23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T48d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious TSPY_DRIDEX.YSMV Sample a497de7f2488… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a497de7f2488…. Malware family: TSPY_DRIDEX.YSMV. Threat score 100/100. 21/28 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43","keywords":["Malicious","TSPY_DRIDEX.YSMV","malware analysis","sandbox report","threat intelligence","a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43"],"about":{"@type":"SoftwareApplication","name":"1111.exe","applicationCategory":["peexe","executable"],"identifier":"a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"TSPY_DRIDEX.YSMV","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":10,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T554,"" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE", Key: "SCAVENGECACHEFILELIMIT") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "DISABLECACHINGOFSSLPAGES") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSHTTPNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\USER\S-1-5-21-1663702577-2139711211-3687027567-1000\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK") "" (Access type: "QUERYVAL", Path: "\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS", Key: "BYPASSSSLNOCACHECHECK")25:T652,"Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabAD2F.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarAD30.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabB223.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarB224.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Tar7F98.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\Cab7F87.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarB129.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabB109.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\TarE57A.tmp" for deletion "Z:\a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43" marked "\Device\HarddiskVolume2\Users\PSPUBWS\AppData\Local\Temp\CabE569.tmp" for deletion26:T5f7,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES")27:T473,"" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "" (Access type: "CREATE", Path: "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "" (Access type: "CREATE", Path: "\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS")28:Tac8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAerSURBVFhH7ZZ5UJXXGca/MV3+SDvtxJk2k85kkomVOBqUfQd3RY17jGg1QJrGJYQajUVQVECJLOKAqICgIriBF2QHgcvqJcBl87KIoCCKmtAobgEFfj3fh1ANRiT9t+/MM/e757zv8zzfe+4550rS/2MkHVg3CWm94TAwYCSUr5brYoTkIoQFRrka81fvRcwNc2X1cU8F8rM8Js8N5Cmf/3N8KUhchbjAGJ8FeGcdRttWz/W7t18Iec478zDvidyBOsn1lxr5ShRuMOL1LdZsTT9A5Y1LVLdfpvrmMBA5cq6HqHndzVrhkL4SGFFsEgUCb3nPJlqbirpZi/rKCCFq5FqZQ9rYz/dqHjaKN99szOid0wgrVaGqzUVVJ0P9X9SL52eQ2JBHYkP+8zlynYDMIXNJX4vfx9evYsLNmFHupmzJCiWyIqkflc+gKokj1ckkXVZT2FZK5XfVXOzQkduqIVLMDeYO1GqTFC6ZUxLcL++Ch0gQMAtzJPBCLIEagZIT/fj2BHtLT3CyLo0L7aWU39YOouyWlqSmHALFvJynQKl7yiG4zA45KtyS+8tMbDNB8jRlXaofnnlheOaH96MgHK/iSBKbsihu1yjIas0jSpdAQHkM+ypPcqAmnuCq0/hojuBZ2F+j1ObJCFM4JU/Bv1XghbFFrP0OE97wn4Fr1l5czwtkB+GaE8SmvGASmtLIbVML4RyCKo7jqz1Gxu1iGp40cYXWQTT3taDprCS8TqXUKhwyV+ZehVvaLr/ki0x4iTXyNmXMwSU4pfrglCaQ4YNz5i6O1sWR3pKJqjmFjUX7ONWWSWNfM5eFrIzq7nou3K+g7FHN4LjqRo5S75T+lEtwjjmwBEnW2SkwJHzE4G4z9CKWsfScO0uTBVLc2XohhKQrKcQ3JfJ5ni8p3+fTIGTr+ho53pbKl5og3EoO4l95Au/yo6wvDMCv9jh/V+9maaqHwqFwCU698GWKhiRrDQlfMbHHjHfCFzFL9U9mJW5gXvImYhvOCHEVLkV7iGhNoJZLlD+uwaU0kJDaeDp+vMuz8aT3CTnXy3E4v51ZSRuYdU4gQUBwytyyhiRrDQk/MRhgzuiDs7COX4P12TWsyfPm5KXT7K+JYnWRFzV9dVT11fJpyW7S2jT09fUp2h1ddynrqOdS5zV6n4599+gODtnbsU5Yq3BZx61RuGUNSdYaEoFiIsic1/ZbMfH0agziHdlVHkJ0fQyO+duIbE+gCh1BLTH418Yqwt09j/G9GIVFujMmqU4YpTixWO1B7Z2ryry6vQKDs04YxDky8dRqXguxUjQkWWtI7BODwRZIoRaMPmrPuLiVHLoYSWTtUWwyPkfTo0XbV83iQhd+6OpUBHbrQrHMWIpFxkeYpX+EcdoyJqV8jFXGZ/jrYtE/54hevAN6ZxwYfcRe4VY0ZBNDIqRfXDpkiRRhxbtnFhOmO0xI9SFm562lXLz/+Uf5rC11U8RvPrrFlOy52GbbY3PeHqusOZhlzMUobR76KfPRO7eQd1WLeTtuCW/EzlE4Fe4BE0MMDIqLpCgr3jw1h6DKYLHfA1le8gWlVHDmTgK7dN8oBoq+L2CG2k7BdIEpOZOFkSmYZ07DMG0645Nn8k7CDH5/cjLSUSEeKRAuuA8+NTHEQIA4HOQEIS4ds+IvcTMIqAjCq8yXD4sduEAZqvuJ7NT1d6Dmrpb5RSbMLzRhXoEJs/NNmKY2xTrbFMMMU8YmG/OWypg/njblNzGis8+a2P+iJZAdyS5F4m9jLfhznCV+4u39K/Yyu2AmRX2l5PUU85l2jvj19/K4t5t/VNiypGQsizRjhcn3Rd44pqrHY5n9AQYZk9BLNhQmjBQTv44RL3dE7oT4/NkQ4r86bskfTpkqhe7fbleWwaHoQ5IfJitd2NHsTE1nodKFunsa1lVPxLlyLKu1eiwvHSfMjMe+QJ/JuZMwzRT/pJIm8eZZI7EUZoyKFgZkEy+L34nEP8Ub854odCx0FhdMKNu0mwi45kYJWrK6UvFrXsijnv6dcLvrCnHtOwhqXsE3jcvxaliBh+5vbKr6hPXlTjgUr2BB/ipm5jiinyxOwuFidLQBbycaMj5Vn+m5lmIXHBDbMZwtuoXkdWeLHlSScv8wMe2f0Pmk/blT8GVfesWyFd+sGN6AbHDsOX0M0ydgl/s+m8vWc6Qumoj6fURcX4O2t0JY0FHQpSK+YxVl94K50VXKncctAtf4t0BHdxu3ulq59vAyLQ+auPXwJj29Pa8mPtAhq38ZMy1qAh+XTCCwyo/TjXGcuRpC6g+e6HqrqRN3Qm1fPWXdiRQ8COJ8p5eY8yKxw4eTt73xbfmUzZdWsih2Kqu8l49MXDZhY2uDrZ0N9lsN+EJjQUBlgHIsp7edoPReEI09BVwVd/9V8V9gAI00K90pFqdG9v183II9sLOzw0bwDLf0Q+ZtbW0ZwNS5ljj62eMjrlj5bAit2U9cqzvFD1aKm3Edmsf+qLsPkPZjKHE3IvA6tgv7+faD9TLPiA2Ym5s/R6CYsbNl/qoFOG5zYn2wCxsiNrAlegVuUXas3fMBi5yNlK49a15+trIaZuv9nDu58KdkI/1uY/ML2v9TQ9bW1iM2Ite8Stv/A7AjMfa4F+WxAAAAAElFTkSuQmCC29:Tac8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAerSURBVFhH7ZZ5UJXXGca/MV3+SDvtxJk2k85kkomVOBqUfQd3RY17jGg1QJrGJYQajUVQVECJLOKAqICgIriBF2QHgcvqJcBl87KIoCCKmtAobgEFfj3fh1ANRiT9t+/MM/e757zv8zzfe+4550rS/2MkHVg3CWm94TAwYCSUr5brYoTkIoQFRrka81fvRcwNc2X1cU8F8rM8Js8N5Cmf/3N8KUhchbjAGJ8FeGcdRttWz/W7t18Iec478zDvidyBOsn1lxr5ShRuMOL1LdZsTT9A5Y1LVLdfpvrmMBA5cq6HqHndzVrhkL4SGFFsEgUCb3nPJlqbirpZi/rKCCFq5FqZQ9rYz/dqHjaKN99szOid0wgrVaGqzUVVJ0P9X9SL52eQ2JBHYkP+8zlynYDMIXNJX4vfx9evYsLNmFHupmzJCiWyIqkflc+gKokj1ckkXVZT2FZK5XfVXOzQkduqIVLMDeYO1GqTFC6ZUxLcL++Ch0gQMAtzJPBCLIEagZIT/fj2BHtLT3CyLo0L7aWU39YOouyWlqSmHALFvJynQKl7yiG4zA45KtyS+8tMbDNB8jRlXaofnnlheOaH96MgHK/iSBKbsihu1yjIas0jSpdAQHkM+ypPcqAmnuCq0/hojuBZ2F+j1ObJCFM4JU/Bv1XghbFFrP0OE97wn4Fr1l5czwtkB+GaE8SmvGASmtLIbVML4RyCKo7jqz1Gxu1iGp40cYXWQTT3taDprCS8TqXUKhwyV+ZehVvaLr/ki0x4iTXyNmXMwSU4pfrglCaQ4YNz5i6O1sWR3pKJqjmFjUX7ONWWSWNfM5eFrIzq7nou3K+g7FHN4LjqRo5S75T+lEtwjjmwBEnW2SkwJHzE4G4z9CKWsfScO0uTBVLc2XohhKQrKcQ3JfJ5ni8p3+fTIGTr+ho53pbKl5og3EoO4l95Au/yo6wvDMCv9jh/V+9maaqHwqFwCU698GWKhiRrDQlfMbHHjHfCFzFL9U9mJW5gXvImYhvOCHEVLkV7iGhNoJZLlD+uwaU0kJDaeDp+vMuz8aT3CTnXy3E4v51ZSRuYdU4gQUBwytyyhiRrDQk/MRhgzuiDs7COX4P12TWsyfPm5KXT7K+JYnWRFzV9dVT11fJpyW7S2jT09fUp2h1ddynrqOdS5zV6n4599+gODtnbsU5Yq3BZx61RuGUNSdYaEoFiIsic1/ZbMfH0agziHdlVHkJ0fQyO+duIbE+gCh1BLTH418Yqwt09j/G9GIVFujMmqU4YpTixWO1B7Z2ryry6vQKDs04YxDky8dRqXguxUjQkWWtI7BODwRZIoRaMPmrPuLiVHLoYSWTtUWwyPkfTo0XbV83iQhd+6OpUBHbrQrHMWIpFxkeYpX+EcdoyJqV8jFXGZ/jrYtE/54hevAN6ZxwYfcRe4VY0ZBNDIqRfXDpkiRRhxbtnFhOmO0xI9SFm562lXLz/+Uf5rC11U8RvPrrFlOy52GbbY3PeHqusOZhlzMUobR76KfPRO7eQd1WLeTtuCW/EzlE4Fe4BE0MMDIqLpCgr3jw1h6DKYLHfA1le8gWlVHDmTgK7dN8oBoq+L2CG2k7BdIEpOZOFkSmYZ07