21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 28:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample a6d39ae99047… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a6d39ae99047…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940"],"about":{"@type":"SoftwareApplication","name":"ic-0.adf9b86c20067.exe","applicationCategory":["peexe","executable"],"identifier":"a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACIndERXAVV1AAAAAAAAAAAiN4RFeFV3iFAAAIdwAAAAIjeERXhVd4hxAAiPgAAAACI3hEV4VXeIdwCI+IAAAAAiN4RFeFV3iHd4j4+AAAAAIjeERXhVd4h3iPj4AAAAACI3hEV4VXeIeIiPgAAAAAAiN4RFeFV3h4eI/wAAAAAAIjeERXhVd3h4iIAAAAAAACI3hEV4VXeHd4cAAAAAAAAiJ3RFeFVYd3h1AAAAAAAAEHeIdwcxd3iHdQAAAAAAAH/////3M4eHN3UAAAAAAAj4iIiIj4eIhzd1AAAAAACPiP///4j/d4hzdQAAAAAI+P/////4j4eIdzEAAAAAf4///////4j3iHczAAAAAIj///////+IiIh3cQAAAACI////////iIh4d3UAAAAAiP///////4d4iHd1AAAAAIj//4j///+HeIh3dQAAAAB4/4iIiI//d3eId3UAAAAAePiP+IiPiHeHd3d1AAAAAHb/////+IiHiI93dQAAAABwf////4iI+HiP93UAAAAAeAf////4eIiHiP91AAAAAAdwf/+P/3d3h0iPgQAAAAAAhwB4//gAd3AAAAAAAAAAAAiHAAAAeHcAAAAAAAAAAAAAeId3eIcAAAAAAAAAAAD//////////+AAD4/gAAcH4AACB+AAAAfgAAAH4AAAD+AAAB/gAAA/4AAAf+AAAP/gAAD/4AAA/8AAAP+AAAD/AAAA/wAAAP8AAAB/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAAD/gAAA/8AAf//gAP//8AP//w==23:T556,RegCreateKeyExW RegCloseKey RegDeleteValueW RegEnumKeyW RegOpenKeyExW RegDeleteKeyW CopyFileW GetModuleFileNameW GetVersionExW GetFileAttributesW LoadLibraryA GetFileSize OpenProcess GetCommandLineW LoadLibraryExW CreateDirectoryW DeleteFileW GetProcAddress GetTempFileNameW GetModuleHandleA CreateThread LoadLibraryW FindNextFileW GetTempPathW FindFirstFileW GetModuleHandleW WriteFile CreateFileW CreateProcessW Sleep GetTickCount ShellExecuteW FindWindowExW IsDebuggerPresent GetModuleFileNameA UnhandledExceptionFilter ExitThread TerminateProcess GetStartupInfoA CreateFileA GetCommandLineA VirtualAlloc RegCreateKeyW CryptEncrypt OpenProcessToken CreateServiceW RegEnumKeyExW StartServiceW GetDriveTypeW OpenFileMappingW OutputDebugStringA DeviceIoControl GetModuleHandleExW CreateToolhelp32Snapshot GetStartupInfoW CreateFileMappingW GetFileSizeEx FindFirstFileExA FindNextFileA Process32NextW Process32FirstW MapViewOfFile socket recv send WSAStartup connect sendto closesocket LockResource FindResourceExW FindResourceW VirtualProtect ShellExecuteExW SetSecurityDescriptorDacl RegOpenKeyW GetFileAttributesExW SetWindowsHookExW GetWindowThreadProcessId FindWindowW SleepEx HttpQueryInfoW InternetConnectW InternetReadFile InternetCloseHandle HttpSendRequestW InternetOpenW24:T565,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" ".exe" touched file "C:\Windows\System32\tzres.dll" ".exe" touched file "C:\Windows\System32\en-US\tzres.dll.mui" ".exe" touched file "C:\Windows\System32\rsaenh.dll" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\System32\regsvr32.exe" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "regsvr32.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "regsvr32.exe" touched file "C:\Windows\System32\regsvr32.exe" "regsvr32.exe" touched file "C:\Windows\AppPatch\AcGenral.dll"25:T41d,"regsvr32.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SMSHELLEXTS") "regsvr32.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\*\SHELLEX\CONTEXTMENUHANDLERS\SMSHELLEXTS"; Key: "(DEFAULT)"; Value: "{3871F95B-BF7A-4c17-950B-3ECBCA765A45}"), "regsvr32.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\DRAGDROPHANDLERS"), "regsvr32.exe" (Access type: "CREATE"; Path: "HKCR\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\DRAGDROPHANDLERS\SMSHELLEXTS"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKCR\SOFTWARE\CLASSES\DIRECTORY\SHELLEX\DRAGDROPHANDLERS\SMSHELLEXTS"; Key: "(DEFAULT)"; Value: "{52B7BC0E-DC49-4678-913A-CB2D5D47A83D}"), "regsvr32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLICONOVERLAYIDENTIFIERS\ !!!SMICO"), "regsvr32.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLICONOVERLAYIDENTIFIERS\ !!!SMICO"; Key: "(DEFAULT)"; Value: "{C6E713CA-A7FD-4C73-9E34-AD7676CB957F}")26:T5d7,Found malicious artifacts related to "45.32.153.241": ... URL: http://np.powzip.club/ (AV positives: 1/67 scanned on 09/27/2018 10:13:39) URL: http://45.32.153.241/ (AV positives: 1/67 scanned on 09/25/2018 16:24:21) URL: http://hnt.powzip.club/ (AV positives: 1/67 scanned on 09/11/2018 10:28:07) File SHA256: 0c8ff856f752ba8ff7ae5039a893e854cdb57aaa788a8016c5bef9a85a30e13a (AV positives: 39/70 scanned on 09/27/2018 17:48:00) File SHA256: e5411c0f4c3829d9cfba81e55d47d60ffc5101eaacd10ddcaccb5cbe09a1edbc (AV positives: 41/71 scanned on 09/26/2018 08:06:08) File SHA256: 89f8c9063c177f8b8638b2bbff5ab90538bbaee4809fb0b3f0c08087a84b89d8 (AV positives: 39/71 scanned on 09/22/2018 02:47:46) File SHA256: 38c72170fedea1d230455b344648aa460d4d1e2eac6b79a89407d4da43717558 (AV positives: 42/71 scanned on 09/22/2018 04:38:55) File SHA256: 36a6624a478e9af1ca1b53dc9fdeb119bdc033299ea0682630cc5f71064aa10f (AV positives: 36/71 scanned on 09/22/2018 04:11:55) File SHA256: 772ff09e3f52030d0e5371ce72bbc101f1109baf93c7c97628775e2a7e1a7897 (Date: 08/29/2018 09:51:50) File SHA256: 7465a48f6e002900a029babc60411428ea99f0b53380b978903eec2c899628a4 (Date: 08/13/2018 09:49:50) File SHA256: 6cfc996d0af53db7cbebc6b4c79018f29bfb4655a96fa812fd57e451cbece935 (Date: 08/10/2018 20:26:06) File SHA256: a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940 (Date: 08/10/2018 20:25:11) File SHA256: 66d34ee37074df0dcc5ea56b6cfd97cba7e919679aea2f36b231027fbdc22db9 (Date: 08/07/2018 20:44:44)27:T534,"7z.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "Powzip.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "smkernel.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "smshellext.