classified as \"HW32.Packed\" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"homebast.exe\" wrote 512 bytes starting with PE header signature to file \"C:\\Windows\\dkPKMLPu.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"ZwQuerySystemInformation@NTDLL.DLL at 00157250-00002040-2804-24-00402950\n NtQueueApcThread@NTDLL.DLL at 00157250-00002040-2804-22-00402AF0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"File system monitor detected a system task modification"}],"sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":79,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":10,"dns_resolutions_count":2,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":null,"sample_flags":["Sample not shared","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"562a3e820e316dc35c33c808","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"suspicious","threat_score":8,"malware_family":"Trojan.A1796E41C","submit_name":"8f1b70c02608c0392648cf3211668ee40788bf28a5e3454bbe09a21dfacdb2ca.doc","analysis_start_time":"2015-10-23T09:05:26+00:00","indicators_count":{"informative":1,"suspicious":1,"malicious":1},"tags":["Sample not shared"],"is_in_unified_schema":true},{"id":"562a3dbfdfd45af0db6f3f5d","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.A1796E41C","contacted_countries":["NGA","USA"],"submit_name":"Credit Note CN-83607.exe","analysis_start_time":"2015-10-23T09:12:30+00:00","indicators_count":{"informative":8,"suspicious":13,"malicious":9},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"562a23350e316d8e16191624","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.A1796E41C","contacted_countries":["CHL","IRN","NGA","NLD","POL","USA"],"submit_name":"Credit Note CN-83607.exe","analysis_start_time":"2015-10-23T09:30:03+00:00","indicators_count":{"informative":9,"suspicious":22,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"67.215.92.215","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"197.149.90.166","port":12280,"protocol":"TCP","country":"Nigeria","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"address":"184.51.147.65","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"address":"197.149.90.166","port":12283,"protocol":"TCP","country":"Nigeria","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"109.199.11.51","port":443,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"4.53.166.172","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"77.72.169.212","port":3478,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"77.72.169.213","port":3479,"protocol":"UDP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"201.187.95.250","port":443,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"address":"185.46.217.70","port":443,"protocol":"TCP","country":"Iran (ISLAMIC Republic Of)","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}],"dns_resolutions":[{"domain":"myip.dnsomatic.com","address":"67.215.92.215","country":"United States","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"domain":"stun.voxgratia.org","address":"77.72.169.211","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}],"http_requests":[{"host":"myip.dnsomatic.com","host_ip":"67.215.92.215:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"host":"","host_ip":"192.168.56.20:49164","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"host":"197.149.90.166:12280","host_ip":"197.149.90.166:12280","url":"/23Q77/j8PFgIbH7E/0/61-SP1/0/FDMBEFJBMKBEMM","method":"GET","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"host":"197.149.90.166:12283","host_ip":"197.149.90.166:12283","url":"/23Q77/1C18ywPi27/0/61-SP1/0/FDMBEFJBMKBEMM","method":"GET","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"host":"197.149.90.166:12283","host_ip":"197.149.90.166:12283","url":"/23Q77/1C18ywPi27/41/5/1/FDMBEFJBMKBEMM","method":"GET","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}],"processes":[{"pid":3852,"ppid":0,"name":"Credit_Note_CN_83607.exe","command_line":"","normalized_path":"","uid":"00132453-00003852","icon":"$2a"},{"pid":4032,"ppid":0,"name":"svchost.exe","command_line":"","normalized_path":"","uid":"00140062-00004032"},{"pid":2040,"ppid":0,"name":"homebast.exe","command_line":"","normalized_path":"","uid":"00157250-00002040"},{"pid":2348,"ppid":0,"name":"dkPKMLPu.