33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 37:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:T910,Found string "k__BackingField" (Indicator: "aes"; Source: "sample.bin"), Found string "k__BackingField" (Indicator: "aes"; Source: "sample.bin"), Found string "ValidaMatriculaInvalidaBase64" (Indicator: "base64"; Source: "sample.bin"), Found string "CODCATEGORIAESOCIAL" (Indicator: "aes"; Source: "sample.bin"), Found string "PESOCIALCLIFOR.CODCATEGORIAESOCIAL" (Indicator: "aes"; Source: "sample.bin"), Found string "k__BackingField" (Indicator: "aes"; Source: "sample.bin"), file/memory contains long string with (Indicator: "aes"; Source: "sample.bin"), Found string "k__BackingField" (Indicator: "aes"; Source: "sample.bin"), Found string "RetornaChaveFuncionarioBase64" (Indicator: "base64"; Source: "sample.bin"), Found string "RetornaChaveFuncionarioFeriasBase64" (Indicator: "base64"; Source: "sample.bin"), Found string "ReturnInputIsBase64" (Indicator: "base64"; Source: "sample.bin"), Found string " SELECT PFUNC.CODCATEGORIAESOCIAL FROM PFUNC INNER JOIN PPESSOA ON PPESSOA.CODIGO = PFUNC.CODPESSOA WHERE PPESSOA.CPF = " (Indicator: "aes"; Source: "sample.bin"), Found string "5__2" (Indicator: "aes"; Source: "sample.bin"), Found string "k__BackingField" (Indicator: "aes"; Source: "sample.bin"), Found string "set_Base64" (Indicator: "base64"; Source: "sample.bin"), Found string " AND PFUNC.MATRICULAESOCIAL = " (Indicator: "aes"; Source: "sample.bin"), Found string "IFopTaeServerREST" (Indicator: "aes"; Source: "sample.bin"), Found string "SELECT PFUNC.MATRICULAESOCIAL, PFUNC.CODCATEGORIAESOCIAL, PFUNC.CODSECAO, PFUNC.NOME, PPESSOA.CPF, PSECAO.CGC, " (Indicator: "aes"; Source: "sample.bin"), Found string "k__BackingField" (Indicator: "aes"; Source: "sample.bin"), Found string "k__BackingField" (Indicator: "3des"; Source: "sample.bin"), Found string "Chamada RetornaConfiguracoesTae - Classe FopTaeServerREST. Par" (Indicator: "aes"; Source: "sample.bin"), Found string "ValidateIsBase64" (Indicator: "base64"; Source: "sample.bin")36:T1970,"SELECT CODCLIENTE, DESCRICAO, CODINTERNO FROM PESOCIALCATTRAB (NOLOCK)" (Source: sample.bin, Indicator: "select codcliente, descricao, codinterno from pesocialcattrab (nolock)"), "DELETE FROM PPAGTOAUTONOMOEXT WHERE CODCOLIGADA = " (Source: sample.bin, Indicator: "delete from ppagtoautonomoext where codcoligada = "), "INSERT INTO PLANCFINANCATIVO (CODCOLIGADA, CODLANC,CODATIVO,RECCREATEDBY,RECCREATEDON,RECMODIFIEDBY,RECMODIFIEDON) VALUES (:CODCOLIGADA,:CODLANC,:CODATIVO,:RECCREATEDBY,:RECCREATEDON,:RECMODIFIEDBY,:RECMODIFIEDON)" (Source: sample.bin, Indicator: "insert into plancfinancativo (codcoligada, codlanc,codativo,reccreatedby,reccreatedon,recmodifiedby,recmodifiedon) values (:codcoligada,:codlanc,:codativo,:reccreatedby,:reccreatedon,:recmodifiedby,:recmodifiedon)"), "SELECT CODCOLIGADA, CODIGO, DESCRICAO FROM PRATEIO {0} WHERE CODCOLIGADA = {1}CODCOLIGADA AND CODIGO = {2}CODIGO" (Source: sample.bin, Indicator: "select codcoligada, codigo, descricao from prateio {0} where codcoligada = {1}codcoligada and codigo = {2}codigo"), "SELECT DESCRICAO FROM PGRPVALE WHERE CODCOLIGADA = :CODCOLIGADA AND CODCLIENTE = :CODCLIENTE" (Source: sample.bin, Indicator: "select descricao from pgrpvale where codcoligada = :codcoligada and codcliente = :codcliente"), "SELECT PROVDESCBASE FROM PEVENTO WHERE CODIGO = :CODIGO" (Source: sample.bin, Indicator: "select provdescbase from pevento where codigo = :codigo"), "SELECT VALORINT FROM PPARAMADICIONAIS (NOLOCK) WHERE CODCOLIGADA = :CODCOLIGADA AND NOMECOLUNA = 'ESOCIALUSAMIDDLEWARE'" (Source: sample.bin, Indicator: "select valorint from pparamadicionais (nolock) where codcoligada = :codcoligada and nomecoluna = 'esocialusamiddleware'"), "SELECT 1 FROM PVALETR WHERE CODIGO = :CODIGO AND CODCOLIGADA = :CODCOLIGADA" (Source: sample.bin, Indicator: "select 1 from pvaletr where codigo = :codigo and codcoligada = :codcoligada"), "SELECT CODCOLIGADA, CODIGO, TITULO, APLICACAO FROM GFORMULA {0} WHERE CODCOLIGADA = {1}CODCOLIGADA AND CODIGO = {2}CODIGO AND APLICACAO = 'P'" (Source: sample.bin, Indicator: "select codcoligada, codigo, titulo, aplicacao from gformula {0} where codcoligada = {1}codcoligada and codigo = {2}codigo and aplicacao = 'p'"), "SELECT DATAGERACAO, MENSAGEM FROM PESOCIALEVENTOS (NOLOCK) WHERE CODCOLIGADA = :paramColigada AND ID = :paramId" (Source: sample.bin, Indicator: "select datageracao, mensagem from pesocialeventos (nolock) where codcoligada = :paramcoligada and id = :paramid"), "INSERT INTO PGERSMARTVIEW (CODIGO,CODCOLIGADA,CODFILIAL,CODUSUARIO,CHAPA,STATUS,IDRELATORIO,IDPROCESSO,RECCREATEDBY,RECCREATEDON,RECMODIFIEDBY,RECMODIFIEDON) VALUES (:CODIGO,:CODCOLIGADA,:CODFILIAL,:CODUSUARIO,:CHAPA,:STATUS,:IDRELATORIO,:IDPROCESSO,:RECCREATEDBY,:RECCREATEDON,NULL,NULL)" (Source: sample.bin, Indicator: "insert into pgersmartview (codigo,codcoligada,codfilial,codusuario,chapa,status,idrelatorio,idprocesso,reccreatedby,reccreatedon,recmodifiedby,recmodifiedon) values (:codigo,:codcoligada,:codfilial,:codusuario,:chapa,:status,:idrelatorio,:idprocesso,:reccreatedby,:reccreatedon,null,null)"), "SELECT CODCOLIGADA, CODCXA, DESCRICAO FROM FCXA {0} WHERE CODCOLIGADA = {1}CODCOLIGADA AND CODCXA = {2}CODCXA" (Source: sample.bin, Indicator: "select codcoligada, codcxa, descricao from fcxa {0} where codcoligada = {1}codcoligada and codcxa = {2}codcxa"), "SELECT 1 FROM PTARIFA WHERE CODIGO = :CODIGO AND INICIOVIGENCIA = :INICIOVIGENCIA AND CODCOLIGADA = :CODCOLIGADA" (Source: sample.bin, Indicator: "select 1 from ptarifa where codigo = :codigo and iniciovigencia = :iniciovigencia and codcoligada = :codcoligada"), "SELECT 1 FROM PDADOSDIS WHERE CODCOLIGADA = :CODCOLIGADA AND ID = :ID" (Source: sample.bin, Indicator: "select 1 from pdadosdis where codcoligada = :codcoligada and id = :id"), "SELECT 1 FROM PLANCFINANC WHERE CODCOLIGADA = :CODCOLIGADA AND CODLANC = :CODLANC" (Source: sample.bin, Indicator: "select 1 from plancfinanc where codcoligada = :codcoligada and codlanc = :codlanc"), "SELECT * FROM TOTALIZADORES_COM_AUTONOMOS_CTE" (Source: sample.bin, Indicator: "select * from totalizadores_com_autonomos_cte"), "SELECT 1 FROM PFUNC (NOLOCK) WHERE CODCOLIGADA = :CODCOLIGADA AND CHAPA = :CHAPA" (Source: sample.bin, Indicator: "select 1 from pfunc (nolock) where codcoligada = :codcoligada and chapa = :chapa"), "SELECT CODCOLIGADA, CODTB2FLX, DESCRICAO FROM FTB2 {0} WHERE CODCOLIGADA = {1}CODCOLIGADA AND CODTB2FLX = {2}CODTB2FLX" (Source: sample.bin, Indicator: "select codcoligada, codtb2flx, descricao from ftb2 {0} where codcoligada = {1}codcoligada and codtb2flx = {2}codtb2flx"), "SELECT top 1 DESCRICAO FROM PTARIFA WHERE CODCOLIGADA = :CODCOLIGADA AND CODIGO = :CODIGO ORDER BY FINALVIGENCIA DESC" (Source: sample.bin, Indicator: "select top 1 descricao from ptarifa where codcoligada = :codcoligada and codigo = :codigo order by finalvigencia desc"), "SELECT 1 FROM PFUNC WHERE CHAPA = :CHAPA AND CODCOLIGADA = :CODCOLIGADA" (Source: sample.bin, Indicator: "select 1 from pfunc where chapa = :chapa and codcoligada = :codcoligada"), "SELECT PSECAO.CODFILIAL FROM PSECAO (NOLOCK) WHERE CODCOLIGADA = :CODCOLIGADA AND CODIGO = :CODSECAO" (Source: sample.bin, Indicator: "select psecao.codfilial from psecao (nolock) where codcoligada = :codcoligada and codigo = :codsecao"), "SELECT NOME FROM PFUNC WHERE CHAPA = :CHAPA AND CODCOLIGADA = :CODCOLIGADA" (Source: sample.bin, Indicator: "select nome from pfunc where chapa = :chapa and codcoligada = :codcoligada"), "SELECT CODCOLIGADA, CHAPA, NOME,DATAADMISSAO FROM PFUNC WHERE CODCOLIGADA = {0}CODCOLIGADA AND CHAPA = {1}CHAPA" (Source: sample.bin, Indicator: "select codcoligada, chapa, nome,dataadmissao from pfunc where codcoligada = {0}codcoligada and chapa = {1}chapa"), "SELECT CODCOLIGADA, CODTB5FLX, DESCRICAO FROM FTB5 {0} WHERE CODCOLIGADA = {1}CODCOLIGADA AND CODTB5FLX = {2}CODTB5FLX" (Source: sample.bin, Indicator: "select codcoligada, codtb5flx, descricao from ftb5 {0} where codcoligada = {1}codcoligada and codtb5flx = {2}codtb5flx")30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample aa7b4e0cc334… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample aa7b4e0cc334…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"RM.Fop.Api.dll\",\"applicationCategory\":[\"pedll\",\"executable\"],\"identifier\":\"aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":28},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794344470389,"unified_at":"2026-11-10T21:01:10.389Z","metadata":{"hashes":{"sha256":"aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","sha1":"644eaed1ce3817daa2e273fec0308453c450735b","md5":"aa64a7a7732eb974e25f34d52a1bd5d6","imphash":"dae02f32a21e03ce65412f6e56942daa","pehash":"0ce7a8be7a69497cb27a976c9336fa4d320f9fc8"},"file_info":{"file_name":"RM.Fop.Api.dll","file_type":["pedll","executable"],"file_type_id":"dll","file_size":1451328,"entropy":5.76,"compile_timestamp":"2026-08-06T19:39:04","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794344453000,"last_seen":1794344453000,"last_multi_scan":1794344453000},"pe_metadata":{"is_dll":true,"is_packed":false,"section_count":3,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x2000","virtual_size":1438688,"raw_size":1438720},{"name":".rsrc","virtual_address":"0x162000","virtual_size":976,"raw_size":1024},{"name":".reloc","virtual_address":"0x164000","virtual_size":12,"raw_size":512}],"section_names":[".text",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":8,"suspicious_count":0,"malicious_count":0,"total":8},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$35","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$36","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileResponse\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"d__22\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"d__7\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"d__20\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"+*.sk\", Heuristic match: \"+*.st\", Heuristic match: \"+*.sy\", Heuristic match: \"+*.sc\", Heuristic match: \"+*.sg\", Heuristic match: \"+*.sl\", Heuristic match: \"rm.lib.io\", Heuristic match: \"\n&*.re\", Heuristic match: \"\n&*.rs\", Heuristic match: \"\n*.sy\", Heuristic match: \"\n*.si\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"SELECT * FROM TOTALIZADORES_COM_AUTONOMOS_CTE\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9":{"type":"File","value":"aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","filetype":"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:b9951bdda68462f2a39a34ec653802abea5da11845ba0117a1b4994309c5dc44":{"type":"File","value":"b9951bdda68462f2a39a34ec653802abea5da11845ba0117a1b4994309c5dc44","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/octet-stream"}},"chains":[{"id":"1569819210657747061","root":"File:aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","to_key":"File:b9951bdda68462f2a39a34ec653802abea5da11845ba0117a1b4994309c5dc44"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_files","root":"File:aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","edges":[{"edge_kind":"extracted","from_key":"File:aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9","to_key":"File:b9951bdda68462f2a39a34ec653802abea5da11845ba0117a1b4994309c5dc44"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"b9951bdda68462f2a39a34ec653802abea5da11845ba0117a1b4994309c5dc44","sha256":"b9951bdda68462f2a39a34ec653802abea5da11845ba0117a1b4994309c5dc44","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample aa7b4e0cc334… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample aa7b4e0cc334…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9"}],["$","meta","4",{"property":"og:title","content":"Sample aa7b4e0cc334… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample aa7b4e0cc334…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aa7b4e0cc33432a1810c915c13195784d0faca41ef89ea959aa2e781b3f3d3a9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample aa7b4e0cc334… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample aa7b4e0cc334…. Threat score 0/100. 0/28 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L37","11",{}]] 32:null