26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL.Benin.Generic Sample a1a8366fa53c… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a1a8366fa53c…. Malware family: MSIL.Benin.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a1a8366fa53c18bf7f249d6eaf873fba15f97f9296ae9274005da925cbc4d0a8","keywords":["Malicious","MSIL.Benin.Generic","malware analysis","sandbox report","threat intelligence","a1a8366fa53c18bf7f249d6eaf873fba15f97f9296ae9274005da925cbc4d0a8"],"about":{"@type":"SoftwareApplication","name":"zasos.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"a1a8366fa53c18bf7f249d6eaf873fba15f97f9296ae9274005da925cbc4d0a8","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL.Benin.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T93f,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "CreateEncryptor" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "V55USpDUP1" (Indicator: "dup"; Source: "sample.bin"), Found reference to API "RuntimeMethodHandle" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Threading" (Indicator: "read"; Source: "sample.bin"), Found reference to API "get_IsStatic" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "IAsyncResult" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "Write" (Indicator: "write"; Source: "sample.bin"), Found reference to API "EditorBrowsableState" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "FileAccess" (Indicator: "access"; Source: "sample.bin"), Found reference to API "ReadSingle" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.Runtime.Remoting" (Indicator: "time"; Source: "sample.bin"), Found reference to API "System.Security.Cryptography" (Indicator: "security"; Source: "sample.bin"), Found reference to API "System.Runtime.Versioning" (Indicator: "time"; Source: "sample.bin"), Found reference to API "BinaryReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadByte" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadDouble" (Indicator: "read"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SUsSystem.Runtime.InteropServices.CharSet, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "time"; Source: "sample.bin"), Found reference to API "MethodAccessException" (Indicator: "access"; Source: "sample.bin"), Found reference to API "Write " (Indicator: "write"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=40" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=64" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=12" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=16" (Indicator: "stat"; Source: "sample.bin")28:T5c7,Found string "CreateEncryptor" (Indicator: "createencryptor"; Source: "sample.bin"), Found string "GZipStream" (Indicator: "GzipStream"; Source: "sample.bin"), Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "ToBase64String" (Indicator: "ToBase64String"; Source: "sample.bin"), Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "rijndael"; Source: "sample.bin"), Found string "RijndaelManaged" (Indicator: "Rijndaelmanaged"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CryptoStreamMode" (Indicator: "cryptostreammode"; Source: "sample.bin"), Found string "CryptoStream" (Indicator: "cryptostream"; Source: "sample.bin"), Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "sample.bin"), Found string "RSACryptoServiceProvider" (Indicator: "RsaCryptoServiceProvider"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "base64"; Source: "sample.bin"), Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aes"; Source: "sample.bin"), Found string "AesCryptoServiceProvider" (Indicator: "aescryptoserviceprovider"; Source: "sample.bin")29:T4a9,Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "sample.bin"), Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "sample.bin"), Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "sample.bin"), Found reference to "RC2mQZDFwen0HDcIUKu" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "TripleDES" (Indicator: "TripleDES"; Source: "sample.bin"), Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "sample.bin"), Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "sample.bin"), Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "sample.bin")2a:T767,"identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IDENTITY_HELPER.EXE") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CONTROL PANEL\DESKTOP") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CONTROL PANEL\DESKTOP") "identity_helper.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT") "identity_helper.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE") "identity_helper.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE")2b:Ta71," HTTP/2 200 OK Content-Type: image/png Date: Sun 01 Nov 2026 13:12:03 GMT X-Msedge-Ref: Ref A: CD69A98DF989497AA41D85EA69AC42EF Ref B: BY1AA1072320042 Ref C: 2026-11-01T13:12:03Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: CD69A98DF989497AA41D85EA69AC42EF Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000008_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-GTRXG Ref C: 2026-11-01T13:12:03Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT....... "GET /favicon.ico?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: www.mlb.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/x-icon Date: Sun 01 Nov 2026 13:12:03 GMT Server: UploadServer Expires: Tue 26 May 2026 19:03:05 GMT Vary: Accept-Encoding Content-Encoding: gzip X-Served-By: cache-chi-kigq8000070-CHI cache-chi-klot8100130-CHI cache-bur-kbur8200144-BUR X-Cache-Hits: 0 3 2 Strict-Transport-Security: max-age=604800 Access-Control-Expose-Headers: * Via: 1.1 varnish 1.1 google 1.1 varnish 1.1 varnish Access-Control-Allow-Origin: * Last-Modified: Tue 04 Feb 2020 13:27:14 GMT X-Content-Type-Options: nosniff X-Xss-Protection: 1; mode=block Referrer-Policy: no-referrer-when-downgrade X-Timer: S1779735785.275633 VS0 VE68 Etag: "c89c193f3ee0f312ce686faa962acd88" X-Cache: MISS HIT HIT Cache-Control: max-age=86400 Accept-Ranges: bytes Age: 47933 with no response body "GET /favicon?url=mlb.com?w=32&h=32&q=100&m=6&f=webp&u=t HTTP/2 Host: services.bingapis.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Referer: https://ntp.msn.com/ Sec-Fetch-Site: cross-site Accept-Language: en-US,en;q=0.9 Priority: i Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8 Sec-Ch-Ua: "Not:A-Brand";v="99", "Microsoft Edge";v="145", "Chromium";v="145" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: image" Response ==> HTTP/2 200 OK Content-Type: image/png Date: Sun 01 Nov 2026 13:12:03 GMT X-Msedge-Ref: Ref A: D9938452DC3047BD80A7BC9A2C5D6CA7 Ref B: BY1AA1072320042 Ref C: 2026-11-01T13:12:03Z X-Cache: CONFIG_NOCACHE Cache-Control: public max-age=86400 X-Falcon-Ref: Ref A: D9938452DC3047BD80A7BC9A2C5D6CA7 Ref B: SC-WUS2-1ZB4Y_AKS-GEN00-28457140-VMSS000005_FABRICROUTER-AZUREGLOBALPRIVATE-5656BB8D79-QSQLK Ref C: 2026-11-01T13:12:03Z X-Falcon-Routerstatuscode: SuccessfullyForwarded (200) Accept-Ch: Sec-CH-UA-Arch Sec-CH-UA-Bitness Sec-CH-UA-Full-Version Sec-CH-UA-Full-Version-List Sec-CH-UA-Mobile Sec-CH-UA-Model Sec-CH-UA-Platform Sec-CH-UA-Platform-Version with response body ==>BINARY_CONTENT.......39:T1971,"