23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 25:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T40a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Clean Sample a3c12e5862eb… — Score 0/100 — Hybrid Analysis","description":"Clean verdict for sample a3c12e5862eb…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a3c12e5862ebc92e34c90e5f9b9bf111decdd65f089519047378150b2769ed42","keywords":["Clean","malware analysis","sandbox report","threat intelligence","a3c12e5862ebc92e34c90e5f9b9bf111decdd65f089519047378150b2769ed42"],"about":{"@type":"SoftwareApplication","name":"100005.js","applicationCategory":["script","javascript"],"identifier":"a3c12e5862ebc92e34c90e5f9b9bf111decdd65f089519047378150b2769ed42","additionalType":"Clean sample"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T971,Pattern match: "ME4F.eitM/K^^F@4ZWK" Pattern match: "y.Ec/D|R[%?{3KNZQkK'E{Giz%]-O;[+8BlK--" Heuristic match: "#O0 4Bu;{E9*f9WM{KvT[q,aFTmN[mNGL|PEoYe=#WGw|S,%GX,.Bf" Pattern match: "k6j.kfo/?:%rrR=" Heuristic match: "\k.jM" Heuristic match: "-AiEW,]fH{m0.kM" Pattern match: "HMqevUH9.SP/i_1Ehj8esl" Pattern match: "h.cN/S~uvq|%WHRT=,Y]1}!u0MN[V}i1L8ru=wc0dny@JgG~" Heuristic match: "MI4q?B`7;Iv2M~DE1-^}]2S{BPPC-{,zO.Sm" Heuristic match: "McrbF1RFJPB/)[K/.N}N>:2c.Hu" Heuristic match: "3Yf3Ws%s9dbN31_0?0%Cjv&.Lb" Heuristic match: "{ndt6F={+ZA@`e3[m73Fe5m[_Z3Ic1xWKdPWa'>;W8cgl&Y?[m~luK.ms" Pattern match: "MJ2O.BUq/`*$[OD" Heuristic match: "HTgG)!Xf3ER2u:Lxf7y3q8G!|q8g4a0MuliPGX+X0Rl*Lk5wr]t8r.KH" Pattern match: "b.zS/sq7" Heuristic match: "LwY[R6:^|}n?6mB&.lk" Heuristic match: "*khIk<'IuC?c=MHgk^?,~s0(+>&2j`-.gM" Pattern match: "OosWvI1.IH/iSAD%U[+Cfzr_jLC" Heuristic match: "y+2q.bg" Heuristic match: ".KDM^SO-/UK+<]TP(2c{}O?us2*nmJ)Xvu7h,?DTWyD-)&?Ux>Je;db++An)`D6MxW[2oQ=9dOgHDLh?=bl0X =|Cxez4T(-]Em{{rl(s[33{,!__zS/+(vw+rK_u10vUyRJXWM$j9G-~OTMoKs8)4?H3VK}`D80hY7a^zGb BVK.Fr" Pattern match: "qrw3.Kzj/XMn0?/-Ied" Pattern match: "OSv6GO.yNH/u5?k43_" Heuristic match: "@|o},rA}fo=rZBMp*:sk:*/(3xLou>9pqP$`_v<$m(f_R?0;ku\W}x.HU" Pattern match: "0DITL.Lsk/NzuvY,hcFeb`G56Q_k4c4?6B15O#+pG" Pattern match: "f12.rfi/o},w\QyBHHbC|q26~5,'H1YYw?]bLf@$" Heuristic match: "4XF6Z:ErXH8S9_2^]g2~h}neUue}NrJm>AEISCI1$.iM" Pattern match: "rkC.Uca/I_SrY]?}86}.+" Heuristic match: "w6r=ZQNA-cK=O-?.51|WH:X:rZ5?ejx?$?y[$$=}at;:Hk~^PO r:FHRhDN1>Z9.PR2UU]y\?['-3[uor.E],MyGP*eP%?Pb3/uP{fE3~*,cN;`\qc#?Y;PrAJJr%r^SF5)(S^YnCnj!21D0gFpFup_Gv'FL8zLN9UC(91&-qM;H89|3l>!R!|&n?Px.Co" Pattern match: "S.PP/Q}{o+'PVIN;I?8}u!?.ih6#Av.&o-" Pattern match: "mn.iO/V?-Axp" Pattern match: "oB30..Eqd/kX`DNyy4" Pattern match: "Xq.Ow/yy7o6mToI_" Heuristic match: "41&Y!nM;>7^FM[@03>!J[.Sh" Heuristic match: "7i9!kOTHh.QA" Pattern match: "cq.xv/g{aEx[#" Heuristic match: "u>fmG^D_etb/(x$-rKCw3u]/ps1LJ7oV?%azylDk([Av$[FMwv|J.is" Heuristic match: "BL+or.tk" Pattern match: "Wx.Wyjy/-a'I$vam/x6;IF5" Pattern match: "V7Y.PZ/mi}1},$Bmx2%4J_yzU" Heuristic match: "b5Xk[c6YGT+!?s+)Wo'vQ0,v.