26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T442,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample 9b7a7316f4f5… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample 9b7a7316f4f5…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","keywords":["Clean","malware analysis","sandbox report","threat intelligence","9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355"],"about":{"@type":"SoftwareApplication","name":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","applicationCategory":["peexe","executable"],"identifier":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":25},"behavioralIndicators":{"malicious":0,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T20e0,Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThread"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventW"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringW"; Source: "sample.bin"), Found reference to API (Indicator: "OpenThread"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SearchPathA"; Source: "sample.bin"), Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "OutputDebugStringA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "GetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleInformation"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseMutex"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "ReportEventW"; Source: "sample.bin"), Found reference to API (Indicator: "RegisterEventSourceW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitializeEx"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "DeregisterEventSource"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameExW"; Source: "sample.bin"), Found reference to API (Indicator: "StartServiceCtrlDispatcherW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "RegConnectRegistryW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "ReadProcessMemory"; Source: "sample.bin"), Found reference to API (Indicator: "GetIpAddrTable"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetThreadPriority"; Source: "sample.bin"), Found reference to API (Indicator: "WSAIoctl"; Source: "sample.bin"), Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFullPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SetDllDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "SetServiceStatus"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin")28:T43b,Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t", Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0", Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_08-31-2010.crl0z", Pattern match: "crl.microsoft.com/pki/crl/products/miccodsigpca_2010-07-06.crl0z", Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z", Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_2010-07-06.crt0", Pattern match: "http://www.microsoft.com/pki/certs/miccodsigpca_08-31-2010.crt0", Pattern match: "http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0", Pattern match: "http://www.microsoft.com/pki/certs/microsofttimestamppca.crt0", Pattern match: "http://www.microsoft.com/sql0", Pattern match: "crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0z", Pattern match: "www.microsoft.com/pki/docs/cps/default.htm0@", Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt0", Pattern match: "crl.microsoft.com/pki/crl/products/microsofttimestamppca.crl0x"29:Tf38,Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-154-01037630 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-154-01037630 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-161-01037700 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-161-01037700 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-163-01039660 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-163-01039660 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-190-0103AD60 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-190-0103AD60 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-191-010390F0 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-191-010390F0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-204-0103AC10 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-204-0103AC10 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-248-01039410 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-248-01039410 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-253-01038FA0 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-253-01038FA0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-258-01038E50 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-258-01038E50 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-265-010388A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-265-010388A0 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-268-01037540 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-268-01037540 Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 38932-272-01037480 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-272-01037480 Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 38932-282-01037224 Assembly shows XOR instruction xor bl dl in Stream UID: 38932-372-01035508 Assembly shows XOR instruction xor al D2h in Stream UID: 38932-384-01035478 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-433-01034EF0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-433-01034EF0 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-436-010306C0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-436-010306C0 