DMG0645Nn8k7CDH5/cjLSUSEeKRAuuA8+NTHEQIA4HOQEIS4ds+IvcTMIqAjCq8yXD4sduEAZqvuJ7NT1d6Dmrpb5RSbMLzRhXoEJs/NNmKY2xTrbFMMMU8YmG/OWypg/njblNzGis8+a2P+iJZAdyS5F4m9jLfhznCV+4u39K/Yyu2AmRX2l5PUU85l2jvj19/K4t5t/VNiypGQsizRjhcn3Rd44pqrHY5n9AQYZk9BLNhQmjBQTv44RL3dE7oT4/NkQ4r86bskfTpkqhe7fbleWwaHoQ5IfJitd2NHsTE1nodKFunsa1lVPxLlyLKu1eiwvHSfMjMe+QJ/JuZMwzRT/pJIm8eZZI7EUZoyKFgZkEy+L34nEP8Ub854odCx0FhdMKNu0mwi45kYJWrK6UvFrXsijnv6dcLvrCnHtOwhqXsE3jcvxaliBh+5vbKr6hPXlTjgUr2BB/ipm5jiinyxOwuFidLQBbycaMj5Vn+m5lmIXHBDbMZwtuoXkdWeLHlSScv8wMe2f0Pmk/blT8GVfesWyFd+sGN6AbHDsOX0M0ydgl/s+m8vWc6Qumoj6fURcX4O2t0JY0FHQpSK+YxVl94K50VXKncctAtf4t0BHdxu3ulq59vAyLQ+auPXwJj29Pa8mPtAhq38ZMy1qAh+XTCCwyo/TjXGcuRpC6g+e6HqrqRN3Qm1fPWXdiRQ8COJ8p5eY8yKxw4eTt73xbfmUzZdWsih2Kqu8l49MXDZhY2uDrZ0N9lsN+EJjQUBlgHIsp7edoPReEI09BVwVd/9V8V9gAI00K90pFqdG9v183II9sLOzw0bwDLf0Q+ZtbW0ZwNS5ljj62eMjrlj5bAit2U9cqzvFD1aKm3Edmsf+qLsPkPZjKHE3IvA6tgv7+faD9TLPiA2Ym5s/R6CYsbNl/qoFOG5zYn2wCxsiNrAlegVuUXas3fMBi5yNlK49a15+trIaZuv9nDu58KdkI/1uY/ML2v9TQ9bW1iM2Ite8Stv/A7AjMfa4F+WxAAAAAElFTkSuQmCC1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790304323776,"unified_at":"2026-09-25T02:45:23.776Z","metadata":{"hashes":{"sha256":"a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43","sha1":"c4a5ad53737df1087f1bce594bd20554345ac335","md5":"6f9ec4ffa07bcade346b04317dfb6f1c","sha512":"2b6e99df7beec4274532dfb0810714ac4d5638311e687c57b35524fe7395bd76a8848556a1cf9694e64a53fa9ce644e65ce6708b3533d70c6b562396d127b847","ssdeep":"3072:td0PerOy3dgBKqtPci74rl54azTSRRjvX0npnUiSV3/yGmHOwYAYDuUpL1pwRvXO:qXyOIrgYerEnp/w3/yDHOBAYCUXGvhW","ssdeep_chunks":["3072:td0PerO","3072:d0PerOy","3072:0PerOy3","3072:PerOy3d","3072:erOy3dg","3072:rOy3dgB","3072:Oy3dgBK","3072:y3dgBKq","3072:3dgBKqt","3072:dgBKqtP","3072:gBKqtPc","3072:BKqtPci","3072:KqtPci7","3072:qtPci74","3072:tPci74r","3072:Pci74rl","3072:ci74rl5","3072:i74rl54","3072:74rl54a","3072:4rl54az","3072:rl54azT","3072:l54azTS","3072:54azTSR","3072:4azTSRR","3072:azTSRRj","3072:zTSRRjv","3072:TSRRjvX","3072:SRRjvX0","3072:RRjvX0n","3072:RjvX0np","3072:jvX0npn","3072:vX0npnU","3072:X0npnUi","3072:0npnUiS","3072:npnUiSV","3072:pnUiSV3","3072:nUiSV3/","3072:UiSV3/y","3072:iSV3/yG","3072:SV3/yGm","3072:V3/yGmH","3072:3/yGmHO","3072:/yGmHOw","3072:yGmHOwY","3072:GmHOwYA","3072:mHOwYAY","3072:HOwYAYD","3072:OwYAYDu","3072:wYAYDuU","3072:YAYDuUp","3072:AYDuUpL","3072:YDuUpL1","3072:DuUpL1p","3072:uUpL1pw","3072:UpL1pwR","3072:pL1pwRv","3072:L1pwRvX","3072:1pwRvXO","6144:td0PerO","6144:d0PerOy","6144:0PerOy3","6144:PerOy3d","6144:erOy3dg","6144:rOy3dgB","6144:Oy3dgBK","6144:y3dgBKq","6144:3dgBKqt","6144:dgBKqtP","6144:gBKqtPc","6144:BKqtPci","6144:KqtPci7","6144:qtPci74","6144:tPci74r","6144:Pci74rl","6144:ci74rl5","6144:i74rl54","6144:74rl54a","6144:4rl54az","6144:rl54azT","6144:l54azTS","6144:54azTSR","6144:4azTSRR","6144:azTSRRj","6144:zTSRRjv","6144:TSRRjvX","6144:SRRjvX0","6144:RRjvX0n","6144:RjvX0np","6144:jvX0npn","6144:vX0npnU","6144:X0npnUi","6144:0npnUiS","6144:npnUiSV","6144:pnUiSV3","6144:nUiSV3/","6144:UiSV3/y","6144:iSV3/yG","6144:SV3/yGm","6144:V3/yGmH","6144:3/yGmHO","6144:/yGmHOw","6144:yGmHOwY","6144:GmHOwYA","6144:mHOwYAY","6144:HOwYAYD","6144:OwYAYDu","6144:wYAYDuU","6144:YAYDuUp","6144:AYDuUpL","6144:YDuUpL1","6144:DuUpL1p","6144:uUpL1pw","6144:UpL1pwR","6144:pL1pwRv","6144:L1pwRvX","6144:1pwRvXO","3072:qXyOIrg","3072:XyOIrgY","3072:yOIrgYe","3072:OIrgYer","3072:IrgYerE","3072:rgYerEn","3072:gYerEnp","3072:YerEnp/","3072:erEnp/w","3072:rEnp/w3","3072:Enp/w3/","3072:np/w3/y","3072:p/w3/yD","3072:/w3/yDH","3072:w3/yDHO","3072:3/yDHOB","3072:/yDHOBA","3072:yDHOBAY","3072:DHOBAYC","3072:HOBAYCU","3072:OBAYCUX","3072:BAYCUXG","3072:AYCUXGv","3072:YCUXGvh","3072:CUXGvhW"],"imphash":"e00f4c089c24dcf27aa64f4bbc3d968f"},"file_info":{"file_name":"1111.