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "smexplorerinternal.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "smmount.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "smmanger.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "donate.ico" has type "MS Windows icon resource - 1 icon 64x64" "delete.ico" has type "MS Windows icon resource - 1 icon 64x64" "add.ico" has type "MS Windows icon resource - 1 icon 64x64" "01.xml" has type "XML 1.0 document UTF-8 Unicode (with BOM) text" "mount.ico" has type "MS Windows icon resource - 1 icon 64x64" "04.xml" has type "XML 1.0 document UTF-8 Unicode (with BOM) text" "preview.ico" has type "MS Windows icon resource - 1 icon 64x64" "02.xml" has type "XML 1.0 document UTF-8 Unicode (with BOM) text" "up_folder.ico" has type "MS Windows icon resource - 1 icon 24x24" "03.xml" has type "XML 1.0 document UTF-8 Unicode (with BOM) text" "conf.db" has type "data"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["evasive"],"file_activity":{"dropped_files":[],"extracted_files":[{"name":"add.ico","sha256":"c8c2774e894acc489903a7e1616d90bc89ae9911baeaa56dbed4e65e064e4a10","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"delete.ico","sha256":"3c5a4981312cf768f28230bf65a25b0d24e113d758315a04f2611f81d8003d07","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"smshellext.dll","sha256":"71a2bebf7b5d78dcea1f871922c6ff34def2b687bb11e08a2948849c129a643f","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"01.xml","sha256":"d9086ac97db8a50f9b267ca17a036bd514af00bca0532fb1d60dd5b351d8e1ab","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"extract.ico","sha256":"8073bea3e95e29e78785a87a9e90c0c4919f29ff532718c934a704a76b309172","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"mount.ico","sha256":"21104a200b05ae906af97fba846829dcefa417732a641a24804cfb3ca4b55d37","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"up_folder.ico","sha256":"3f3bb641a14ad989070a5b757730fd24e2b282c42605acef1f8ecff766a407f2","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Powzip.dll","sha256":"b6782df13e82a1cad774f42e39304c8ab357d3b1465acc7cc4fa9ce98e44c041","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"smkernel.dll","sha256":"63f24b40ab4fe11e0080f18ce0afc8759c5ace514fa51a5c573a3c690b3af0a3","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"smmount.exe","sha256":"b37d15b8275ed85864a207031a29f6b7fdaab1ec2bc06ef08679b21521b73953","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"03.xml","sha256":"6a3ae4170b0ab3dae1cc46f8ac6561685b37a56517233000c832b19b38929e2c","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"conf.db","sha256":"5b5eda50cc3866c9500ad2ba9aa10fa57de50e36d601d90174399205f3f568a2","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"7z.dll","sha256":"ddbe753af3c48600910852c185ac21ad1c19765a1799b5478c8ac373fb6bbba3","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"smexplorerinternal.exe","sha256":"1804028c850e3cf529a76b852e07e9d601e23431caee9d4bc1c226013f3f9bdb","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"smmanger.dll","sha256":"6d3274d76c4a637c8b81e7cf6fc19278cbc301006ac64b97afc4bb4554d14270","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"malicious"},{"name":"System.dll","sha256":"7851cb12fa4131f1fee5de390d650ef65cac561279f1cfe70ad16cc9780210af","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"02.xml","sha256":"95a36d823ba60b12c3b9fafad2f41909f1d69120d6bf5ec6c4cbee010d33f1ab","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"04.xml","sha256":"af890bb21fbaa1a6fa4e9493ac46dbbf232c18e8e226bc1c22bf10548a741a82","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"donate.ico","sha256":"5b00d067eb8e8ca5ddc5cee0a8ebffea9116f24686c5ffc36a543afe8c5353ae","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"preview.ico","sha256":"c4280d2cab7a2f8cd3080fcaaffff0e747e3cea1eaf3ce94af7d046f9ebc32f5","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"},{"name":"wizard.ico","sha256":"8926c13b5869ab60c51cc4b2fdfa86dbb31d831f97eaac2424b84e20b58ef53e","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"C:\\a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940.exe","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\smexplorerinternal.exe","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"C:\\Program Files","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\Powzip.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\smshellext.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%TEMP%\\nsgA045.tmp","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"C:\\Users\\Public","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\extract.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\smmount.exe","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\add.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\mount.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PUBLIC%\\Documents","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\locales","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\locales\\04.xml","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\preview.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\wizard.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\regsvr32.exe","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%TEMP%\\nsgA045.tmp\\System.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"C:\\share","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PUBLIC%\\Documents\\XMUpdate\\conf.db","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\Powzip.exe","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\donate.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\smkernel.