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-440-0102F160 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-440-0102F160 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-442-01030C80 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-442-01030C80 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-450-01030070 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-450-01030070 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-456-01034830 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-456-01034830 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-457-01034780 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-457-01034780 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-466-01033E20 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-466-01033E20 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-467-01033CB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-467-01033CB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 38932-471-01033910 Assembly shows XOR instruction xor ecx ebp in Stream UID: 38932-471-010339102a:T43f,Sleep@KERNEL32.dll at 38932-30-01035846 WaitForSingleObject@KERNEL32.dll at 38932-186-0103B018 WaitForSingleObject@KERNEL32.dll at 38932-191-010390F0 WaitForSingleObject@KERNEL32.dll at 38932-248-01039410 WaitForSingleObject@KERNEL32.dll at 38932-253-01038FA0 WaitForSingleObject@KERNEL32.dll at 38932-258-01038E50 Sleep@KERNEL32.dll at 38932-376-010354D8 WaitForMultipleObjects@KERNEL32.dll at 38932-403-01035394 WaitForSingleObject@KERNEL32.dll at 38932-409-0103534C WaitForMultipleObjects@KERNEL32.dll at 38932-588-0102CB00 Sleep@KERNEL32.dll at 38932-591-0102A3B0 WaitForSingleObject@KERNEL32.dll at 38932-592-0102A080 WaitForSingleObject@KERNEL32.dll at 38932-608-01028BE0 WaitForSingleObject@KERNEL32.dll at 38932-612-01029230 WaitForMultipleObjects@KERNEL32.dll at 38932-659-0102C330 WaitForSingleObject@KERNEL32.dll at 38932-661-0102C310 WaitForSingleObject@KERNEL32.dll at 38932-677-0102ABA0 WaitForMultipleObjects@KERNEL32.dll at 38932-699-01029AD0 WaitForSingleObject@KERNEL32.dll at 38932-708-010292B0 WaitForSingleObject@KERNEL32.dll at 38932-908-010208302b:Tab6,"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\BIDINTERFACE\LOADER"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\MICROSOFT SQL SERVER\100"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: ""; Value: "")2c:Te4b,"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "9B7A7316F4F508C156EBA259632C82287E105249F31FFE998DB8005D5C912355"; Value: "") "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "")2d:Td01,"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe.Local\" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\MSVCR80.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\FLTLIB.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\MSVCP140.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\VCRUNTIME140.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\ucrtbase.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll"2e:Tcf7,"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\FLTLIB.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\MSVCP140.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\ucrtbase.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"2f:T4f1,Found string "GetDllDirectoryW" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: KERNEL32.DLL) Found string "SetDllDirectoryW" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: KERNEL32.DLL) Found string "DmpGetClientExport" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: 9B7A7316F4F508C156EBA259632C82287E105249F31FFE998DB8005D5C912355.EXE) Found string "IsWow64Process" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: KERNELBASE.DLL) Found string "RegDeleteKeyExW" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: ADVAPI32.DLL) Found string "CoUninitialize" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: OLE32.DLL) Found string "CoInitializeEx" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: OLE32.DLL) Found string "DmpRemoteDumpRequest" (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355, API is part of module: 9B7A7316F4F508C156EBA259632C82287E105249F31FFE998DB8005D5C912355.EXE)30:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"clean","threat_score":0,"unified_at_epoch_ms":1792915021428,"unified_at":"2026-10-25T07:57:01.428Z","metadata":{"hashes":{"sha256":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","sha1":"ab215e5584c4d3749a8df5df63cf9dc5acaa91c7","md5":"7619dd0677dea1ea5bf4eb8b0bc03212","sha512":"d71e3011497ef91cf0fba7171b74665d7594cb0488938a442a05067b82d4536e31656eacab259a4327da460f70a057c8fbe37deea2c4094fee2d77bf1ac2c35a","ssdeep":"6144:mUwI7e3WUGVaWMWhX/V7wFvRzepo8yKdyKVyKJAjBy:/e0a9W1/V7K527yKdyKVyK4k","ssdeep_chunks":["6144:mUwI7e3","6144:UwI7e3W","6144:wI7e3WU","6144:I7e3WUG","6144:7e3WUGV","6144:e3WUGVa","6144:3WUGVaW","6144:WUGVaWM","6144:UGVaWMW","6144:GVaWMWh","6144:VaWMWhX","6144:aWMWhX/","6144:WMWhX/V","6144:MWhX/V7","6144:WhX/V7w","6144:hX/V7wF","6144:X/V7wFv","6144:/V7wFvR","6144:V7wFvRz","6144:7wFvRze","6144:wFvRzep","6144:FvRzepo","6144:vRzepo8","6144:Rzepo8y","6144:zepo8yK","6144:epo8yKd","6144:po8yKdy","6144:o8yKdyK","6144:8yKdyKV","6144:yKdyKVy","6144:KdyKVyK","6144:dyKVyKJ","6144:yKVyKJA","6144:KVyKJAj","6144:VyKJAjB","6144:yKJAjBy","12288:mUwI7e3","12288:UwI7e3W","12288:wI7e3WU","12288:I7e3WUG","12288:7e3WUGV","12