26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample b08979af247a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b08979af247a…. Malware family: Trojan.Generic. Threat score 100/100. 11/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840"],"about":{"@type":"SoftwareApplication","name":"faktura_03.08.2018.pdf.exe","applicationCategory":["peexe","executable"],"identifier":"b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T43d,GetSystemTime@KERNEL32.DLL at 00014120-00002504-4538-251-004026C4 GetSystemTime@KERNEL32.DLL at 00014120-00002504-4538-177-0040102C GetSystemTimeAsFileTime@KERNEL32.DLL at 00014343-00002628-7900-75-00458208 GetSystemTimeAsFileTime@KERNEL32.DLL at 00014343-00002628-7900-865-004581C4 GetSystemTimeAsFileTime@KERNEL32.DLL at 00014343-00002628-7900-832-00458DC4 GetSystemTime@KERNEL32.DLL at 00014343-00002628-7900-785-00402778 GetLocalTime@KERNEL32.DLL at 00014343-00002628-7900-3202-0046F754 GetLocalTime@KERNEL32.DLL at 00014343-00002628-7900-3209-0046FD00 GetLocalTime@KERNEL32.DLL at 00014343-00002628-7900-3480-004081CC GetLocalTime@KERNEL32.DLL at 00014343-00002628-7900-3479-004081F8 GetSystemTimeAsFileTime@KERNEL32.DLL at 00014894-00002972-20523-70-00BE6A10 GetLocalTime@KERNEL32.dll at 41182-1232-10083DF8 GetLocalTime@KERNEL32.dll at 41182-1230-10083EDF GetLocalTime@KERNEL32.dll at 41182-1255-10082D90 GetLocalTime@KERNEL32.dll at 41182-1244-10083691 GetLocalTime@KERNEL32.dll at 41182-1253-10082E5C GetSystemTimeAsFileTime@KERNEL32.dll at 41182-1249-1008321028:T519,GetVersionExA@KERNEL32.DLL at 00014120-00002504-4538-108-00406144 GetVersion@KERNEL32.DLL at 00014120-00002504-4538-118-00404654 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-881-00419490 GetVersionExA@KERNEL32.DLL at 00014343-00002628-7900-873-004501E8 GetVersionExA@KERNEL32.DLL at 00014343-00002628-7900-850-00485194 GetVersionExA@KERNEL32.DLL at 00014343-00002628-7900-875-0044FCAC GetVersion@KERNEL32.DLL at 00014343-00002628-7900-920-004063F4 GetVersionExA@KERNEL32.DLL at 00014343-00002628-7900-862-0044BAA4 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-887-0041F568 GetVersionExA@KERNEL32.DLL at 00014343-00002628-7900-913-004094C0 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-748-0042E4EC GetVersion@KERNEL32.DLL at 00014343-00002628-7900-1065-0045D3BC GetVersion@KERNEL32.DLL at 00014343-00002628-7900-1010-0046EE04 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-3093-00463A24 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-2935-00450994 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-2713-0042DDC4 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-3090-004638CC GetVersion@KERNEL32.DLL at 00014343-00002628-7900-2465-00411B44 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-4358-004637D4 GetVersion@KERNEL32.DLL at 00014343-00002628-7900-4357-0046398429:T92d,Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 004046A5h" at 00014120-00002504-4538-118-00404654 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "setnb byte ptr [0049D5C8h]" at 00014343-00002628-7900-881-00419490 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000600h" and "je 00406445h" at 00014343-00002628-7900-920-004063F4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp bl, 04h" and "jnc 0041F5B1h" at 00014343-00002628-7900-887-0041F568 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jc 0042E569h" at 00014343-00002628-7900-748-0042E4EC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jnc 0045D3F1h" at 00014343-00002628-7900-1065-0045D3BC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 00000601h" and "jc 0046EE48h" at 00014343-00002628-7900-1010-0046EE04 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00463A97h" at 00014343-00002628-7900-3093-00463A24 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 00450A8Ch" at 00014343-00002628-7900-2935-00450994 Found API call GetDiskFreeSpaceA@KERNEL32.DLL directly followed by "cmp byte ptr [ebp-02h], 00h" and "je 004566AFh" at 00014343-00002628-7900-2970-004565A8 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 0042DE1Fh" at 00014343-00002628-7900-2713-0042DDC4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jnc 00463941h" at 00014343-00002628-7900-3090-004638CC Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0004h" and "jc 00411CA4h" at 00014343-00002628-7900-2465-00411B44 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp dx, 0005h" and "jne 0046385Bh" at 00014343-00002628-7900-4358-004637D4 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0006h" and "jc 004639FEh" at 00014343-00002628-7900-4357-00463984 