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\smmanger.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\locales\\01.xml","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\locales\\02.xml","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\delete.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PUBLIC%\\Documents\\XMUpdate","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\locales\\03.xml","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar\\up_folder.ico","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\regsvr32.exe.mui","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"C:\\Users","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\theme\\toolbar","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Powzip\\7z.dll","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\_","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\Mutex_30529524-5368-41ba-80C6-DC17066687A2_conf.db","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"45.32.153.241","country":"United States","port":5519,"protocol":"TCP","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]}],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["WSHTCPIP.DLL","ntdll.dll","rasadhlp.dll","user32.dll","msasn1.dll","sfc.dll","msctf.dll","AcGenral.dll","shlwapi.dll","dhcpcsvc.dll","cryptsp.dll","cfgmgr32.dll","rpcrt4.dll","gdi32.dll","iertutil.dll","devobj.dll","wintrust.dll","propsys.dll","winrnr.dll","shell32.dll","mpr.dll","dhcpcsvc6.dll","NapiNSP.dll","ntmarta.dll","winnsi.dll","apphelp.dll","dwmapi.dll","tzres.dll","comctl32.dll","wininet.dll","nsi.dll","IPHLPAPI.DLL","sfc_os.dll","urlmon.dll","smshellext.dll","dxgi.dll","profapi.dll","rsaenh.dll","psapi.dll","lpk.dll","uxtheme.dll","pnrpnsp.dll","dnsapi.dll","kernel32.dll","nlaapi.dll","Wldap32.dll","msacm32.dll","cryptbase.dll","userenv.dll","mswsock.dll","Powzip.dll","samcli.dll","imm32.dll","msvcrt.dll","advapi32.dll","crypt32.dll","KernelBase.dll","sechost.dll","setupapi.dll","winmm.dll","System.dll","shfolder.dll","FWPUCLNT.DLL","version.dll","sspicli.dll","usp10.dll","ws2_32.dll","ole32.dll","clbcatq.dll","oleaut32.dll"],"processes":[{"command_line":"","icon":"$22","name":"a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940.exe","normalized_path":"C:\\a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940.exe","pid":3180,"ppid":0,"sha256":"a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940","uid":"00041789-00003180"},{"command_line":"regsvr32 /s \"%PROGRAMFILES%\\Powzip\\smshellext.dll\"","name":"regsvr32.exe","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00041789-00003180","pid":1940,"ppid":3180,"sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","uid":"00043804-00001940"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},"registry_activity":{"keys_created":[{"key":"HKCR\\SOFTWARE\\CLASSES\\APPID\\{9CC34070-3A38-4C7A-89CB-EF8177EF07A1}\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{3871F95B-BF7A-4C17-950B-3ECBCA765A45}\\PROGID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{3871F95B-BF7A-4C17-950B-3ECBCA765A45}\\TYPELIB\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMSHELLEXT.ICONOVERLAY.1\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMSHELLEXT.ICONOVERLAY\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMSHELLEXT.ICONOVERLAY\\CURVER\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{52B7BC0E-DC49-4678-913A-CB2D5D47A83D}\\TYPELIB\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\DRAGDROPHANDLERS\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\DIRECTORY\\SHELLEX\\DRAGDROPHANDLERS\\SMSHELLEXTS\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\APPID\\SMSHELLEXT.DLL\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMSHELLEXT.ICONOVERLAY\\CLSID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{C6E713CA-A7FD-4C73-9E34-AD7676CB957F}\\PROGID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{52B7BC0E-DC49-4678-913A-CB2D5D47A83D}\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{C6E713CA-A7FD-4C73-9E34-AD7676CB957F}\\INPROCSERVER32\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{C6E713CA-A7FD-4C73-9E34-AD7676CB957F}\\TYPELIB\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.DRAGDROPMENU.1\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.DRAGDROPMENU\\CURVER\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.CONTEXTMENUEXT\\CURVER\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{3871F95B-BF7A-4C17-950B-3ECBCA765A45}\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.DRAGDROPMENU\\CLSID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.CONTEXTMENUEXT.1\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{3871F95B-BF7A-4C17-950B-3ECBCA765A45}\\VERSIONINDEPENDENTPROGID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMSHELLEXT.ICONOVERLAY.1\\CLSID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.DRAGDROPMENU.1\\CLSID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{52B7BC0E-DC49-4678-913A-CB2D5D47A83D}\\VERSIONINDEPENDENTPROGID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.CONTEXTMENUEXT\\CLSID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{3871F95B-BF7A-4C17-950B-3ECBCA765A45}\\INPROCSERVER32\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.DRAGDROPMENU\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.CONTEXTMENUEXT.1\\CLSID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\SMARTMOUNTSHELL.CONTEXTMENUEXT\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\*\\SHELLEX\\CONTEXTMENUHANDLERS\\SMSHELLEXTS\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{C6E713CA-A7FD-4C73-9E34-AD7676CB957F}\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{C6E713CA-A7FD-4C73-9E34-AD7676CB957F}\\VERSIONINDEPENDENTPROGID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{52B7BC0E-DC49-4678-913A-CB2D5D47A83D}\\PROGID\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"key":"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{52B7BC0E-DC49-4678-913A-CB2D5D47A83D}\\INPROCSERVER32\\","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]}],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Network