26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T46e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample adcf10cfb770… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample adcf10cfb770…. Malware family: Malware. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303"],"about":{"@type":"SoftwareApplication","name":"textify_setup.exe","applicationCategory":["peexe","executable"],"identifier":"adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T41a,"Textify.exe" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "StdUtils.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "System.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "nsDialogs.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "WebApp.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "LangDLL.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "modern-wizard.bmp" has type "PC bitmap Windows 3.x format 164 x 314 x 8" "WebApp.ini" has type "ASCII text with CRLF line terminators" "google_translate.ico" has type "MS Windows icon resource - 4 icons 64x64" "google.ico" has type "MS Windows icon resource - 2 icons 16x16" "Textify.ini" has type "ASCII text with CRLF line terminators" "wikipedia.ico" has type "MS Windows icon resource - 3 icons 48x48 16 colors" "duckduckgo.ico" has type "MS Windows icon resource - 4 icons 64x64" "modern-header.bmp" has type "PC bitmap Windows 3.x format 150 x 57 x 8"28:T53e,"" touched file "C:\Windows\system32\en-US\SETUPAPI.dll.mui" "" touched file "C:\Windows\system32\OLEACCRC.DLL" "" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Users\wXikLEy\AppData\Local\Microsoft\Windows\Caches" "" touched file "C:\Users\wXikLEy\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "" touched file "C:\Users\wXikLEy\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "" touched file "C:\Windows\Fonts\staticcache.dat" "" touched file "C:\Windows\system32\en-US\MSCTF.dll.mui" "" touched file "C:\Windows\system32\en-US\USER32.dll.mui" "" touched file "C:\Windows\system32\rsaenh.dll" "" touched file "C:\Windows\System32\ieframe.dll" "" touched file "C:\Windows\system32\stdole2.tlb" "" touched file "C:\Windows\system32\shell32.dll" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db"29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHcAAAAAAAAAAAAAAAAAAAf/iHcAAAA3u7NwAAAAAAeI////iHAHu7c7s3AAAAB4iP/4iIj/e7s3c7swAAAAeIj/+IiIiHuzeIe7twAAAHiI/4iIiIe7t4iIe7MAAAB4iP+IiIiHu3eP+He7AAAAeHf//4iIh7u7f/e7uwAAAHd3////+IeIiH/3iIcAAAB3eP/4///4eIiP94iHAAAAeIj/iIiI/3iIeIeIgAAAAHiI/4iIiP+HiIiIiHAAAAB4iP+IiIiIiHj/+HcAAAAAeIj/+IiIiIiId3AAAAAAAHiI//iIiIiIiIhwAAAAAAB4iP+IiIiIiIiIcAAAAAAAeIf/iIiIiIiIiHAAAAAAAHd3+IiIiIiIiIhwAAAAAAB3ePiHiIiIiIiIcAAAAAAAeP/4f4d3d3iIh3AAAAAAAHj/9/////iHd3dwAAAAAAB4/3j////4iIiIh3AAAAAACPh7iIj/+IiIiIhwAAAAAAj4O7u4iIiIiIiHAAAAAAB/94iIuIiIiIiIgAAAAAAAf4eIiIiIiIiIiPcAAAAAB4d4iIiIiP/3iIj4cAAAAHd4iIiIiIj/93iIj3AAAAB3d3d4iIiI//d4d3cAAAAAAAAAd3d3d3d3BwAAAAAAD8B/AP+ABAA+AAAAHgAAAB4AAAAOAAAADgAAAA4AAAAOAAAADgAAAA4AAAAOAAAADgAAAB4AAAA+AAAAPgAAAP4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAH4AAAB+AAAAfgAAAPwAAAD8AAAA+AAAAHgAAAB4AAAAeAAAAH/gAB/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790309690933,"unified_at":"2026-09-25T04:14:50.933Z","metadata":{"hashes":{"sha256":"adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303","sha1":"ee9f9136d9a5932c20d3a7e78dcaa5e4fae197e2","md5":"93455ddc5d677c3115e3f812e060ba8c","sha512":"ffc84f3f29d0fc5581ff6113cd0276fed9e78874fc6f231bd6bb34cbdbc140ffe208043fe60f1800d94a42d42f6a1b815930556e8f4e078c1386fe169d8f5ae7","ssdeep":"12288:1zAd5wLVgZwg64WDEOLZ6CbDAoGa5K/bJ2E0Wc:GdmVgWr4+E7CbOTY","ssdeep_chunks":["12288:1zAd5wL","12288:zAd5wLV","12288:Ad5wLVg","12288:d5wLVgZ","12288:5wLVgZw","12288:wLVgZwg","12288:LVgZwg6","12288:VgZwg64","12288:gZwg64W","12288:Zwg64WD","12288:wg64WDE","12288:g64WDEO","12288:64WDEOL","12288:4WDEOLZ","12288:WDEOLZ6","12288:DEOLZ6C","12288:EOLZ6Cb","12288:OLZ6CbD","12288:LZ6CbDA","12288:Z6CbDAo","12288:6CbDAoG","12288:CbDAoGa","12288:bDAoGa5","12288:DAoGa5K","12288:AoGa5K/","12288:oGa5K/b","12288:Ga5K/bJ","12288:a5K/bJ2","12288:5K/bJ2E","12288:K/bJ2E0","12288:/bJ2E0W","12288:bJ2E0Wc","24576:1zAd5wL","24576:zAd5wLV","24576:Ad5wLVg","24576:d5wLVgZ","24576:5wLVgZw","24576:wLVgZwg","24576:LVgZwg6","24576:VgZwg64","24576:gZwg64W","24576:Zwg64WD","24576:wg64WDE","24576:g64WDEO","24576:64WDEOL","24576:4WDEOLZ","24576:WDEOLZ6","24576:DEOLZ6C","24576:EOLZ6Cb","24576:OLZ6CbD","24576:LZ6CbDA","24576:Z6CbDAo","24576:6CbDAoG","24576:CbDAoGa","24576:bDAoGa5","24576:DAoGa5K","24576:AoGa5K/","24576:oGa5K/b","24576:Ga5K/bJ","24576:a5K/bJ2","24576:5K/bJ2E","24576:K/bJ2E0","24576:/bJ2E0W","24576:bJ2E0Wc","12288:GdmVgWr","12288:dmVgWr4","12288:mVgWr4+","12288:VgWr4+E","12288:gWr4+E7","12288:Wr4+E7C","12288:r4+E7Cb","12288:4+E7CbO","12288:+E7CbOT","12288:E7CbOTY"],"imphash":"4ea4df5d94204fc550be1874e1b77ea7"},"file_info":{"file_name":"textify_setup.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":517603,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1507119282000,"last_seen":1676937079000,"last_multi_scan":1676937079000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":14,"suspicious_count":10,"malicious_count":3,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 34646-1133-1000FA16\n SetUnhandledExceptionFilter@KERNEL32.dll at 41710-2168-0040D664\n SetUnhandledExceptionFilter@KERNEL32.dll at 41710-1187-0040CE11","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.dll at 34646-1265-1000EFB8\n GetProcessHeap@KERNEL32.dll at 34646-3373-10018D8A\n GetProcessHeap@KERNEL32.dll at 34646-1264-1000EEE1\n GetProcessHeap@KERNEL32.dll at 34646-1263-1000F022\n GetProcessHeap@KERNEL32.dll at 41710-2305-00416A2F","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\TEXTIFY\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"UnregisterHotKey@USER32.dll at 41710-1244-00402C60\n RegisterHotKey@USER32.dll at 41710-1250-00402D80","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\nsg3B0F.tmp\"\n \"\" created file \"%TEMP%\\nsq3B1A.tmp\\System.dll\"\n \"\" created file \"%TEMP%\\nsq3B1A.tmp\\LangDLL.dll\"\n \"\" created file \"%TEMP%\\nsq3B1A.tmp\\modern-header.bmp\"\n \"\" created file \"%TEMP%\\nsq3B1A.tmp\\modern-wizard.bmp\"\n \"\" created file \"%TEMP%\\nsq3B1A.tmp\\nsDialogs.dll\"\n \"\" created file \"%TEMP%\\nsq3B1A.tmp\\StdUtils.dll\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\textify_instmutex\"\n \"textify_instmutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"StdUtils.dll\" as clean (type is \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"nsDialogs.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"), Antivirus vendors marked dropped file \"LangDLL.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6B2B0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"#32770\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$27","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Pattern match: \"http://rammichael.com/\"\n Pattern match: \"https://msdn.microsoft.com/en-us/library/windows/desktop/dd375731.aspx\"\n Pattern match: \"https://translate.google.com/m/translate#auto/en/%s\"\n Pattern match: \"https://duckduckgo.com/?q=%s\"\n Pattern match: \"https://en.m.wikipedia.org/w/index.php?search=%s\"\n Pattern match: \"https://www.google.com/search?q=%s\"\n Pattern match: \"http://rammichael.com/textify\"\n Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"Textify.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"WebApp.dll\" was detected as \"Borland Delphi 3.0 (???)