Found API call GetVersion@KERNEL32.DLL directly followed by "cmp ax, 0005h" and "jne 0044F533h" at 00014343-00002628-7900-6537-0044F488 Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by "cmp ecx, eax" and "je 100832FAh" at 41182-1249-100832102a:T95f,"" created file "C:\Users\%OSUSER%\AppData\Local\Temp\is-M89RQ.tmp\faktura_03.08.2018.pdf.tmp" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-datetime-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-debug-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-file-l1-2-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-file-l2-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-crt-multibyte-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-crt-time-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\tor.exe" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-processthreads-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-crt-heap-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\msvcp140.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\nklaprok.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\ssleay32.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\zlib1.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-processthreads-l1-1-1.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-core-timezone-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-crt-filesystem-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\api-ms-win-crt-process-l1-1-0.dll" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\firefox.exe" "faktura_03.08.2018.pdf.tmp" created file "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\libgmp-10.dll"2b:T64d,Antivirus vendors marked dropped file "is-P4EM8.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-JKN8F.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-ULT1I.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-EM4RC.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-3J3S8.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "faktura_03.08.2018.pdf.tmp" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-8MCUU.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-DF12G.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-VDD8J.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "is-9GB33.tmp" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-TLROC.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "is-5GGFK.tmp" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows")2c:T4a0,The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 5F:B7:EE:06:33:E2:59:DB:AD:0C:4C:9A:E6:D3:8F:1A:61:C7:DC:25; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert EV Code Signing CA SHA2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 20:F5:66:3D:8C:6A:87:01:D8:F2:DE:1C:DB:BB:84:21:FD:C8:C9:43; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 61:4D:27:1D:91:02:E3:01:69:82:24:87:FD:E5:DE:00:A3:52:B0:1D; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 60:EE:3F:C5:3D:4B:DF:D1:69:7A:E5:BE:AE:1C:AB:1C:0F:3A:D4:E3; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 19:A0:9B:5A:36:F4:DD:99:72:7D:F7:83:C1:7A:51:23:1A:56:C1:17; see report for more information)2d:T5a3,"is-KTTMA.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-IPUOM.tmp" has type "ASCII text with no line terminators" "is-P4EM8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-JKN8F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-ULT1I.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-JRN0K.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-BT8JO.tmp" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "is-EM4RC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-3J3S8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "faktura_03.08.2018.pdf.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-8MCUU.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-B0TM2.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-DF12G.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-VDD8J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "is-9GB33.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-TLROC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-5GGFK.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"2e:T53e,"" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "" touched file "C:\Windows\System32\oleaccrc.dll" "" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "" touched file "C:\Windows\System32\netmsg.dll" "" touched file "C:\Windows\System32\en-US\netmsg.