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":324608,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297407000,"last_seen":1677382205000,"last_multi_scan":1677382205000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":21,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":20,"malicious_count":10,"total":39},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Dridex","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.ZPACK.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.61681","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Kovter-7076609-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Dridex.UQNQ-8723","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jaik.61681 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Dridex.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Backdoor/Dridex.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004beaac1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.moea","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes.dxnaje","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Dridex-GU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Yakes.324608.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.YSMV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TSPY_DRIDEX.YSMV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dridex.IA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Dridex.Win32.253","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TSPY_DRIDEX.YSMV","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 01963171-00002352-77E701AA-1978173\n GetLocalTime@KERNEL32.DLL at 01963171-00002352-45472-126-00401352\n GetSystemTimeAsFileTime@KERNEL32.DLL at 01963171-00002352-45472-336-0040AD22","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.0.160.25:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 77850000\n \"\" loaded module \"OLEAUT32.DLL\" at base 779B0000\n \"\" loaded module \"SHELL32.DLL\" at base 76BB0000\n \"\" loaded module \"NTDLL.DLL\" at base 77E40000\n \"\" loaded module \"USER32.DLL\" at base 76AB0000\n \"\" loaded module \"ADVAPI32.DLL\" at base 75A70000\n \"\" loaded module \"SHLWAPI.DLL\" at base 76300000\n \"\" loaded module \"WININET.DLL\" at base 769B0000\n \"\" loaded module \"COMCTL32.DLL\" at base 75680000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CommandLineToArgvW@shell32.dll\"\n \"RtlFillMemory@ntdll.dll\"\n \"RegOpenKeyExA@ADVAPI32.dll\"\n \"RegQueryValueExA@ADVAPI32.dll\"\n \"OpenProcessToken@ADVAPI32.dll\"\n \"GetTokenInformation@ADVAPI32.dll\"\n \"AllocateAndInitializeSid@ADVAPI32.dll\"\n \"EqualSid@ADVAPI32.dll\"\n \"FreeSid@ADVAPI32.dll\"\n \"RtlQueryElevationFlags@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 01963171-00002352-77E5FDA0-1985411","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 01963171-00002352-45472-20-00403C56\n SetUnhandledExceptionFilter@KERNEL32.DLL at 01963171-00002352-45472-46-00404549\n