\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.71949440068","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/64 reputation engines marked \"http://nsis.sf.net\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.dll at 34646-1139-1000E800\n FindResourceExW@KERNEL32.dll at 34646-1438-10004BA0\n FindResourceW@KERNEL32.dll at 34646-1485-10004360\n LockResource@KERNEL32.dll at 34646-1437-10004C20\n FindResourceW@KERNEL32.dll at 41710-1193-00405DF0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.dll at 41710-1174-00401150","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.dll at 41710-1175-00401290","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"Textify.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"StdUtils.dll\" has type \"PE32 executable (DLL) (console) Intel 80386 for MS Windows\"\n \"System.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"nsDialogs.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"WebApp.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"LangDLL.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteW\n FindWindowExW\n RegEnumKeyExW\n FindResourceExW\n OutputDebugStringW\n WriteProcessMemory\n IsDebuggerPresent\n LoadLibraryExA\n UnhandledExceptionFilter\n TerminateProcess\n GetModuleHandleExW\n LoadLibraryW\n CreateRemoteThread\n OpenProcess\n GetStartupInfoW\n FindFirstFileExW\n VirtualAllocEx\n LockResource\n GetCommandLineA\n FindResourceW\n VirtualAlloc\n FindWindowW\n GetWindowThreadProcessId\n GetLastActivePopup\n SetWindowsHookExW\n GetVersionExW\n ShellExecuteExW\n VirtualProtect\n GetModuleFileNameA\n FindFirstFileExA\n FindNextFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"13/66 Antivirus vendors marked sample as malicious (19% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"13/66 Antivirus vendors marked sample as malicious (19% detection rate)\n 1/37 Antivirus vendors marked sample as malicious (2% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/66 Antivirus vendors marked dropped file \"Textify.exe\" as malicious (classified as \"Adware.Generic\" with 21% detection rate)\n 1/88 Antivirus vendors marked dropped file \"System.dll\" as malicious (classified as \"Adware.Domage.Neobar.BF\" with 1% detection rate)\n 1/65 Antivirus vendors marked dropped file \"WebApp.dll\" as malicious (classified as \"Malware.Generic\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":48,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":29,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"59d4cf427ca3e12470384665","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Adware.Generic","submit_name":"textify_setup.exe","analysis_start_time":"2017-10-04T13:06:51+00:00","indicators_count":{"informative":14,"suspicious":11,"malicious":4},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}],"processes":[{"pid":3288,"ppid":0,"name":"adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303.exe","command_line":"","sha256":"adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303","normalized_path":"C:\\adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303.exe","uid":"00014485-00003288","icon":"$29"}],"all_imported_dlls":["StdUtils.dll","cryptsp.dll","RpcRtRemote.dll","ntdll.dll","lpk.dll","profapi.dll","version.dll","riched20.dll","ieframe.dll","cryptbase.dll","kernel32.dll","advapi32.dll","ole32.dll","uxtheme.dll","userenv.dll","Wldap32.dll","nsDialogs.dll","imm32.dll","cfgmgr32.dll","devobj.dll","tiptsf.dll","rsaenh.dll","sxs.dll","ieproxy.dll","actxprxy.dll","apphelp.dll","propsys.dll","comdlg32.dll","shell32.dll","sechost.dll","dwmapi.dll","user32.dll","msvcrt.dll","rpcrt4.dll","comctl32.dll","msctf.dll","setupapi.dll","oleacc.dll","KernelBase.dll","usp10.dll","shfolder.dll","ntmarta.dll","System.dll","gdi32.dll","shlwapi.dll","oleaut32.dll","oleaccrc.