Traffic","Extracted Files","TOR analysis"],"sandbox_reports":[{"analysis_start_time":"2018-10-04T04:37:10+00:00","contacted_countries":["USA"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"5bb57cba7ca3e17cc767fafa","indicators_count":{"informative":26,"malicious":12,"suspicious":26},"is_in_unified_schema":true,"malware_family":"Trojan.Generic","state":"SUCCESS","submit_name":"ic-0.adf9b86c20067.exe","tags":["Network Traffic","Extracted Files","TOR analysis"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":1,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":21,"files_deleted_count":0,"files_written_count":57,"http_requests_count":0,"imported_dlls_count":70,"injected_processes_count":0,"mutex_created_count":2,"process_count":2,"registry_keys_created_count":36,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":36,"script_calls_count":0,"spawned_processes_count":2}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Trojan.Generic"}]},"av_detections":{"engines":{"aegislab":{"data_source":"MetaDefender","name":"AegisLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"ADWARE/Avantov.246","verdict":"malicious"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.GenericKD.31160263","verdict":"malicious"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"comodo":{"data_source":"MetaDefender","name":"Comodo","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"ApplicUnwnt","verdict":"malicious"},"cyren":{"data_source":"MetaDefender","name":"Cyren","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"a variant of Win32/Winsecsrv.H.gen trojan","verdict":"malicious"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan ( 0056e5201 )","verdict":"malicious"},"kaspersky":{"data_source":"MetaDefender","name":"Kaspersky","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Agent.qwhdiz","verdict":"malicious"},"mcafee":{"data_source":"MetaDefender","name":"McAfee","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"microsoftdefender":{"data_source":"MetaDefender","name":"Microsoft Defender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Ursu.fhmtdj","verdict":"malicious"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Win32.Malware","verdict":"malicious"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicro":{"data_source":"MetaDefender","name":"Trend Micro","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trendmicrohousecall":{"data_source":"MetaDefender","name":"Trend Micro HouseCall","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"PUP.Win32.AvanpostitTov.A","verdict":"malicious"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"BScope.Trojan.Agent","verdict":"malicious"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware","verdict":"malicious"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan.Agent.Win32.920081","verdict":"malicious"}}},"incidents":[{"details":[{"detail":"Uses network protocols on unusual ports"}],"details_count":1,"name":"Remote Access","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"}],"details_count":2,"name":"Spyware","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"details":[{"detail":"Writes data to a remote process"},{"detail":"Interacts with the primary disk partition (DR0)"}],"details_count":2,"name":"Persistence","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"details_count":2,"name":"Fingerprint","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"details":[{"detail":"Possibly checks for the presence of an Antivirus engine"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"details_count":1,"name":"Spreading","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Collection","technique":"Clipboard Data"},{"attack_id":"T1065","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1065","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Uncommonly Used Port"},{"attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1067","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1067","identifiers":[{"type":"malicious","value":"Interacts with the primary disk partition (DR0)"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Persistence","technique":"Bootkit"},{"attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Code Signing"},{"attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Input Capture"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Data Compressed"},{"attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Persistence","technique":"Kernel Modules and Extensions"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1060","identifiers":[{"type":"informative","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Persistence","technique":"Registry Run Keys / Start Folder"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Modify Registry"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}],"tactic":"Discovery","technique":"Security Software Discovery"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"SizeofResource@KERNEL32.dll at 24983-3536-0040CEDF\n FreeResource@KERNEL32.dll at 24983-3537-0040CE0A\n LoadResource@KERNEL32.dll at 24983-3538-0040CDCA\n LoadResource@KERNEL32.dll at 24983-4054-004102E2\n LoadResource@KERNEL32.dll at 24983-4047-00414149\n LoadResource@KERNEL32.dll at 24983-7241-0040C482\n FindResourceW@KERNEL32.dll at 41963-818-10004ED6\n