SetUnhandledExceptionFilter@KERNEL32.DLL at 01963171-00002352-45472-644-0040A448\n SetUnhandledExceptionFilter@KERNEL32.DLL at 01963171-00002352-45472-256-0040EA92","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".hote with unusual entropies 7.40039106076","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 01963171-00002352-77E701AA-1978548","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 01963171-00002352-77E701AA-1978500\n GetProcessHeap@KERNEL32.DLL at 01963171-00002352-77E701AA-1978515\n GetProcessHeap@KERNEL32.DLL at 01963171-00002352-77E701AA-1978517","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\", Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\index.dat\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@??? at 01963171-00002352-77E701AA-1983609","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 23.0.160.25 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetTickCount\n GetModuleFileNameA\n WriteFile\n GetModuleHandleW\n GetModuleHandleA\n LoadLibraryA\n GetProcAddress\n VirtualAlloc\n Sleep\n LoadLibraryW\n GetStartupInfoA\n GetCommandLineA\n IsDebuggerPresent\n UnhandledExceptionFilter\n TerminateProcess\n CreateFileA\n FindWindowA\n FindWindowExA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000407\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Queries/modifies the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$24","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/56 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabAD2F.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarAD30.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabB223.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarB224.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab7F87.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar7F98.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabB109.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarB129.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabE569.tmp\"\n \"\" created file \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarE57A.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\19f513849b17fd21d98463edcafafbab\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"Explorer.EXE\" (UID: 00464093-00001968)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00327031-00001620-77A2228D-356094\n LookupAccountNameLocalW@SECHOST.DLL at 00327031-00001620-77A2228D-426609","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"CabAD2F.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"TarAD30.tmp\" has type \"data\"\n \"CabB223.tmp\" has type \"Microsoft Cabinet archive data, 48151 bytes, 1 file\"\n \"TarB224.tmp\" has type \"data\"\n \"94308059B57B3142E455B38A6EB92015\" has type \"data\"\n \"Cab7F87.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"Tar7F98.tmp\" has type \"data\"\n \"CabB109.tmp\" has type \"Microsoft Cabinet archive data, 50006 bytes, 1 file\"\n \"TarB129.tmp\" has type \"data\"\n \"92_51_129_33[1].txt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00327031-00001620-77A2228D-460890\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00327031-00001620-42854-166-00406F00","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"$25","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabAD2F.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarAD30.