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\oleaccrc.dll" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\Fonts\StaticCache.dat" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\en-US\user32.dll.mui" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\netmsg.dll" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\en-US\netmsg.dll.mui" "faktura_03.08.2018.pdf.tmp" touched file "C:\Windows\System32\shfolder.dll"2f:Tb2a,Pattern match: "http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline" Pattern match: "http://schemas.microsoft.com/SMI/2" Pattern match: "www.digicert.com1+0" Pattern match: "crl3.digicert.com/EVCodeSigningSHA2-g1.crl07" Pattern match: "crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0H" Pattern match: "http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0" Pattern match: "www.digicert.com1!0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDCA-1.crl08" Pattern match: "crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0" Pattern match: "http://ocsp.digicert.com0I" Pattern match: "http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0" Pattern match: "http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@" Pattern match: "http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0" Pattern match: "http://www.digicert.com/ssl-cps-repository.htm0" Pattern match: "www.digicert.com1$0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "crl4.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://schemas.microsoft.com/SMI/2005/Windo" Pattern match: "http://www.innosetup.com/" Pattern match: "http://www.remobjects.com/ps" Heuristic match: "COMMAND.COM" Pattern match: "http://schemas.microsoft.com/SMI/20" Heuristic match: "z:/build/build/src/security/sandbox/chromium/base/threading/thread_local_storage.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/base/win/scoped_handle.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/sandbox/win/src/sandbox_policy_base.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/sandbox/win/src/handle_closer_agent.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/sandbox/win/src/broker_services.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/sandbox/win/src/interception.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/sandbox/win/src/registry_policy.cc" Heuristic match: "z:/build/build/src/security/sandbox/chromium/sandbox/win/src/sync_policy.cc" Pattern match: "https://crash-reports.mozilla.com/submit?id={ec8030f7-c20a-464f-9b0e-13a3a9e97384}&version=56.0&buildid=20170926190823" Heuristic match: "ld/src/security/sandbox/chromium/sandbox/win/src/sandbox_policy_base.cc" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "ip6.arpa" Heuristic match: "%d.%d.%d.%d.in-addr.arpa" Heuristic match: "google.com" Pattern match: "http://www.openssl.org/"30:T564,"is-KTTMA.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-P4EM8.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-JKN8F.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-ULT1I.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-JRN0K.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-BT8JO.tmp" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "is-EM4RC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-3J3S8.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "faktura_03.08.2018.pdf.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-8MCUU.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-B0TM2.tmp" has type "PE32 executable (GUI) Intel 80386 for MS Windows" "is-DF12G.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-VDD8J.tmp" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "is-9GB33.tmp" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "is-TLROC.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "is-5GGFK.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"31:T947,"" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-M89RQ.tmp\faktura_03.08.2018.pdf.tmp" with delete access "" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-M89RQ.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-ABL2F.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-5D88V.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-RM04Q.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-T8MO9.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-BPC2S.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-MTK64.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-ATNTK.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-J3QNC.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-9A1D9.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-SD652.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-23MF9.