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"System.dll","sha256":"bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"Textify.exe","sha256":"6facddae3bcb6d517db7e72bb7d2fcb31519a3460bebe016ec426c9a39a027a3","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"WebApp.dll","sha256":"fe54efd83ae5b97c7c0888009a89f11ee5ffafe2cbeacf1600e625c6fe58d6ff","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"LangDLL.dll","sha256":"6dff504c6759c418c6635c9b25b8c91d0d9ef7787a3a93610d7670bb563c09df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"StdUtils.dll","sha256":"d94deb73938b716c37898cd2b31a019fdcfe5ddb63d0dbadcf0145bd0fc1a95a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"nsDialogs.dll","sha256":"c13104552b8b553159f50f6e2ca45114493397a6fa4bf2cbb960c4a2bbd349ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"modern-header.bmp","sha256":"4c9e804ce1a391f8e603b7b9c732a6529c1e81be4d12f125c8562ea9d49095c2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"modern-wizard.bmp","sha256":"a7b2f12e01cbea88d4f645f797f2ca6107d76ae13cd1be6dc532b759bfe0d925","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"Textify.ini","sha256":"f8f082e9464cbde2a64e1818c86c99489d3d7bda17e1328c3fb2c44a770e9bfe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"WebApp.ini","sha256":"5fee3155f8c0030659cb3a265225d8a912e40cbcaafdb9af4fbdcfcd97499b41","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"duckduckgo.ico","sha256":"902c39ef8ca32b6d47fdb679670770bfc8bb605c00b72efd675e61a2035dcc0f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"google.ico","sha256":"6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"google_translate.ico","sha256":"06fd4ba3b981a0765dc1e8fcd5aa2faf802323d5367d7ca0b8afb7f896f2e81f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"wikipedia.ico","sha256":"3638de61226857e62cf5187d7d59cf902111ad4f792b5bdff1bfed3f5ed5e608","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303.exe","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Users\\wXikLEy","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%TEMP%\\nsq3B1A.tmp","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\Textify.exe","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\Textify.ini","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\WebApp.dll","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\WebApp.ini","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\icons\\duckduckgo.ico","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\icons\\google.ico","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%TEMP%\\nsg3B0F.tmp","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\icons\\google_translate.ico","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"C:\\Textify\\icons\\wikipedia.ico","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\system32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\textify_instmutex","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]},{"name":"textify_instmutex","sources":[{"report_type":"sandbox","report_id":"59d4cf427ca3e12470384665"}]}]}},"report_ids":{"sandbox_job_ids":["59d4cf427ca3e12470384665"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample adcf10cfb770… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample adcf10cfb770…. Malware family: Malware. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample adcf10cfb770… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample adcf10cfb770…. Malware family: Malware. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/adcf10cfb77099fd5244c53959a15a548e3872d7fef216781ab543c06cc34303"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample adcf10cfb770… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample adcf10cfb770…. Malware family: Malware. Threat score 100/100. 1/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]