=.hR{?s.Nr" Pattern match: "Ke.yRec/PKhPNbp" Heuristic match: "n$WY0}-wSCHS7+5p'jrABNk<@eMl=[h L+v]'#!1*o,2#8f.tSEt!u\"~fHbKB~96u9'jh=C&p7p9=Ul~JF)x|%*L[=m`RuKG|+NoV0D0C jnDX9s}'T\" (Indicator: \"bfe\")","origin":"File/Memory","relevance":7,"id":"string-43","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]}],"incidents":[{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"References security related windows services"}],"sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":33,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":7,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Sample Crashed","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"58245c88aac2ed35460374ad","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"clean","submit_name":"100005.js","analysis_start_time":"2016-11-10T12:41:05+00:00","indicators_count":{"informative":10,"suspicious":8,"malicious":1},"tags":["Sample Crashed","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}],"processes":[{"pid":2880,"ppid":0,"name":"wscript.exe","command_line":"\"C:\\100005.js\"","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00019945-00002880","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAFJSURBVFhHzZcNDsMgCIU9ukfrzbpR91KsgEgxmYlpZxf5fPyopbBWaz2zO59/+k7GMxvN9zVK3dd2ACxB7AA4juNyq0uJHQDkUjfELgA3hAWwkh0IZCY9XMCfY2BqAG28PBJk/E1S/3ytJhP7jw8AULWWbzCNvVkql5/JOJSid6ktAcgrf07bGycD6BJEAOAUV05qILiwcm5cgwgB6NVRX30qgOV/7nsEIH8+4ZMUQIDdCnj3kCUAmhSB6FHBAxEEaKmGlJOemHgGsQxwq2BlQ58RFkQIgEO8VSIMkKXEK4AMJZIA7ICEm6TADAN4tuNW++0aEQLQzwnjfsAhUhSY7Yi8FD/rQyKAXoh6gD42EgF8VZCrpVXGcAxIez0fw/nPOozw84N4U7EOpdJWa41p5TikwGyDWfn+/wAzX2d8t65p0gVi19gVhx+V73GC7R1O0wAAAABJRU5ErkJggg=="}],"all_imported_dlls":["KernelBase.dll","advapi32.dll","lpk.dll","usp10.dll","uxtheme.dll","sxs.dll","dwmapi.dll","clbcatq.dll","ntdll.dll","kernel32.dll","msvcrt.dll","cryptbase.dll","crypt32.dll","ole32.dll","sechost.dll","shlwapi.dll","wshext.dll","oleaut32.dll","msisip.dll","cryptsp.dll","user32.dll","gdi32.dll","rsaenh.dll","msctf.dll","rpcrt4.dll","imm32.dll","msasn1.dll","comctl32.dll","scrobj.dll","version.dll","shell32.dll","jscript.dll","wintrust.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\System32\\en-US\\WScript.exe.mui","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"path":"%WINDIR%\\System32\\WScript.exe","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"path":"C:\\100005.js","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"path":"%WINDIR%\\System32\\en-US\\jscript.dll.mui","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"58245c88aac2ed35460374ad"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["58245c88aac2ed35460374ad"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Clean Sample a3c12e5862eb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Clean verdict for sample a3c12e5862eb…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a3c12e5862ebc92e34c90e5f9b9bf111decdd65f089519047378150b2769ed42"}],["$","meta","4",{"property":"og:title","content":"Clean Sample a3c12e5862eb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Clean verdict for sample a3c12e5862eb…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a3c12e5862ebc92e34c90e5f9b9bf111decdd65f089519047378150b2769ed42"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Clean Sample a3c12e5862eb… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Clean verdict for sample a3c12e5862eb…. Threat score 0/100. 0/27 AV engines flagged this file. 1 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L25","11",{}]]