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-THB2J.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-8F94C.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-KEQJG.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-0C1UG.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-F2UHM.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-GHCUT.tmp" with delete access "faktura_03.08.2018.pdf.tmp" opened "C:\Users\zdBu6sE\AppData\Local\Temp\is-BUPHJ.tmp\is-FQQ37.tmp" with delete access32:T5f8,RegCloseKey OpenProcessToken RegOpenKeyExA GetFileAttributesA VirtualProtect GetVersionExA GetModuleFileNameA GetFileSize LockResource CreateDirectoryA DeleteFileA GetCommandLineA GetProcAddress GetModuleHandleA WriteFile LoadLibraryA CreateProcessA Sleep CreateFileA FindResourceA VirtualAlloc GetModuleFileNameW GetVersionExW IsDebuggerPresent UnhandledExceptionFilter LoadLibraryExW GetStartupInfoW CreateThread LoadLibraryW TerminateProcess GetModuleHandleW GetModuleHandleExW OutputDebugStringW CreateFileW GetWindowThreadProcessId CopyFileW FindNextFileW FindFirstFileExW GetFileAttributesExW RegOpenKeyExW VirtualAllocEx LoadLibraryExA CreateFileMappingW SleepConditionVariableCS MapViewOfFile VirtualProtectEx OutputDebugStringA GetThreadContext GetTickCount OpenProcess FindFirstFileA GetStartupInfoA CreateFileMappingA FindNextFileA accept WSAStartup connect closesocket send listen recv socket bind WSASend recvfrom sendto RegDeleteKeyA GetUserNameA SetSecurityDescriptorDacl RegCreateKeyExA RegDeleteValueA RegEnumKeyExA GetDriveTypeA DeviceIoControl CopyFileA GetComputerNameA ShellExecuteExA ShellExecuteA GetLastActivePopup SetWindowsHookExA FindWindowA GetDriveTypeW GetTempPathA GetTempPathW ExitThread CreateDirectoryW DeleteFileW FindFirstFileExA GetCommandLineW CreateProcessW RegCreateKeyExW CreateProcessAsUserW SetKernelObjectSecurity GetFileAttributesW CreateRemoteThread WriteProcessMemory ReadProcessMemory33:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAABwAAAAAAAAAAAAAAAABwAAYHd3d3d3d3d3d3d3dwAAAHeP//////////////9wAAAH////////////////eAAAB////////////////3AAAAf///////////////9wAAAH//iIiIiIiIiIiP//cAAAB////////////////3AAAAf/+IiIiIiIiIj///9wAAAH////////////////cAAAB//4iIiIiIiIiIj//3AAAAf///////////////9wAAAH//iIiIiIiP//////cAAAB////////////////3AAAAf/+IiIiIiIiIiI//9wAAAH////////////////cAAAB//4iIiIiIiIiP///3AAAAf///////////////9wAAAH//iIiIiIiIiP////cAAAB////////////////3AAAAf/+IiIiIiIiIiI//9wAAAH////////////////cAAAB////////////////3AAAAf//4iIiIiIiIiIiI9wAAAH//iIiIiIiIiIj/j4gAAAB//4iIiIiIiIiI//iIAAAAf/+IiIiIiIiIj//3gAAAAH//////////////eAAAAACP////////////94AAAAAAiIiIiIiIiIiIiIgAAAAAAAiIiIiIiIiIiIgAAAAAD/////wAAAA8AAAAPAAAAD4AAAA+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAP4AAAH+AAAD/gAAB/8AAB/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791122570380,"unified_at":"2026-10-04T14:02:50.380Z","metadata":{"hashes":{"sha256":"b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840","sha1":"6e08ba725089003831b51777e2ad3d83cc3c854f","md5":"24430134629c4ca7da4409b1ae406a2d","sha512":"aa4374b20df163bb08ffca2e80b2323e9491239af35ce0e26bcfd928233660355a81ac7e0a296b6cc23fba23676bb3b1afe094fe9113506b82f6c1cf3bfc0103","ssdeep":"98304:65sxxxbR5aJOZO6jkKtusCC5NNiSb8tqlWcZKQ:JgGl9iSHlsQ","ssdeep_chunks":["98304:65sxxxb","98304:5sxxxbR","98304:sxxxbR5","98304:xxxbR5a","98304:xxbR5aJ","98304:xbR5aJO","98304:bR5aJOZ","98304:R5aJOZO","98304:5aJOZO6","98304:aJOZO6j","98304:JOZO6jk","98304:OZO6jkK","98304:ZO6jkKt","98304:O6jkKtu","98304:6jkKtus","98304:jkKtusC","98304:kKtusCC","98304:KtusCC5","98304:tusCC5N","98304:usCC5NN","98304:sCC5NNi","98304:CC5NNiS","98304:C5NNiSb","98304:5NNiSb8","98304:NNiSb8t","98304:NiSb8tq","98304:iSb8tql","98304:Sb8tqlW","98304:b8tqlWc","98304:8tqlWcZ","98304:tqlWcZK","98304:qlWcZKQ","196608:65sxxxb","196608:5sxxxbR","196608:sxxxbR5","196608:xxxbR5a","196608:xxbR5aJ","196608:xbR5aJO","196608:bR5aJOZ","196608:R5aJOZO","196608:5aJOZO6","196608:aJOZO6j","196608:JOZO6jk","196608:OZO6jkK","196608:ZO6jkKt","196608:O6jkKtu","196608:6jkKtus","196608:jkKtusC","196608:kKtusCC","196608:KtusCC5","196608:tusCC5N","196608:usCC5NN","196608:sCC5NNi","196608:CC5NNiS","196608:C5NNiSb","196608:5NNiSb8","196608:NNiSb8t","196608:NiSb8tq","196608:iSb8tql","196608:Sb8tqlW","196608:b8tqlWc","196608:8tqlWcZ","196608:tqlWcZK","196608:qlWcZKQ","98304:JgGl9iS","98304:gGl9iSH","98304:Gl9iSHl","98304:l9iSHls","98304:9iSHlsQ"],"imphash":"2fb819a19fe4dee5c03e8c6a79342f79"},"file_info":{"file_name":"faktura_03.08.2018.pdf.