LoadResource@KERNEL32.dll at 41963-778-10004E7B\n FindResourceExW@KERNEL32.dll at 41963-779-10004F05\n LoadResource@KERNEL32.dll at 46990-1492-004094E0\n FindResourceExW@KERNEL32.dll at 46990-1497-00409630\n FindResourceW@KERNEL32.dll at 46990-1491-00409490\n LoadResource@KERNEL32.dll at 46990-1713-004179F0","id":"stream-32","level":"suspicious","name":"Contains ability to find and load resources of a specific module","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"External Systems","description":"41/69 Antivirus vendors marked sample as malicious (59% detection rate)","id":"avtest-3","level":"malicious","name":"Sample was identified as malicious by a large number of Antivirus engines","origin":"External System","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Network Related","description":"TCP traffic to 45.32.153.241 on port 5519","id":"network-7","level":"malicious","mitre_attack_id":"T1065","name":"Uses network protocols on unusual ports","origin":"Network Traffic","relevance":7,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetVersion@KERNEL32.DLL at 00041789-00003180-19614-15-00406805\n GetVersionExW@KERNEL32.DLL at 00041789-00003180-19614-58-004063AC\n GetVersion@KERNEL32.DLL at 00041789-00003180-24816-15-00406805\n GetVersionExW@KERNEL32.dll at 24983-3593-0041016E\n GetVersionExW@KERNEL32.dll at 24983-3827-004174D0\n GetVersionExW@KERNEL32.dll at 46990-1795-00409740","id":"stream-3","level":"informative","name":"Contains ability to query the machine version","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" created file \"%TEMP%\\nsgA045.tmp\\System.dll\"\n \".exe\" created file \"%TEMP%\\nsgA045.tmp\\Powzip.dll\"","id":"api-4","level":"informative","name":"Creates a writable file in a temporary directory","origin":"API Call","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"regsvr32.exe\" with commandline \"regsvr32 /s \"%PROGRAMFILES%\\Powzip\\smshellext.dll\"\" (UID: 00043804-00001940)","id":"target-25","level":"informative","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Network Related","description":"Pattern match: \"https://secure.comodo.net/CPS0C\"\n Pattern match: \"crl.comodoca.com/COMODORSACodeSigningCA.crl0t\"\n Pattern match: \"crt.comodoca.com/COMODORSACodeSigningCA.crt0$\"\n Pattern match: \"http://ocsp.comodoca.com0\"\n Pattern match: \"http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q\"\n Pattern match: \"http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0\"\n Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://www.Powzip.cc\"\n Pattern match: \"http://www.Powzip.cc/about.html\"\n Pattern match: \"http://www.Powzip.cc/help.html\"\n Heuristic match: \"ate.SZ\"\n Pattern match: \"www.smartmount.cc\"\n Pattern match: \"http://}|({ftp://}({.+}:{.+}@)?)\"","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","id":"api-6","level":"suspicious","name":"Reads configuration files","origin":"API Call","relevance":4,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\"7z.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"Powzip.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"smkernel.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"smshellext.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"smexplorerinternal.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"smmount.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"smmanger.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","id":"binary-1","level":"suspicious","name":"Drops executable files","origin":"Binary File","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"System Destruction","description":"\"C:\\a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940.exe\" marked \"%TEMP%\\nss9F9A.tmp\" for deletion\n \"C:\\a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940.exe\" marked \"%TEMP%\\nsgA045.tmp\" for deletion","id":"api-26","level":"suspicious","mitre_attack_id":"T1107","name":"Marks file for deletion","origin":"API Call","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"ExitWindowsEx@USER32.DLL at 00041789-00003180-19614-1-00403883\n ExitWindowsEx@USER32.DLL at 00041789-00003180-24816-1-00403883\n ExitWindowsEx@USER32.dll at 24983-4579-0043F943","id":"stream-23","level":"malicious","name":"Contains ability to reboot/shutdown the operating system","origin":"Hybrid Analysis Technology","relevance":5,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetDiskFreeSpaceW@KERNEL32.DLL at 00041789-00003180-19614-86-004044A5\n GetDiskFreeSpaceW@KERNEL32.DLL at 00041789-00003180-24816-89-004044A5\n GetDiskFreeSpaceExW@KERNEL32.dll at 26633-2853-10011430\n GetDiskFreeSpaceExW@KERNEL32.dll at 26633-2453-10034B60\n GetDiskFreeSpaceExW@KERNEL32.dll at 26633-2746-10010F70\n GetDiskFreeSpaceExW@KERNEL32.dll at 53141-2585-10084D50","id":"stream-37","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to query volume size","origin":"Hybrid Analysis Technology","relevance":3,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"The entire certificate chain of the input sample was validated successfully.","id":"certificate-2","level":"informative","name":"The input sample is signed with a valid certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940.bin\" was detected as \"Nullsoft PiMP Stub -> SFX\"\n \"7z.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"Powzip.dll\" was detected as \"Borland Delphi 3.0 (???)\"\n \"smkernel.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"smshellext.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"\n \"smexplorerinternal.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"smmount.