26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample aa2ed4fae4da… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aa2ed4fae4da…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41"],"about":{"@type":"SoftwareApplication","name":"withlove.exe","applicationCategory":["peexe","executable"],"identifier":"aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":25,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T689,"_GUICtrlMenu_GetItemRectEx.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUICtrlRichEdit_ScrollLines.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "00010007.wid.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "azroles.h.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUICtrlRichEdit_GetParaTabStops.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GDIPlus_PathBrushGetWrapMode.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "AdvClientdlg.cpp.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "AcquireClientLicensor.cpp.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "2adb2fe2-ae92-4320-8e3f-3c06940ec9b5.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUICtrlMonthCal_GetCalendarCount.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "06_Pictures_rated_4_or_5_stars.wpl.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "al.exe.config.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUICtrlComboBox_GetEditSel.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_WinAPI_SetWinEventHook.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUICtrlTreeView_HitTestEx.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GDIPlus_ImageAttributesSetColorKeys.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUICtrlMonthCal_GetMonthRangeMax.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "BBqkZXE[1].jpg.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "_GUIToolTip_SetTipTextColor.au3.id-C1EE047A.[java2018@tuta.io].arrow" has type "data" "AcroRd32.exe.id-C1EE047A.[java2018@tuta.io].arrow" has type "data"28:T4a1,"" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\System32\withlove.exe" "" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\withlove.exe" "" touched file "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\withlove.exe" "" touched file "C:\Windows\System32\en-US\mpr.dll.mui" "cmd.exe" touched file "C:\Windows\System32\en-US\cmd.exe.mui" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\basebrd.dll" "cmd.exe" touched file "C:\Windows\Branding\Basebrd\en-US\basebrd.dll.mui" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "cmd.exe" touched file "C:\Windows\System32\mode.com" "cmd.exe" touched file "C:\Windows\System32\vssadmin.exe" "mode.com" touched file "C:\Windows\System32\en-US\ulib.dll.mui" "vssadmin.exe" touched file "C:\Windows\System32\en-US\vssadmin.exe.mui" "vssadmin.exe" touched file "C:\Windows\System32\rsaenh.dll" "vssadmin.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"29:T8d5,Heuristic match: "tools.google.com" Heuristic match: "*.google.com" Heuristic match: "*.android.com" Heuristic match: "*.appengine.google.com" Heuristic match: "*.cloud.google.com" Heuristic match: "*.db833953.google.cn" Heuristic match: "*.gcp.gvt2.com" Heuristic match: "*.google-analytics.com" Heuristic match: "*.google.ca" Heuristic match: "*.google.cl" Heuristic match: "*.google.co.in" Heuristic match: "*.google.co.jp" Heuristic match: "*.google.co.uk" Heuristic match: "*.google.com.ar" Heuristic match: "*.google.com.au" Heuristic match: "*.google.com.br" Heuristic match: "*.google.com.co" Heuristic match: "*.google.com.mx" Heuristic match: "*.google.com.tr" Heuristic match: "*.google.com.vn" Heuristic match: "*.google.de" Heuristic match: "*.google.es" Heuristic match: "*.google.fr" Heuristic match: "*.google.hu" Heuristic match: "*.google.it" Heuristic match: "*.google.nl" Heuristic match: "*.google.pl" Heuristic match: "*.google.pt" Heuristic match: "*.googleadapis.com" Heuristic match: "*.googleapis.cn" Heuristic match: "*.googlecommerce.com" Heuristic match: "*.googlevideo.com" Heuristic match: "*.gstatic.cn" Heuristic match: "*.gstatic.com" Heuristic match: "*.gvt1.com" Heuristic match: "*.gvt2.com" Heuristic match: "*.metric.gstatic.com" Heuristic match: "*.urchin.com" Heuristic match: "*.url.google.com" Heuristic match: "*.youtube-nocookie.com" Heuristic match: "*.youtube.com" Heuristic match: "*.youtubeeducation.com" Heuristic match: "*.ytimg.com" Heuristic match: "android.clients.google.com" Heuristic match: "android.com" Heuristic match: "developer.android.google.cn" Heuristic match: "developers.android.google.cn" Heuristic match: "google-analytics.com" Heuristic match: "google.com" Heuristic match: "googlecommerce.com" Heuristic match: "source.android.google.cn" Pattern match: "www.goo.gl" Heuristic match: "youtube.com" Heuristic match: "youtubeeducation.com" Pattern match: "http://pki.goog/gsr2/GTSGIAG3.crt0" Pattern match: "http://ocsp.pki.goog/GTSGIAG30" Pattern match: "http://crl.pki.goog/GTSGIAG3.crl0" Pattern match: "http://ocsp.pki.goog/gsr202" Pattern match: "http://crl.pki.goog/gsr2/gsr2.crl0" Pattern match: "https://pki.goog/repository/0"2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790727462408,"unified_at":"2026-09-30T00:17:42.408Z","metadata":{"hashes":{"sha256":"aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41","sha1":"98ec5bff9db1559bf76aa81b122f3375fb3b1224","md5":"6419a14de6fb2b29bcd287ae754228d8","sha512":"9b1fd59828a9637c00af52766136f8b2b61e4736eba7097ba017ece7490a35e1728553ef17fedd2f364143c4d9cc0fe189452206d10823e0fe57d7f98877b21d","ssdeep":"1536:mBwl+KXpsqN5vlwWYyhY9S4Au2gC4c0RtNmJR9u0Yet8m8e9g7HbScWJ:Qw+asqN5aW/hLM7RtNS9eese0HGcy","ssdeep_chunks":["1536:mBwl+KX","1536:Bwl+KXp","1536:wl+KXps","1536:l+KXpsq","1536:+KXpsqN","1536:KXpsqN5","1536:XpsqN5v","1536:psqN5vl","1536:sqN5vlw","1536:qN5vlwW","1536:N5vlwWY","1536:5vlwWYy","1536:vlwWYyh","1536:lwWYyhY","1536:wWYyhY9","1536:WYyhY9S","1536:YyhY9S4","1536:yhY9S4A","1536:hY9S4Au","1536:Y9S4Au2","1536:9S4Au2g","1536:S4Au2gC","1536:4Au2gC4","1536:Au2gC4c","1536:u2gC4c0","1536:2gC4c0R","1536:gC4c0Rt","1536:C4c0RtN","1536:4c0RtNm","1536:c0RtNmJ","1536:0RtNmJR","1536:RtNmJR9","1536:tNmJR9u","1536:NmJR9u0","1536:mJR9u0Y","1536:JR9u0Ye","1536:R9u0Yet","1536:9u0Yet8","1536:u0Yet8m","1536:0Yet8m8","1536:Yet8m8e","1536:et8m8e9","1536:t8m8e9g","1536:8m8e9g7","1536:m8e9g7H","1536:8e9g7Hb","1536:e9g7HbS","1536:9g7HbSc","1536:g7HbScW","1536:7HbScWJ","3072:mBwl+KX","3072:Bwl+KXp","3072:wl+KXps","3072:l+KXpsq","3072:+KXpsqN","3072:KXpsqN5","3072:XpsqN5v","3072:psqN5vl","3072:sqN5vlw","3072:qN5vlwW","3072:N5vlwWY","3072:5vlwWYy","3072:vlwWYyh","3072:lwWYyhY","3072:wWYyhY9","3072:WYyhY9S","3072:YyhY9S4","3072:yhY9S4A","3072:hY9S4Au","3072:Y9S4Au2","3072:9S4Au2g","3072:S4Au2gC","3072:4Au2gC4","3072:Au2gC4c","3072:u2gC4c0","3072:2gC4c0R","3072:gC4c0Rt","3072:C4c0RtN","3072:4c0RtNm","3072:c0RtNmJ","3072:0RtNmJR","3072:RtNmJR9","3072:tNmJR9u","3072:NmJR9u0","3072:mJR9u0Y","3072:JR9u0Ye","3072:R9u0Yet","3072:9u0Yet8","3072:u0Yet8m","3072:0Yet8m8","3072:Yet8m8e","3072:et8m8e9","3072:t8m8e9g","3072:8m8e9g7","3072:m8e9g7H","3072:8e9g7Hb","3072:e9g7HbS","3072:9g7HbSc","3072:g7HbScW","3072:7HbScWJ","1536:Qw+asqN","1536:w+asqN5","1536:+asqN5a","1536:asqN5aW","1536:sqN5aW/","1536:qN5aW/h","1536:N5aW/hL","1536:5aW/hLM","1536:aW/hLM7","1536:W/hLM7R","1536:/hLM7Rt","1536:hLM7RtN","1536:LM7RtNS","1536:M7RtNS9","1536:7RtNS9e","1536:RtNS9ee","1536:tNS9ees","1536:NS9eese","1536:S9eese0","1536:9eese0H","1536:eese0HG","1536:ese0HGc","1536:se0HGcy"],"imphash":"f86dec4a80961955a89e7ed62046cc0e"},"file_info":{"file_name":"withlove.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":94720,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1527370474000,"last_seen":1627639771000,"last_multi_scan":1627639771000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["crysis","isda","neshta","parite","ransomware","troldesh","wadhrama","dharma"]},"stats":{"av":{"malicious_count":25,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":15,"suspicious_count":13,"malicious_count":3,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crusis.tqMs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Crysis.E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Crysis.D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.Crysis.P trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Crysis.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00519f781 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crusis.to","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Dharma!6419A14DE6FB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nano":{"name":"Nano","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Ransom.Crysis.A3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_98","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Criakl-G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Crysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom.71377523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom.71377523","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokada","success":true,"verdict":"malicious","threat_name":"Unavailable (downloaded)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Crusis.Win32.134","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"vssadmin.exe\" at 00015713-00002968-00000105-9808307979","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4292037462\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4297145536\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4302604814\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4309109552\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4430873840\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4442397035","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4292037462\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4297145536\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4302604814\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4309109552\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4430873840\n \"\" queries volume information of \"C:\\\" at 00015360-00003700-0000010C-4442397035","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"vssadmin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"216.58.213.142:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\crysis\\Release\\PDB\\payload.