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4588696,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1533543595000,"last_seen":1632171204000,"last_multi_scan":1632171204000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["adware","agentsmall","chir","filetour","madang","neshta"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":27,"suspicious_count":19,"malicious_count":6,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Malware/Gen.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Tinukebot.jpldu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jatif.965","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Jatif.965 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Tinukebot.K trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0052ef271 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Deplist.i","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TinyNuke.fjhtmx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Deplist","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Command and Control","technique":"Custom Command and Control Protocol","attack_id":"T1094","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1094","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00014894-00002972-20523-40-00BE6810\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014894-00002972-20523-67-00BE6B21\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00014894-00002972-20523-1270-00BE6C80\n SetUnhandledExceptionFilter@KERNEL32.dll at 25450-1668-659C0000\n SetUnhandledExceptionFilter@KERNEL32.dll at 34053-1044-6E4506F0\n SetUnhandledExceptionFilter@KERNEL32.dll at 37250-1016-6AD2D0E0\n SetUnhandledExceptionFilter@KERNEL32.dll at 43670-1099-6CD9BC90","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API SHGetFolderPathA@SHFOLDER.DLL at 00014343-00002628-7900-3279-0047E184","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"BSS\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".reloc\" is zero\n Raw size of \".bss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 41182-1249-10083210","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"$28","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetUserDefaultLCID@KERNEL32.DLL at 00014894-00002972-20523-905-00C03F5D\n GetUserDefaultLCID@KERNEL32.dll at 41182-475-100A1D68","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00014343-00002628-7900-2970-004565A8\n GetDiskFreeSpaceA@KERNEL32.dll at 41182-1649-10078513\n GetDiskFreeSpaceExW@KERNEL32.dll at 46984-495-1002DAAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"$29","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"faktura_03.08.2018.pdf.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FAKTURA_03.08.2018.PDF.TMP\")\n \"faktura_03.08.2018.pdf.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\FAKTURA_03.08.2018.PDF.TMP\")\n \"faktura_03.08.2018.pdf.tmp\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{BC30AEF9-5CE9-43A0-9520-C3A594C5E93C}_IS1\")\n \"faktura_03.08.2018.pdf.tmp\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{BC30AEF9-5CE9-43A0-9520-C3A594C5E93C}_IS1\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"z:\\build\\build\\src\\obj-firefox\\browser\\app\\firefox.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Contains ability to create named pipes for inter-process communication (IPC)","description":"CreateNamedPipeA@KERNEL32.DLL at 00014343-00002628-7900-832-00458DC4\n CreateNamedPipeW@KERNEL32.DLL at 00014894-00002972-20523-688-00BF737B","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-45","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$2a","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\"\n \"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$2b","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"faktura_03.08.2018.pdf.tmp\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"faktura_03.08.2018.pdf.tmp\" with commandline \"/SL5=\"$50182\n4326717\n88064\nC:\\faktura_03.08.2018.pdf.exe\"\" (UID: 00014343-00002628)\n Spawned process \"firefox.exe\" (UID: 00014894-00002972)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"faktura_03.08.2018.pdf.tmp\" with commandline \"/SL5=\"$50182\n4326717\n88064\nC:\\faktura_03.08.2018.pdf.exe\"\" (UID: 00014343-00002628)\n Spawned process \"firefox.exe\" (UID: 00014894-00002972)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$2c","origin":"Certificate Data","mitre_attack_id":"T1116","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"faktura_03.08.2018.pdf.tmp\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00014343-00002628-7900-434-00455D38","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2d","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2e","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$2f","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"faktura_03.08.2018.pdf.tmp\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Unusual Characteristics","name":"Found Delphi 4 - Delphi 2006 artifact","description":"\"faktura_03.08.2018.pdf.exe.bin\" has a PE timestamp using the buggy magic timestamp 0x2A425E19.