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"smmanger.dll\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","id":"static-18","level":"informative","mitre_attack_id":"T1002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"InternetReadFile@WININET.dll at 53141-2895-10007F6C","id":"stream-17","level":"suspicious","name":"Contains ability to download files from the internet","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"System Destruction","description":"\".exe\" opened \"%TEMP%\\nss9F9A.tmp\" with delete access\n \".exe\" opened \"%TEMP%\\nsgA045.tmp\" with delete access","id":"api-25","level":"suspicious","name":"Opens file with deletion access rights","origin":"API Call","relevance":7,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"System Security","description":"SetSecurityDescriptorDacl@ADVAPI32.dll at 24983-3515-0043F774\n SetSecurityDescriptorDacl@ADVAPI32.dll at 46990-1591-004033E0","id":"stream-44","level":"suspicious","name":"Contains ability to elevate privileges","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$23","id":"static-1","level":"suspicious","name":"Imports suspicious APIs","origin":"Static Parser","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}\\Parameters\"","id":"api-20","level":"malicious","mitre_attack_id":"T1055","name":"Allocates virtual memory in a remote process","origin":"API Call","relevance":7,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetTimeZoneInformation@KERNEL32.dll at 26633-2433-100364F0\n GetTimeZoneInformation@KERNEL32.dll at 26633-2314-1005C0AE\n GetTimeZoneInformation@KERNEL32.dll at 53141-2298-1009A969","id":"stream-48","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query the machine timezone","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{B26B3E84-2716-4DB6-BFB6-7FBDFE26C69C}\")","id":"registry-55","level":"informative","mitre_attack_id":"T1012","name":"Reads the registry for installed applications","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"The input sample is signed with a certificate issued by \"CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: 63:19:6F:07:BE:F0:69:77:91:68:0D:B9:38:55:0B:AF:46:BC:53:18; see report for more information)\n The input sample is signed with a certificate issued by \"CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB\" (SHA1: B6:9E:75:2B:BE:88:B4:45:82:00:A7:C0:F4:F5:B3:CC:E6:F3:5B:47; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft Code Verification Root, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US\" (SHA1: 10:68:70:65:9C:06:9F:24:8C:8C:0A:05:AC:D8:71:CA:BE:B3:CC:38; see report for more information)","id":"certificate-0","level":"informative","mitre_attack_id":"T1116","name":"The input sample is signed with a certificate","origin":"Certificate Data","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"$24","id":"api-55","level":"informative","name":"Touches files in the Windows directory","origin":"API Call","relevance":7,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"regsvr32.exe\" opened \"\\Device\\KsecDD\"","id":"api-37","level":"informative","mitre_attack_id":"T1215","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","origin":"API Call","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"DeviceIoControl@KERNEL32.dll at 26633-2782-1000BC20\n DeviceIoControl@KERNEL32.dll at 26633-2787-1000B990\n DeviceIoControl@KERNEL32.dll at 26633-2853-10011430\n DeviceIoControl@KERNEL32.dll at 26633-2803-1000BF30","id":"stream-21","level":"malicious","name":"Contains ability to start/interact with device drivers","origin":"Hybrid Analysis Technology","relevance":8,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"\"G:\\Work\\smartmount\\Src\\Bin\\Win32\\Release\\SMExplorerInternal.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"$25","id":"registry-0","level":"informative","mitre_attack_id":"T1060","name":"Modifies auto-execute functionality by setting/creating a value in the registry","origin":"Registry Access","relevance":8,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"External Systems","description":"41/69 Antivirus vendors marked sample as malicious (59% detection rate)","id":"avtest-0","level":"malicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","relevance":8,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\".exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\regsvr32.exe\" (Handle: 584)\n \".exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\regsvr32.exe\" (Handle: 584)\n \".exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\regsvr32.exe\" (Handle: 584)\n \".exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\regsvr32.exe\" (Handle: 584)","id":"api-0","level":"malicious","mitre_attack_id":"T1055","name":"Writes data to a remote process","origin":"API Call","relevance":6,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Network Related","description":"$26","id":"network-21","level":"malicious","name":"Malicious artifacts seen in the context of a contacted host","origin":"Network Traffic","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"System.