exe","command_line":"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\homebast.exe","normalized_path":"","uid":"00165687-00002348"}],"all_imported_dlls":["user32.dll","sechost.dll","imm32.dll","gdi32.dll","lpk.dll","rpcrt4.dll","version.dll","kernel32.dll","KernelBase.dll","ole32.dll","oleaut32.dll","ntdll.dll","usp10.dll","msvcrt.dll","advapi32.dll","msctf.dll","iphlpapi.DLL","fwpuclnt.dll","MSCTF.dll","LPK.dll","VERSION.dll","apphelp.dll","comctl32.dll","rtutils.dll","Cabinet.dll","VERSION.DLL","PSAPI.DLL","RPCRT4.dll","RASAPI32.dll","sensapi.dll","USERENV.dll","schannel.DLL","bcryptprimitives.dll","winrnr.dll","wshtcpip.dll","credssp.dll","GPAPI.dll","CFGMGR32.dll","IMM32.DLL","ntmarta.dll","napinsp.dll","KERNELBASE.dll","CRYPTBASE.dll","DEVOBJ.dll","Normaliz.dll","wininet.dll","rasadhlp.dll","pnrpnsp.dll","SHLWAPI.dll","rsaenh.dll","GDI32.dll","OLEAUT32.dll","wship6.dll","ncrypt.dll","OLEAUT32.DLL","CRYPTSP.dll","USP10.dll","OLE32.DLL","USER32.DLL","ws2_32.DLL","mswsock.dll","cryptnet.dll","DEVRTL.dll","SETUPAPI.dll","SHELL32.dll","NLAapi.dll","rasman.dll","urlmon.dll","secur32.dll","USER32.dll","ADVAPI32.dll","dnsapi.DLL","CRYPT32.dll","wintrust.dll","profapi.dll","SspiCli.dll","COMDLG32.DLL","COMCTL32.DLL","ADVAPI32.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"myip_dnsomatic_com[1].htm","sha256":"a236775d29d4b092b227026c4c42a3f152a4dd44862f4d3786a0c97190f60609","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"CabEFD4.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"name":"TarEFD5.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"name":"SCHEDLGU.TXT","sha256":"99a6d02bd924239152e4bbba82d26ec8423cb97af3d29b9b0a76c33b0251e98e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"name":"setupact.log","sha256":"66eb51c62e5147e614f00e63293e9cc9e8f3ce0c6fd60eef61a7caab3cdaf992","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"name":"homebast.exe","sha256":"3ef096c54d28efc1eb9281a0d1730a7b7f7d177d8984cc8e4a22d0981c130ff3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"dkPKMLPu.exe","sha256":"3ef096c54d28efc1eb9281a0d1730a7b7f7d177d8984cc8e4a22d0981c130ff3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"asta14[1].zip","sha256":"272d6fb757c55c47efee3f2d44227e0ae12a7ca07c4ebaf5f0a45875d3ced0bb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Cab4368.tmp","sha256":"3d5564a752a73b7e4b044144f93c4a649ff37a6a6ab9a3a745975fe4eb1f514c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Tar4369.tmp","sha256":"da1df45dcd494958f8cc5feabb934f1e39466654d674012450ae9e3160733792","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}],"files_written":[{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%WINDIR%\\system32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\YB8HQDNM\\myip_dnsomatic_com[1].htm","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\E9S7QCHY\\myip_dnsomatic_com[1].htm","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\D0YDZTO5\\asta14[1].zip","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%TEMP%\\homebast.exe","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"%WINDIR%\\dkPKMLPu.exe","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"path":"pipe\\47e489b8f2a1c668c9126785e4f8a9f3","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SVCHOST_RASMANCS\\","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\SVCHOST_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"562a3dbfdfd45af0db6f3f5d"},{"report_type":"sandbox","report_id":"562a23350e316d8e16191624"}]}]}},"report_ids":{"sandbox_job_ids":["562a3dbfdfd45af0db6f3f5d","562a23350e316d8e16191624","562a3e820e316dc35c33c808"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9b56cf91316d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9b56cf91316d…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9b56cf91316d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9b56cf91316d…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9b56cf91316d423927cc4e293bde8b1659d97c712165119cba49a300427a1761"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9b56cf91316d… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9b56cf91316d…. Malware family: Trojan.Generic. Threat score 100/100. 23/28 AV engines flagged this file. 11 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]