\n \"faktura_03.08.2018.pdf.tmp\" has a PE timestamp using the buggy magic timestamp 0x2A425E19. The real compilation date is probably Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-19","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"faktura_03.08.2018.pdf.exe.bin\" was detected as \"Borland Delphi 4.0\"\n \"is-KTTMA.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-P4EM8.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-JKN8F.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"faktura_03.08.2018.pdf.tmp\" was detected as \"Borland Delphi 3.0\"\n \"is-8MCUU.tmp\" was detected as \"Borland Delphi 3.0 (???)\"\n \"is-B0TM2.tmp\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Looks up many procedures within the same disassembly stream (often used to hide usage)","description":"Found 10 calls to GetProcAddress@KERNEL32.DLL at 00014343-00002628-7900-887-0041F568\n Found 47 calls to GetProcAddress@KERNEL32.DLL at 00014343-00002628-7900-860-0044BB28","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-40","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.53860930322","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"ECDSA\" (Indicator: \"ecdsa\"; File: \"is-DF12G.tmp.3805793934\")\n \"RC4\" (Indicator: \"rc4\"; File: \"is-DF12G.tmp.3805793934\")\n \"DES\" (Indicator: \"des\"; File: \"is-DF12G.tmp.3805793934\")\n \"AES128\" (Indicator: \"aes128\"; File: \"is-DF12G.tmp.3805793934\")\n \"AES256\" (Indicator: \"aes256\"; File: \"is-DF12G.tmp.3805793934\")","origin":"File/Memory","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00014894-00002972-20523-69-00BE6DAE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"faktura_03.08.2018.pdf.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00014120-00002504-4538-79-0040A0D4\n FindResourceA@KERNEL32.DLL at 00014343-00002628-7900-673-0040D460\n FindResourceA@KERNEL32.DLL at 00014343-00002628-7900-652-0040B228\n FreeResource@KERNEL32.DLL at 00014343-00002628-7900-5101-0040D4CC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$30","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"127.0.0.1\"\n \"18.244.0.188\"\n Heuristic match: \"127.0.0.1 localhost\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"cmovnc\" (Indicator for product: Generic VNC)","origin":"File/Memory","relevance":10,"id":"string-27","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"\"cmd=\" (Indicator: \"cmd=\")","origin":"File/Memory","mitre_attack_id":"T1094","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\faktura_03.08.2018.pdf.exe\" marked \"%TEMP%\\is-M89RQ.tmp\\faktura_03.08.2018.pdf.tmp\" for deletion\n \"C:\\faktura_03.08.2018.pdf.exe\" marked \"%TEMP%\\is-M89RQ.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$31","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetSecurityDescriptorDacl@ADVAPI32.DLL at 00014343-00002628-7900-2960-0042F254\n SetEntriesInAclW@ADVAPI32.DLL at 00014894-00002972-20523-217-00BEFEC6\n SetEntriesInAclW@ADVAPI32.DLL at 00014894-00002972-20523-203-00BE29A3\n SetKernelObjectSecurity@ADVAPI32.DLL at 00014894-00002972-20523-699-00BFFBC1","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"BaseThreadInitThunk@KERNEL32.DLL\" in \"firefox.exe\"\n \"LdrLoadDll@NTDLL.DLL\" in \"firefox.exe\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"is-KTTMA.tmp\" claimed CRC 292194 while the actual is CRC 4639617\n \"is-P4EM8.tmp\" claimed CRC 584283 while the actual is CRC 292194\n \"is-JKN8F.tmp\" claimed CRC 161864 while the actual is CRC 584283\n \"is-ULT1I.tmp\" claimed CRC 156538 while the actual is CRC 161864\n \"is-JRN0K.tmp\" claimed CRC 845615 while the actual is CRC 156538\n \"is-BT8JO.tmp\" claimed CRC 3649605 while the actual is CRC 845615\n \"is-EM4RC.tmp\" claimed CRC 757564 while the actual is CRC 3649605\n \"is-3J3S8.tmp\" claimed CRC 3241133 while the actual is CRC 757564\n \"is-8MCUU.tmp\" claimed CRC 932204 while the actual is CRC 799896\n \"is-B0TM2.tmp\" claimed CRC 534675 while the actual is CRC 932204\n \"is-DF12G.tmp\" claimed CRC 766669 while the actual is CRC 534675\n \"is-VDD8J.tmp\" claimed CRC 111603 while the actual is CRC 766669\n \"is-9GB33.tmp\" claimed CRC 524759 while the actual is CRC 