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_AD6UZFA\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_AD6UZFU\"\n \"Global\\syncronize_AD6UZFU\"\n \"Global\\syncronize_AD6UZFA\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" (UID: 00015543-00002464)\n Spawned process \"mode.com\" with commandline \"mode con cp select=1251\" (UID: 00015561-00003912)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00015713-00002968)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"mode.com\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found a reference to a known community page","description":"\"*.youtube-nocookie.com\" (Indicator: \"youtube\")\n \"*.youtube.com\" (Indicator: \"youtube\")\n \"*.youtubeeducation.com\" (Indicator: \"youtube\")\n \"youtube.com\" (Indicator: \"youtube\")\n \"youtubeeducation.com\" (Indicator: \"youtube\")","origin":"File/Memory","relevance":7,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"vssadmin.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00015360-00003700-00000105-4182796684\n \"\" queried SystemProcessInformation at 00015360-00003700-00000105-4318212334","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rdata\n .data with unusual entropies 7.78504061339\n 7.98193400219","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 00015360-00003700-15301-120-004053B0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_ENUMERATE_SERVICE\" (0x4)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WITHLOVE.EXE\"; Value: \"%WINDIR%\\System32\\withlove.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\mode.com\" (Handle: 84)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\vssadmin.exe\" (Handle: 80)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\withlove.exe\" marked \"C:\\autoexec.bat\" for deletion\n \"C:\\withlove.exe\" marked \"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\autoexec.bat\" with delete access\n \"\" opened \"C:\\$Recycle.Bin\\S-1-5-21-4162757579-3804539371-4239455898-1000\\desktop.ini\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n LoadLibraryA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"mode.com\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"dharma_ransomware\" classified file \"withlove.exe.bin\" as \"dharma,crysis,ransomware\" based on indicators: \"C:\\crysis\\Release\\PDB\\payload.pdb\" (Author: Marc Rivero | Hybrid Analysis)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"vssadmin delete shadows /all /quiet\" (UID: 00015713-00002968)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt.id-C1EE047A.[java2018@tuta.io].arrow\" which has been seen in the context of ransomware (Indicator: README_.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]}],"incidents":[{"name":"Ransomware","details_count":2,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":44,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["crysis","isda","neshta","parite","ransomware","troldesh","wadhrama","dharma"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5b09d0c97ca3e150c20e43dd","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["USA"],"submit_name":"withlove.exe","analysis_start_time":"2018-05-26T22:23:25+00:00","indicators_count":{"informative":15,"suspicious":16,"malicious":4},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"216.58.213.142","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}],"processes":[{"pid":3700,"ppid":0,"name":"withlove.exe","command_line":"","sha256":"aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41","normalized_path":"C:\\withlove.exe","uid":"00015360-00003700","icon":"$2a"},{"pid":2464,"ppid":3700,"name":"cmd.exe","command_line":"","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00015360-00003700","uid":"00015543-00002464"},{"pid":3912,"ppid":2464,"name":"mode.com","command_line":"mode con cp select=1251","sha256":"efc11f8fcdd0a8649ebee758b105db10536e895ea6d586a07b61f68b1e5dbd20","normalized_path":"%WINDIR%\\System32\\mode.com","parent_uid":"00015543-00002464","uid":"00015561-00003912"},{"pid":2968,"ppid":2464,"name":"vssadmin.exe","command_line":"vssadmin delete shadows /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00015543-00002464","uid":"00015713-00002968"}],"all_imported_dlls":["vssapi.dll","user32.dll","winsta.dll","RpcRtRemote.dll","rpcrt4.dll","davhlpr.dll","netutils.dll","browcli.dll","rpcss.dll","rsaenh.dll","kernel32.dll","vsstrace.dll","ole32.dll","usp10.dll","imm32.dll","ws2_32.dll","ntlanman.dll","ulib.dll","uxtheme.dll","cryptbase.dll","vss_ps.dll","cscapi.dll","sechost.dll","mpr.dll","wkscli.dll","ureg.dll","atl.dll","gdi32.dll","lpk.dll","shell32.dll","apphelp.dll","winbrand.dll","oleaut32.dll","clbcatq.dll","msctf.dll","nsi.dll","cryptsp.dll","ntdll.dll","KernelBase.dll","advapi32.dll","msvcrt.dll","shlwapi.dll","drprov.dll","davclnt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_GUICtrlMenu_GetItemRectEx.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"d21ec87b4195ee050c900bfdc7b54154b9b170019c689fc2351f80ea0c4faefd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUICtrlRichEdit_ScrollLines.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"b765e4c781e75c6ed687822ff90c01a2cb8f56024be4f43d085a4b2e28a56051","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"00010007.wid.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"cef2e710312f29483a5107a18beca3ca00387c94a8f5a155794cfad243255e7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"azroles.h.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"f55a347daa3dc22c4babf4f52f193a22fccf2222ba6e7960ce74aaf0e6175b69","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUICtrlRichEdit_GetParaTabStops.