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"regsvr32.exe\" with commandline \"regsvr32 /s \"%PROGRAMFILES%\\Powzip\\smshellext.dll\"\" (UID: 00043804-00001940)","id":"target-103","level":"informative","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"$27","id":"binary-0","level":"informative","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","id":"registry-1","level":"suspicious","mitre_attack_id":"T1012","name":"Reads the cryptographic machine GUID","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"GetAsyncKeyState@USER32.DLL at 00041789-00003180-19614-86-004044A5\n GetAsyncKeyState@USER32.DLL at 00041789-00003180-24816-89-004044A5\n GetAsyncKeyState@USER32.dll at 24983-4065-0040FB4A","id":"stream-12","level":"suspicious","mitre_attack_id":"T1056","name":"Contains ability to retrieve keyboard strokes","origin":"Hybrid Analysis Technology","relevance":8,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"7z.dll\" claimed CRC 898643 while the actual is CRC 2578946\n \"smkernel.dll\" claimed CRC 192972 while the actual is CRC 631006\n \"smshellext.dll\" claimed CRC 267605 while the actual is CRC 71366\n \"smexplorerinternal.exe\" claimed CRC 935241 while the actual is CRC 267605\n \"smmount.exe\" claimed CRC 373682 while the actual is CRC 935241\n \"smmanger.dll\" claimed CRC 1072015 while the actual is CRC 373682","id":"static-0","level":"suspicious","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthyness","description":"\".exe\" created file \"Scsi3:\"\n \".exe\" created file \"Scsi4:\"\n \".exe\" created file \"Scsi5:\"\n \".exe\" created file \"Scsi6:\"\n \".exe\" created file \"Scsi7:\"\n \".exe\" created file \"Scsi8:\"\n \".exe\" created file \"Scsi9:\"\n \".exe\" created file \"Scsi10:\"\n \".exe\" created file \"Scsi11:\"\n \".exe\" created file \"Scsi12:\"\n \".exe\" created file \"Scsi13:\"\n \".exe\" created file \"Scsi14:\"\n \".exe\" created file \"Scsi15:\"","id":"api-19","level":"malicious","name":"Creates a resource fork (ADS) file (often used to hide data)","origin":"API Call","relevance":8,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"Raw size of \".ndata\" is zero","id":"static-5","level":"informative","name":"PE file contains zero-size sections","origin":"Static Parser","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"\"45.32.153.241:5519\"","id":"network-1","level":"informative","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Installation/Persistance","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"regsvr32.exe\" connecting to \"\\ThemeApiPort\"","id":"api-16","level":"informative","name":"Connects to LPC ports","origin":"API Call","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"System Destruction","description":"\".exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x74080\n \".exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x7c088\n \".exe\" interacting with \"\\Device\\Harddisk0\\DR0\" using IoControlCode 0x2d1400","id":"api-59","level":"malicious","mitre_attack_id":"T1067","name":"Interacts with the primary disk partition (DR0)","origin":"API Call","relevance":5,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 1005C1DAh\" at 26633-2314-1005C0AE\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [ebp+04h], 05h\" and \"jc 004177E8h\" at 24983-3827-004174D0\n Found API call GetVersionExW@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-00000124h], 00000000h\" and \"je 004097B6h\" at 46990-1795-00409740\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, edi\" and \"je 1009AB85h\" at 53141-2298-1009A969","id":"stream-39","level":"informative","name":"Makes a code branch decision directly after an API that is environment aware","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetProcessHeap@KERNEL32.dll at 24983-7964-00469BB8\n GetProcessHeap@KERNEL32.dll at 41963-1182-10010B88\n GetProcessHeap@KERNEL32.dll at 41963-1978-1002514F\n GetProcessHeap@KERNEL32.dll at 41963-1864-10010D19\n GetProcessHeap@KERNEL32.dll at 41963-1274-1002389A\n GetProcessHeap@KERNEL32.dll at 46990-2921-004322F2\n GetProcessHeap@KERNEL32.dll at 53141-2125-1009D65B","id":"stream-31","level":"informative","name":"Possibly tries to detect the presence of a debugger","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"\"vbox\" (Indicator: \"vbox\")\n \"vmware\" (Indicator: \"vmware\")\n \"\\virtualbox\" (Indicator: \"virtualbox\")\n \"\\vmware\" (Indicator: \"vmware\")","id":"string-1","level":"suspicious","name":"Possibly tries to implement anti-virtualization techniques","origin":"File/Memory","relevance":4,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"OpenClipboard@USER32.DLL at 00041789-00003180-19614-91-004050CD\n OpenClipboard@USER32.DLL at 00041789-00003180-24816-94-004050CD\n OpenClipboard@USER32.dll at 24983-3940-00410826\n OpenClipboard@USER32.dll at 24983-4085-004107E3\n OpenClipboard@USER32.dll at 24983-3933-0041080C\n OpenClipboard@USER32.dll at 24983-4595-00440853","id":"stream-0","level":"suspicious","mitre_attack_id":"T1115","name":"Contains ability to open the clipboard","origin":"Hybrid Analysis Technology","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"6/76 Antivirus vendors marked dropped file \"7z.dll\" as malicious (classified as \"Trojan.Agent\" with 7% detection rate)\n 36/66 Antivirus vendors marked dropped file \"Powzip.dll\" as malicious (classified as \"Gen:Variant.Ursu\" with 54% detection rate)\n 30/67 Antivirus vendors marked dropped file \"smkernel.dll\" as malicious (classified as \"Trojan.Generic\" with 44% detection rate)\n 6/66 Antivirus vendors marked dropped file \"smshellext.dll\" as malicious (classified as \"Trojan.Agent\" with 9% detection rate)\n 32/67 Antivirus vendors marked dropped file \"smexplorerinternal.exe\" as malicious (classified as \"Trojan.Generic\" with 47% detection rate)\n 33/68 Antivirus vendors marked dropped file \"smmount.exe\" as malicious (classified as \"Trojan.Agent\" with 48% detection rate)\n 26/66 Antivirus vendors marked dropped file \"smmanger.dll\" as malicious (classified as \"Trojan.Generic\" with 39% detection rate)","id":"binary-11","level":"malicious","name":"The analysis extracted a file that was identified as malicious","origin":"Binary File","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 24983-4853-00457CAF\n SetUnhandledExceptionFilter@KERNEL32.dll at 24983-7899-0045CD75\n