26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample aa9a26dbe5fc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aa9a26dbe5fc…. Malware family: Tedy.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359"],"about":{"@type":"SoftwareApplication","name":"Notificacion de envio de DHL FACTURA CONOCIMIENTO DE EMBARQUE.exe","applicationCategory":["peexe","executable"],"identifier":"aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6b2,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359.bin") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; File: "aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "aa9a26dbe5fcfab9b87fe4433d35381bb381b219a499a8c427ed9e7762025359.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004620.00000000.125998.00401000.00000020.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004620.00000000.125998.00401000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004620.00000000.125998.00401000.00000020.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00004620.00000000.125998.00401000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004620.00000000.125998.00401000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004620.00000000.125998.00401000.00000020.mdmp")28:T7a6,"9iqmgvw,czct)1dnew" - Source: "00000000-00004620.00000000.125998.031EF000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004620.00000000.125998.031EF000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004620.00000000.125998.031EF000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn-xgjr0m06a[j3bv:tx'ecbz69u9.w?bjo@.a" - Source: "00000000-00004620.00000000.125998.031EF000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00004620.00000000.125998.031EF000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasycasyct" - Source: "00000000-00004620.00000000.125998.031EF000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004620.00000000.125998.063D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004620.00000000.125998.063D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004620.00000000.125998.063D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004620.00000000.125998.063D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004620.00000000.125998.063D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004620.00000000.125998.063D0000.00000004.mdmp") Found URL "https://arpausa.com.ec/o8q368jn.nyba62cbdbe" - Source: "00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found URL "https://arpausa.com.ec/o8q368jn.nybc:\users\hapubws\appdata\local\microsoft\windows\inetcache\ie\lscby323\o8q368jn[1].nyb39-a9ba-be0bbb1085*.*.*.*.*.*.*.*.*.*.*.*.*1012tpnkb0v37vicrosoft" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?e8;cfglobalsign" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czct)1dnew" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn-xgjr0m06a[j3bv:tx'ecbz69u9.w?bjo@.a" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l250905032048z0/^g(o-cejy" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasycasyct" - Source: "00000000-00004620.00000001.127919.031A2000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004620.00000001.127919.063D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004620.00000001.127919.063D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004620.00000001.127919.063D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004620.00000001.127919.063D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004620.00000001.127919.063D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004620.00000001.127919.063D0000.00000004.mdmp")35:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp")36:T936,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00004620.00000000.125998.031A2000.00000004.mdmp, 00000000-00004620.00000000.125998.031EF000.00000004.mdmp, 00000000-00004620.00000001.127919.031A2000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004620.00000000.125998.063D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004620.00000001.127919.063D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004620.00000000.125998.03150000.00000004.mdmp, 00000000-00004620.00000001.127919.03150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nConnection: Keep-Alive\nKeep-Alive: timeout=5\n max=100\nContent-Type: application/octet-stream\nLast-Modified: Wed\n 15 Apr 2026 13:58:44 GMT\nAccept-Ranges: bytes\nContent-Length: 239104\nDate: Thu\n 16 Apr 2026 12:33:25 GMT\nalt-svc: h3=\":443\"; ma=2592000\n h3-29=\":443\"; ma=2592000 with response body ==>7A0DC2A3484136554C3652564EC2A7C2BB5146C3AD38464844534E4672443738363857354B354A375733484236554C3252564E584451465538464844534E4632.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69e0d6f6fa7c6e9f2a0e1367"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"