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"aef0f7a8296e9d6aebc56fb490fb9e7a61aad305c2866144988cb30b71fe7d33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GDIPlus_PathBrushGetWrapMode.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"4ccd4721e9acf67c9a9403568b2e0b4bd08db845272758aa1928aebc13a5babe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"AdvClientdlg.cpp.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"2b858f9580897c9be5c2949d0de5ae27603e200f4f58e060f5bfbd85e520d3b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"AcquireClientLicensor.cpp.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"11b5b23e27df8cf7a17c3940ac0df3523bd219cfc85fad0ff14109141272ad34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"2adb2fe2-ae92-4320-8e3f-3c06940ec9b5.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"d0091265b1b0578dcd39e9b5abbe1f807836acd351a6ee04e52fb7459a622765","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUICtrlMonthCal_GetCalendarCount.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"e79b57e07c0b1b0062d4007ba53d445a1c65f6423a587b94c2e77982ea4725fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"06_Pictures_rated_4_or_5_stars.wpl.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"75de869cbe7289635e539d977a5da8d2802316c09bee6806533339d7b5cfc892","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"al.exe.config.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"2584531bc3ef36dffc7db171434153d29661068666d30df39155fb946f386ea7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUICtrlComboBox_GetEditSel.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"715c19ae4435cea84b812258e5535723480bef5d569667c437ce9e47161eb53f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_WinAPI_SetWinEventHook.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"9b97feb3f147b446fbe6a6063b5c7b7fe179ff35c1575c1d68592b7573ff35d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUICtrlTreeView_HitTestEx.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"ebe5f31f43d461d29cd9648feaeeff849797ca09381e295f9922f065cd489a36","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GDIPlus_ImageAttributesSetColorKeys.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"09dd697c592b8b689185b83f410daff359099d28ff1050dc40715619f7d25d48","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUICtrlMonthCal_GetMonthRangeMax.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"b286e076575da941d92abb1950a5b04397dde7de5852e232ca76c6854a04be1b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"BBqkZXE[1].jpg.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"2954547fe6ff00b69311febcb7ba166ce5a92ad687439ae19a497f6dc1cf6c5a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"_GUIToolTip_SetTipTextColor.au3.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"b9cddd6099c64a878c96a6fb063247c25dbe8092a4919747cfa6b7f9822d0849","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"AcroRd32.exe.id-C1EE047A.[java2018@tuta.io].arrow","sha256":"6a63f9003d5fe61cc6187bedf4a429140a48174e214e26526f07c87d6d7d1341","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]}],"files_written":[{"path":"C:\\withlove.exe","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\withlove.exe","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\withlove.exe","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\withlove.exe","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\en-US\\mpr.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\basebrd.dll","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\Branding\\Basebrd\\en-US\\basebrd.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\mode.com","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"C:\\config.sys","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0012-0000-0000-0000000FF1CE}-C\\Office64WW.xml","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"C:\\MSOCache\\All Users\\{90140000-0016-0409-0000-0000000FF1CE}-C\\ExcelMUI.xml","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"C:\\config.sys.id-C1EE047A.[java2018@tuta.io].arrow","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\en-US\\ulib.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_AD6UZFA","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\syncronize_AD6UZFU","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"Global\\syncronize_AD6UZFU","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]},{"name":"Global\\syncronize_AD6UZFA","sources":[{"report_type":"sandbox","report_id":"5b09d0c97ca3e150c20e43dd"}]}]}},"report_ids":{"sandbox_job_ids":["5b09d0c97ca3e150c20e43dd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample aa2ed4fae4da… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample aa2ed4fae4da…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample aa2ed4fae4da… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample aa2ed4fae4da…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aa2ed4fae4da37089cb33c88e0ee9f252e6afa171223b00963477baa32e3de41"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample aa2ed4fae4da… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample aa2ed4fae4da…. Malware family: Trojan.Generic. Threat score 100/100. 25/28 AV engines flagged this file. 3 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]