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabB223.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarB224.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Tar7F98.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\Cab7F87.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\TarB129.tmp\" with delete access\n \"\" opened \"C:\\Users\\PSPUBWS\\AppData\\Local\\Temp\\CabB109.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$26","origin":"Registry Access","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLEFILETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"ENABLECONSOLETRACING\", Value: \"00000000\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"FILETRACINGMASK\", Value: \"0000FFFF\")\n \"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\", Key: \"CONSOLETRACINGMASK\", Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00005012 bytes of memory in \"explorer.exe\" (Protection: \"execute/read/write\")\n \"\" allocated 00417792 bytes of memory in \"explorer.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"Explorer.EXE\" (UID: 00464093-00001968)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 417792 bytes to a foreign process \"explorer.exe\" (PID: 00001968)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 82.118.24.167 on port 4483\n TCP traffic to 92.51.129.33 on port 4483","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"System Security","name":"Modifies System Certificates Settings","description":"$27","origin":"Registry Access","relevance":8,"id":"registry-38","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtSetSystemInformation@NTDLL.DLL at 00327031-00001620-77A2228D-373939\n NtQueryInformationProcess@NTDLL.DLL at 00327031-00001620-77A2228D-461297\n NtQueryVirtualMemory@NTDLL.DLL at 00327031-00001620-77A2228D-466565","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":198,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":28,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"560e256e0e316d901f7a9147","environment_id":5,"environment_description":"W7 32 bit 'Stealthy Mode' with 'DNS Spoof'","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["DEU","SWE"],"submit_name":"1111.exe","analysis_start_time":"2015-10-02T01:35:46+00:00","indicators_count":{"informative":9,"suspicious":26,"malicious":9},"tags":["Network Traffic","Extracted Files","Simulated analysis"],"is_in_unified_schema":true},{"id":"560d23950e316d8945ad5555","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":55,"malware_family":"Kryptik.DRDE","contacted_countries":["USA"],"submit_name":"1111.exe","analysis_start_time":"2015-10-01T07:15:33+00:00","indicators_count":{"informative":4,"suspicious":15,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"560d22850e316dff6c147d89","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":90,"malware_family":"Kryptik.DRDE","contacted_countries":["DEU","SWE"],"submit_name":"1111.exe","analysis_start_time":"2015-10-01T07:11:15+00:00","indicators_count":{"informative":9,"suspicious":28,"malicious":12},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.0.160.25","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"}]},{"address":"82.118.24.167","port":4483,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"address":"92.51.129.33","port":4483,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}],"dns_resolutions