288:e3WUGVa","12288:3WUGVaW","12288:WUGVaWM","12288:UGVaWMW","12288:GVaWMWh","12288:VaWMWhX","12288:aWMWhX/","12288:WMWhX/V","12288:MWhX/V7","12288:WhX/V7w","12288:hX/V7wF","12288:X/V7wFv","12288:/V7wFvR","12288:V7wFvRz","12288:7wFvRze","12288:wFvRzep","12288:FvRzepo","12288:vRzepo8","12288:Rzepo8y","12288:zepo8yK","12288:epo8yKd","12288:po8yKdy","12288:o8yKdyK","12288:8yKdyKV","12288:yKdyKVy","12288:KdyKVyK","12288:dyKVyKJ","12288:yKVyKJA","12288:KVyKJAj","12288:VyKJAjB","12288:yKJAjBy","6144:/e0a9W1","6144:e0a9W1/","6144:0a9W1/V","6144:a9W1/V7","6144:9W1/V7K","6144:W1/V7K5","6144:1/V7K52","6144:/V7K527","6144:V7K527y","6144:7K527yK","6144:K527yKd","6144:527yKdy","6144:27yKdyK","6144:7yKdyKV","6144:dyKVyK4","6144:yKVyK4k"],"imphash":"165384641f90204ed0b43dc1a1ed9274"},"file_info":{"file_name":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","file_type":["peexe","executable"],"file_type_id":"exe","file_size":277464,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792914942000,"last_seen":1792914942000,"last_multi_scan":1792914942000}},"detections":{"summary":{"verdict":"clean","score":0,"tags":["chir","floxif"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":37},"sandbox_signatures":{"informative_count":99,"suspicious_count":10,"malicious_count":0,"total":109},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"whitelisted","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"suspicious","value":"Able to check if a debugger is running"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Able to retrieve NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"suspicious","value":"Contains ability to read the host's architecture"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains ability to query the machine version"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"suspicious","value":"Contains ability to modify services"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Contains ability to modify processes thread functionality"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"suspicious","value":"Contains ability to terminate a process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Contains ability to download files from the internet"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\MSSQL$%s\\sql\\query, Found string - \\\\.\\pipe\\$$\\, Found string - \\\\.\\pipe\\sql\\query","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Microsoft SQL Server\\100\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Microsoft SQL Server\\90\" in Source: sample.bin, \"6SOFTWARE\\Microsoft\\\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\BidInterface\\Loader\" in Source: sample.bin, \"*** [HKLM\\\" in Source: sample.bin, \"Software\\Microsoft\\WinFS\" in Source: sample.bin, \"SOFTWARE\\Microsoft\\Microsoft SQL Server\\100\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in \"sample.bin\", Found registry modification API: \"RegConnectRegistryW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartServiceCtrlDispatcher\"; Source: \"sample.bin\"), Found reference to API \"StartServiceCtrlDispatcherW\" (Indicator: \"StartService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-209","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"SQLBrowser.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \" getaddrinfo: %ls\n\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\"), Found reference to API \" getaddrinfo error, %d{WINERR}.\n\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\"), Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-739","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1680","id":"string-998","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"sample.bin\", Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \" socket contexts\n\" (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \" no valid socket contexts\n\" (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \"Refreshing socket for SSRP\n\" (Indicator: \" socket \"; Source: \"sample.bin\"), Found reference to API \" %d{WINERR} Shutdown IO Context\n\" (Indicator: \" shutdown \"; Source: \"sample.bin\"), Found reference to API \" creating an event to signal the update thread about service shutdown : %d{WINERR}\n\" (Indicator: \" shutdown \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"\n Failed to get function pointers: %d{WINERR}\n\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-601","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"\n Failed to get function pointers: %d{WINERR}\n\" (Indicator: \"WSASend\"; Source: \"sample.bin\"), Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"sample.bin\"), Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1095","id":"string-228","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\\\.