SetUnhandledExceptionFilter@KERNEL32.dll at 41963-1206-1001830C\n SetUnhandledExceptionFilter@KERNEL32.dll at 46990-1381-004298AF\n SetUnhandledExceptionFilter@KERNEL32.dll at 46990-2910-0042AB65\n SetUnhandledExceptionFilter@KERNEL32.dll at 53141-2099-100B3DD0\n SetUnhandledExceptionFilter@KERNEL32.dll at 53141-1912-1008C3F7\n SetUnhandledExceptionFilter@KERNEL32.dll at 53141-2372-100B3FA0","id":"stream-4","level":"informative","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 26633-2364-10058DCA\n GetSystemTime@KERNEL32.dll at 24983-7184-0042C786\n GetLocalTime@KERNEL32.dll at 46990-2048-0041B780\n GetLocalTime@KERNEL32.dll at 53141-2667-10080D50\n GetLocalTime@KERNEL32.dll at 53141-2633-100820B0\n GetLocalTime@KERNEL32.dll at 53141-2670-10080F60","id":"stream-2","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to query machine time","origin":"Hybrid Analysis Technology","relevance":1,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\Mutex_30529524-5368-41ba-80C6-DC17066687A2_conf.db\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]},{"category":"System Security","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","id":"registry-67","level":"informative","mitre_attack_id":"T1112","name":"Creates or modifies windows services","origin":"Registry Access","relevance":10,"sources":[{"report_id":"5bb57cba7ca3e17cc767fafa","report_type":"sandbox"}]}],"stats":{"attributions":{"campaigns_count":0,"cves_count":0,"malware_families_count":1,"threat_actors_count":0,"threat_types_count":0},"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"mitre_attacks":{"total":18},"rule_matches":{"sigma_count":0,"suricata_count":0,"yara_count":0},"sandbox_signatures":{"informative_count":26,"malicious_count":11,"suspicious_count":13,"total":50}},"summary":{"score":100,"tags":["evasive"],"verdict":"malicious"}},"metadata":{"file_info":{"file_name":"ic-0.adf9b86c20067.exe","file_size":2575840,"file_type":["peexe","executable"],"file_type_id":"exe"},"hashes":{"imphash":"be41bf7b8cc010b614bd36bbca606973","md5":"b77edd4286ce7c95c340b3b4ee8c3630","sha1":"6564793497879994d27cb2c0d1a63a9935793518","sha256":"a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940","sha512":"483dfb3b6c384552b3415db3c0b21955710c91adf9a602843775392efd0694346e81f807b9ab45523ca4577c00f0b86dafca60995108993e13bc2bf893c53ad0","ssdeep":"49152:FyO42oBUYyfqq/0YnR2/Ub/Z7ZBm/gAjD2lFHT1tydLpQGqj1ffpAatUmqzU/VjX:FyHVeYMyYRC6/cnqNQ2ma6HINii","ssdeep_chunks":["49152:FyO42oB","49152:yO42oBU","49152:O42oBUY","49152:42oBUYy","49152:2oBUYyf","49152:oBUYyfq","49152:BUYyfqq","49152:UYyfqq/","49152:Yyfqq/0","49152:yfqq/0Y","49152:fqq/0Yn","49152:qq/0YnR","49152:q/0YnR2","49152:/0YnR2/","49152:0YnR2/U","49152:YnR2/Ub","49152:nR2/Ub/","49152:R2/Ub/Z","49152:2/Ub/Z7","49152:/Ub/Z7Z","49152:Ub/Z7ZB","49152:b/Z7ZBm","49152:/Z7ZBm/","49152:Z7ZBm/g","49152:7ZBm/gA","49152:ZBm/gAj","49152:Bm/gAjD","49152:m/gAjD2","49152:/gAjD2l","49152:gAjD2lF","49152:AjD2lFH","49152:jD2lFHT","49152:D2lFHT1","49152:2lFHT1t","49152:lFHT1ty","49152:FHT1tyd","49152:HT1tydL","49152:T1tydLp","49152:1tydLpQ","49152:tydLpQG","49152:ydLpQGq","49152:dLpQGqj","49152:LpQGqj1","49152:pQGqj1f","49152:QGqj1ff","49152:Gqj1ffp","49152:qj1ffpA","49152:j1ffpAa","49152:1ffpAat","49152:ffpAatU","49152:fpAatUm","49152:pAatUmq","49152:AatUmqz","49152:atUmqzU","49152:tUmqzU/","49152:UmqzU/V","49152:mqzU/Vj","49152:qzU/VjX","98304:FyO42oB","98304:yO42oBU","98304:O42oBUY","98304:42oBUYy","98304:2oBUYyf","98304:oBUYyfq","98304:BUYyfqq","98304:UYyfqq/","98304:Yyfqq/0","98304:yfqq/0Y","98304:fqq/0Yn","98304:qq/0YnR","98304:q/0YnR2","98304:/0YnR2/","98304:0YnR2/U","98304:YnR2/Ub","98304:nR2/Ub/","98304:R2/Ub/Z","98304:2/Ub/Z7","98304:/Ub/Z7Z","98304:Ub/Z7ZB","98304:b/Z7ZBm","98304:/Z7ZBm/","98304:Z7ZBm/g","98304:7ZBm/gA","98304:ZBm/gAj","98304:Bm/gAjD","98304:m/gAjD2","98304:/gAjD2l","98304:gAjD2lF","98304:AjD2lFH","98304:jD2lFHT","98304:D2lFHT1","98304:2lFHT1t","98304:lFHT1ty","98304:FHT1tyd","98304:HT1tydL","98304:T1tydLp","98304:1tydLpQ","98304:tydLpQG","98304:ydLpQGq","98304:dLpQGqj","98304:LpQGqj1","98304:pQGqj1f","98304:QGqj1ff","98304:Gqj1ffp","98304:qj1ffpA","98304:j1ffpAa","98304:1ffpAat","98304:ffpAatU","98304:fpAatUm","98304:pAatUmq","98304:AatUmqz","98304:atUmqzU","98304:tUmqzU/","98304:UmqzU/V","98304:mqzU/Vj","98304:qzU/VjX","49152:FyHVeYM","49152:yHVeYMy","49152:HVeYMyY","49152:VeYMyYR","49152:eYMyYRC","49152:YMyYRC6","49152:MyYRC6/","49152:yYRC6/c","49152:YRC6/cn","49152:RC6/cnq","49152:C6/cnqN","49152:6/cnqNQ","49152:/cnqNQ2","49152:cnqNQ2m","49152:nqNQ2ma","49152:qNQ2ma6","49152:NQ2ma6H","49152:Q2ma6HI","49152:2ma6HIN","49152:ma6HINi","49152:a6HINii"]},"submissions":{"first_seen":1538620604000,"last_multi_scan":1677382757000,"last_seen":1677382757000}},"overall_status":"SUCCESS","report_ids":{"sandbox_job_ids":["5bb57cba7ca3e17cc767fafa"]},"schema_version":"1.0.9","sha256":"a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940","threat_score":100,"unified_at":"2026-09-06T01:28:11.553Z","unified_at_epoch_ms":1788658091553,"verdict":"malicious"}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample a6d39ae99047… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a6d39ae99047…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample a6d39ae99047… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a6d39ae99047…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a6d39ae9904760d70c511d6dc4d0a4890a6fbc0d0508946b76857a963e67a940"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample a6d39ae99047… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a6d39ae99047…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 11 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L28","11",{}]]