":null,"http_requests":[{"host":"","host_ip":"192.168.56.15:49227","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}],"processes":[{"pid":1620,"ppid":0,"name":"a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43","command_line":"","normalized_path":"","uid":"00327031-00001620","icon":"$28"},{"pid":1968,"ppid":0,"name":"Explorer.EXE","command_line":"","normalized_path":"","uid":"00464093-00001968","icon":"$29"}],"all_imported_dlls":["comctl32.dll","ole32.dll","RPCRT4.dll","NETAPI32.dll","LPK.dll","IMM32.DLL","DEVOBJ.dll","kernel32.dll","KERNELBASE.dll","WINNSI.DLL","USP10.dll","PSAPI.DLL","OLEAUT32.dll","ntdll.dll","CRYPTSP.dll","srvcli.dll","SETUPAPI.dll","netutils.dll","VERSION.dll","profapi.dll","rsaenh.dll","CRYPTBASE.dll","wkscli.dll","NSI.dll","msvcrt.dll","wininet.dll","shell32.dll","GDI32.dll","SspiCli.dll","gdiplus.dll","MSACM32.dll","MSCTF.dll","USER32.dll","sechost.dll","WINMM.dll","SHLWAPI.dll","ADVAPI32.dll","IPHLPAPI.DLL","CFGMGR32.dll","uxtheme.dll","wship6.dll","schannel.DLL","SearchFolder.dll","Syncreg.dll","davclnt.dll","urlmon.dll","hcproviders.dll","stobject.dll","msxml5.dll","wpdshserviceobj.dll","Cabinet.dll","dhcpcsvc6.DLL","fwpuclnt.dll","twext.dll","hgcpl.dll","SAMLIB.dll","rasman.dll","bcryptprimitives.dll","NLSData0009.dll","apphelp.dll","UxTheme.dll","rtutils.dll","WINHTTP.dll","NaturalLanguage6.dll","thumbcache.dll","framedynos.dll","dwmapi.dll","npmproxy.dll","bcrypt.dll","wercplsupport.dll","wwapi.dll","WS2_32.dll","authui.dll","imapi2.dll","ntshrui.dll","OLEDB32R.DLL","PortableDeviceTypes.dll","DAVHLPR.dll","EXPLORERFRAME.dll","pnrpnsp.dll","ws2_32.DLL","MSDART.DLL","StructuredQuery.dll","sensapi.dll","WindowsCodecs.dll","iertutil.dll","HID.DLL","MsftEdit.dll","CRYPT32.dll","wshqos.dll","GPAPI.dll","shdocvw.dll","syncui.dll","OLEACC.dll","USERENV.dll","SXS.DLL","FXSAPI.dll","wer.dll","DUI70.dll","actxprxy.dll","XmlLite.dll","Wlanapi.dll","slc.dll","EhStorShell.dll","SYNCENG.dll","cryptnet.dll","oledb32.dll","taskschd.dll","prnfldr.dll","NetworkExplorer.dll","BatMeter.dll","VBoxMRXNP.dll","RASAPI32.dll","napinsp.dll","mswsock.dll","dhcpcsvc.DLL","PortableDeviceApi.dll","drprov.dll","pnidui.dll","dnsapi.DLL","QUtil.dll","wevtapi.dll","QAgent.dll","wlanutil.dll","WININET.dll","samcli.dll","msiltcfg.dll","ksuser.dll","cscapi.dll","winrnr.dll","wwanapi.dll","MPR.dll","ieproxy.dll","SyncCenter.dll","CRYPTUI.dll","Normaliz.dll","NLSLexicons0009.dll","zipfldr.dll","tiptsf.dll","WSCAPI.dll","AUDIOSES.DLL","SHELL32.dll","POWRPROF.dll","credssp.dll","IconCodecService.dll","SndVolSSO.DLL","werconcpl.dll","LINKINFO.dll","srchadmin.dll","SSPICLI.DLL","ntmarta.dll","Secur32.dll","EhStorAPI.dll","WTSAPI32.dll","FXSRESM.DLL","nlaapi.dll","RpcRtRemote.dll","netshell.dll","ehSSO.dll","Actioncenter.dll","wshtcpip.DLL","DEVRTL.dll","ntlanman.dll","provsvc.dll","fxsst.dll","AVRT.dll","NLAapi.dll","gameux.dll","netprofm.dll","PROPSYS.dll","ieframe.dll","WLDAP32.dll","CLBCatQ.DLL","ncrypt.dll","dsrole.dll","tquery.dll","ATL.DLL","WINTRUST.dll","IMM32.dll","secur32.dll","dxp.dll","es.dll","AltTab.dll","shacct.dll","DUser.dll","msls31.dll","WINSTA.dll","wscinterop.dll","WinCDEmuContextMenu.dll","UIAnimation.dll","CLUSAPI.dll","wintrust.dll","rasadhlp.dll","MMDevApi.dll","midimap.dll","msi.dll","MSASN1.dll","MLANG.