\\pipe\\sql\\query\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-735","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-736","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-118","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-107","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryInfoKeyW\" in \"sample.bin\", Found registry query API: \"RegNotifyChangeKeyValue\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \" GetComputerNameEx: %d{WINERR}\n\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\"), Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\"), Found reference to API \" GetComputerNameEx: %d{WINERR}\n\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\"), Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.003","id":"string-309","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\"), Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\"), Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"RegisterServiceCtrlHandlerExW\" (Indicator: \"RegisterServiceCtrlHandler\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 38932-397-010353DC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 257833; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 260827; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 260945; code bytes = 30d0\n Found XOR loop in file \"sample.bin\" at offset 132164; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 132169; code bytes = 33c1\n Found XOR loop in file \"sample.bin\" at offset 260810; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 260906; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 262980; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"IsWow64Process\" with parameter \"2960\" - (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"RtlGetVersion\" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.dll at 38932-186-0103B018\n GetTickCount@KERNEL32.dll at 38932-314-010370A4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.dll at 38932-384-01035478\n GetDriveTypeA@KERNEL32.dll at 38932-749-01027FC0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 38932-312-010370BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 38932-312-010370BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.dll at 38932-378-010354C0\n GetVersion@KERNEL32.dll at 38932-394-01035400\n GetVersionExW@KERNEL32.dll at 38932-592-0102A080\n GetVersion@KERNEL32.dll at 38932-746-010277D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.dll at 38932-124-0103C262\n GetSystemInfo@KERNEL32.dll at 38932-267-01037D60","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.dll at 38932-303-01037128","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" queried token user identity (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/24 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00002960)\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00002960)\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00002960)\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00002960)\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" called \"GetProcAddress\" with a parameter DecodePointer (UID: 00000000-00002960)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 38932-267-01037D60\n LoadLibraryW@KERNEL32.dll at 38932-380-010354A8\n LoadLibraryA@KERNEL32.dll at 38932-391-01035424\n LoadLibraryW@KERNEL32.dll at 38932-433-01034EF0\n LoadLibraryA@KERNEL32.dll at 38932-478-0102DC20\n LoadLibraryW@KERNEL32.dll at 38932-704-010296A0\n LoadLibraryA@KERNEL32.dll at 38932-753-01027D30\n LoadLibraryA@KERNEL32.dll at 38932-1103-01036C76","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" contains export function called \"DmpGetClientExport\" at ordinal 1\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" contains export function called \"DmpRemoteDumpRequest\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 767B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f43076@RPCRT4.dll\"\n \"1800190068e8426d@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8426d@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f426d@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has an writable section named \".data\"\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has an writable section named \".sdbid\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" file has an entrypoint instructions - \"call\t0x1035d79,jmp\t0x1035587,int3\t,int3\t,int3\t,int3\t,int3\t,cmp\tecx, dword ptr [0x103e010],jne\t0x103585f,repz ret\t,jmp\t0x1035e12,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tdword ptr [0x1001288],int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tdword ptr [0x1001284],int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tdword ptr [0x1001280],int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tdword ptr [0x1001248],int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,jmp\tdword ptr [0x1001244],int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Sample shows a variety of benign indicators","description":"The input file/all extracted files were not detected as malicious and the input file is signed with a validated certificate","origin":"Indicator Combinations","relevance":10,"id":"summary-6","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 83:63:88:75:11:B4:83:5B:79:C3:83:EC:F0:6F:C0:55:B5:83:92:55; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Time-Stamp PCA, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 21:1C:1B:A9:C4:31:57:D5:D0:42:93:E5:56:9D:51:F3:C2:40:ED:C0; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 3C:AF:9B:A2:DB:55:70:CA:F7:69:42:FF:99:10:1B:99:38:88:E2:57; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Root Certificate Authority, DC=microsoft, DC=com\" (SHA1: 37:5F:CB:82:5C:3D:C3:75:2A:02:E3:4E:B7:09:93:B4:99:71:91:EF; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" trying to access non-existent file \"C:\\9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe.Local\\\"\n \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe\" trying to access non-existent file \"C:\\9B7A7316F4F508C156EBA259632C82287E105249F31FFE998DB8005D5C912355.EXE.LOCAL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExW\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: 9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.dll at 38932-310-010370D4\n OutputDebugStringA@KERNEL32.dll at 38932-382-01035490\n OutputDebugStringW@KERNEL32.dll at 38932-396-010353E8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify processes thread functionality","description":"OpenThread@KERNEL32.dll at 38932-370-01035520\n OpenThread@KERNEL32.dll at 38932-586-0102CEB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-129","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"General","name":"Contains ability to modify services","description":"StartServiceCtrlDispatcherW@ADVAPI32.dll at 38932-421-010352BC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543.003","relevance":3,"id":"stream-84","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains ability to download files from the internet","description":"WSARecvFrom@WS2_32.dll at 38932-323-0103603C\n WSARecvFrom@WS2_32.dll at 38932-589-0102AA50","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"WSASocketW@WS2_32.dll at 38932-331-01035FDC\n WSASocketW@WS2_32.dll at 38932-592-0102A080","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read the host's architecture","description":"GetEnvironmentVariableW@KERNEL32.dll at 38932-308-010370EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":3,"id":"stream-111","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.dll at 38932-121-0103C286\n GetModuleFileNameW@KERNEL32.dll at 38932-265-010388A0\n GetModuleFileNameA@KERNEL32.dll at 38932-383-01035484\n GetModuleFileNameA@KERNEL32.dll at 38932-747-010280A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"TerminateProcess@KERNEL32.dll at 38932-311-010370C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegEnumKeyExW\n StartServiceCtrlDispatcherW\n RegOpenKeyExA\n RegCloseKey\n RegDeleteKeyW\n RegOpenKeyExW\n RegCreateKeyExW\n GetModuleFileNameA\n OutputDebugStringW\n TerminateProcess\n Sleep\n GetComputerNameW\n CreateThread\n GetSystemInfo\n ReadProcessMemory\n LoadLibraryA\n GetModuleHandleW\n CreateProcessW\n OutputDebugStringA\n GetModuleFileNameW\n GetVersionExW\n GetProcAddress\n GetDriveTypeA\n UnhandledExceptionFilter\n GetComputerNameExW\n GetSystemDirectoryW\n LoadLibraryW\n GetSystemDirectoryA\n GetTickCount\n GetStartupInfoW\n IsDebuggerPresent\n WSAStartup\n closesocket\n WSASocketW\n bind\n WSASendTo","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355\" has a section named \".sdbid\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]}],"intel_graph":{"map":{"File:9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355":{"type":"File","value":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}},"chains":[{"id":"1563823361231420975","root":"File:9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","edges":[],"verdict":{"verdict":"likely_benign","verdict_source":"observed prevalence","reasons":["File has very high prevalence"]}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":42,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["chir","floxif"],"sandbox_reports":[{"id":"6addb5fdfb0d44569f0eb439","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","submit_name":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","analysis_start_time":"2026-10-25T07:55:42+00:00","indicators_count":{"informative":99,"suspicious":14,"malicious":0},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}],"processes":[{"pid":2960,"ppid":0,"name":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe","command_line":"","sha256":"9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355","normalized_path":"C:\\9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355.exe","uid":"00000000-00002960","icon":"$30"}],"all_imported_dlls":["api-ms-win-crt-environment-l1-1-0.dll","kernel32.dll","KernelBase.dll","nsi.dll","msvcr80.dll","psapi.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","VxSSL32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-utility-l1-1-0.dll","ntdll.dll","sechost.dll","ws2_32.dll","gdi32.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-core-file-l1-2-0.dll","msctf.dll","fltLib.dll","user32.dll","lpk.dll","usp10.dll","api-ms-win-crt-heap-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","imm32.dll","ole32.dll","msvcrt.dll","rpcrt4.dll","vcruntime140.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","oleaut32.dll","shlwapi.dll","msvcp140.dll","ucrtbase.dll","advapi32.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-time-l1-1-0.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6addb5fdfb0d44569f0eb439"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6addb5fdfb0d44569f0eb439"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Clean Sample 9b7a7316f4f5… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample 9b7a7316f4f5…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355"}],["$","meta","4",{"property":"og:title","content":"Clean Sample 9b7a7316f4f5… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample 9b7a7316f4f5…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9b7a7316f4f508c156eba259632c82287e105249f31ffe998db8005d5c912355"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample 9b7a7316f4f5… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample 9b7a7316f4f5…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]