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"94308059B57B3142E455B38A6EB92015","sha256":"477d31dc70c570df0840e474560c7a7d441f5b6b0e518bb1b6983ffdaa947a21","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"92_51_129_33[1].txt","sha256":"59d8a590891d2052ffe23febddde6377a32e20df366e8ddcd76c7c337afe9fff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Cab18E.tmp","sha256":"408ce7c02583426f38edf186d7567f9d8a76758f7a6f0a349376fdf1c8fd07cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Cab7F87.tmp","sha256":"408ce7c02583426f38edf186d7567f9d8a76758f7a6f0a349376fdf1c8fd07cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"CabAD2F.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"CabB109.tmp","sha256":"408ce7c02583426f38edf186d7567f9d8a76758f7a6f0a349376fdf1c8fd07cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"CabB223.tmp","sha256":"459e3eb1819fd94f6cb0d6a9c790e53720cf0733370f92823f31ba7545036f8a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"CabE569.tmp","sha256":"408ce7c02583426f38edf186d7567f9d8a76758f7a6f0a349376fdf1c8fd07cd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Tar19F.tmp","sha256":"17e284cbafe1476b77015ae8fe3b89fcce7ba2a617a66e4ed755c58e35a1cf58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Tar7F98.tmp","sha256":"17e284cbafe1476b77015ae8fe3b89fcce7ba2a617a66e4ed755c58e35a1cf58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"TarAD30.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"TarB129.tmp","sha256":"17e284cbafe1476b77015ae8fe3b89fcce7ba2a617a66e4ed755c58e35a1cf58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"TarB224.tmp","sha256":"0efe8455a273c22d2fdcf3d02be7f446a515a5504182a65d64a347c82972ce4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"TarE57A.tmp","sha256":"17e284cbafe1476b77015ae8fe3b89fcce7ba2a617a66e4ed755c58e35a1cf58","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%WINDIR%\\system32\\en-US\\WINHTTP.dll.mui","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\94308059B57B3142E455B38A6EB92015","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QA0UPEJW\\92_51_129_33[1].txt","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"560d23950e316d8945ad5555"},{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]},{"name":"Global\\19f513849b17fd21d98463edcafafbab","sources":[{"report_type":"sandbox","report_id":"560d22850e316dff6c147d89"}]}]}},"report_ids":{"sandbox_job_ids":["560e256e0e316d901f7a9147","560d22850e316dff6c147d89","560d23950e316d8945ad5555"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious TSPY_DRIDEX.YSMV Sample a497de7f2488… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a497de7f2488…. Malware family: TSPY_DRIDEX.YSMV. Threat score 100/100. 21/28 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43"}],["$","meta","4",{"property":"og:title","content":"Malicious TSPY_DRIDEX.YSMV Sample a497de7f2488… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a497de7f2488…. Malware family: TSPY_DRIDEX.YSMV. Threat score 100/100. 21/28 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a497de7f2488f093aa74562695a2ce705cbddbd2c4a357f5c785f23ea7450f43"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious TSPY_DRIDEX.YSMV Sample a497de7f2488… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a497de7f2488…. Malware family: TSPY_DRIDEX.YSMV. Threat score 100/100. 21/28 AV engines flagged this file. 10 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]