111603\n \"is-TLROC.tmp\" claimed CRC 436197 while the actual is CRC 524759\n \"is-5GGFK.tmp\" claimed CRC 431471 while the actual is CRC 436197","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$32","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"faktura_03.08.2018.pdf.tmp\" wrote bytes \"0857ba750478c3750000000051c18c7694988c76ee9c8c7675dc8e76273e8e76efb292760000000046cee476013de57638ede576cfcde4763123e476de2fe576c4cae47680bbe476aa6ee5769fbbe47692bbe47646bae4760abfe47600000000\" to virtual address \"0x6AFC1000\" (part of module \"SHFOLDER.DLL\")\n \"faktura_03.08.2018.pdf.tmp\" wrote bytes \"c4cae47680bbe476aa6ee5769fbbe47608bbe47646cee4766138e576de2fe576d0d9e47600000000177977764f9177767f6f7776f4f7777611f77776f2837776857e777600000000\" to virtual address \"0x6AFD1000\" (part of module \"MSIMG32.DLL\")\n \"firefox.exe\" wrote bytes \"e93d6f11f4\" to virtual address \"0x76E53C33\" (\"BaseThreadInitThunk@KERNEL32.DLL\")\n \"firefox.exe\" wrote bytes \"e90385ebf3\" to virtual address \"0x770B22B8\" (\"LdrLoadDll@NTDLL.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"faktura_03.08.2018.pdf.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"firefox.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"is-ULT1I.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-JRN0K.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-EM4RC.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-3J3S8.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-DF12G.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-VDD8J.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-9GB33.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-TLROC.tmp\" claims program is from Thu Jan 1 00:00:00 1970\n \"is-5GGFK.tmp\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/65 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/76 Antivirus vendors marked dropped file \"is-JRN0K.tmp\" as malicious (classified as \"Unsafe\" with 1% detection rate)\n 1/78 Antivirus vendors marked dropped file \"is-BT8JO.tmp\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)\n 1/76 Antivirus vendors marked dropped file \"is-B0TM2.tmp\" as malicious (classified as \"Trojan.Heur\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/76 Antivirus vendors marked spawned process \"firefox.exe\" (PID: 2972) as malicious (classified as \"Trojan.Heur\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a remote process \"%TEMP%\\is-M89RQ.tmp\\faktura_03.08.2018.pdf.tmp\" (Handle: 220)\n \"\" wrote 4 bytes to a remote process \"%TEMP%\\is-M89RQ.tmp\\faktura_03.08.2018.pdf.tmp\" (Handle: 220)\n \"\" wrote 32 bytes to a remote process \"%TEMP%\\is-M89RQ.tmp\\faktura_03.08.2018.pdf.tmp\" (Handle: 220)\n \"\" wrote 52 bytes to a remote process \"%TEMP%\\is-M89RQ.tmp\\faktura_03.08.2018.pdf.tmp\" (Handle: 220)\n \"faktura_03.08.2018.pdf.tmp\" wrote 32 bytes to a remote process \"%TEMP%\\is-BUPHJ.tmp\\firefox.exe\" (Handle: 508)\n \"faktura_03.08.2018.pdf.tmp\" wrote 52 bytes to a remote process \"%TEMP%\\is-BUPHJ.tmp\\firefox.exe\" (Handle: 508)\n \"faktura_03.08.2018.pdf.tmp\" wrote 4 bytes to a remote process \"%TEMP%\\is-BUPHJ.tmp\\firefox.exe\" (Handle: 508)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00014343-00002628-7900-95-00455D80","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":17,"files_written_count":60,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["adware","agentsmall","chir","filetour","madang","neshta"],"sample_flags":["Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5b6804a19ac508f90ba1a561","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","submit_name":"faktura_03.08.2018.pdf.exe","analysis_start_time":"2018-08-06T09:15:53+00:00","indicators_count":{"informative":27,"suspicious":30,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}],"processes":[{"pid":2504,"ppid":0,"name":"faktura_03.08.2018.pdf.exe","command_line":"","sha256":"b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840","normalized_path":"C:\\faktura_03.08.2018.pdf.exe","uid":"00014120-00002504","icon":"$33"},{"pid":2628,"ppid":2504,"name":"faktura_03.08.2018.pdf.tmp","command_line":"/SL5=\"$50182,4326717,88064,C:\\faktura_03.08.2018.pdf.exe\"","sha256":"27bae3876335bfed11a0a5ad6919ffc01802978eb30dcd3243ff0d73e3565493","normalized_path":"%TEMP%\\is-M89RQ.tmp\\faktura_03.08.2018.pdf.tmp","parent_uid":"00014120-00002504","uid":"00014343-00002628"},{"pid":2972,"ppid":2628,"name":"firefox.exe","command_line":"","sha256":"70225f14a28007815b0410b1f41f7ea6a16b6329fd69f7ec06386b05862cf5c4","normalized_path":"%TEMP%\\is-BUPHJ.tmp\\firefox.exe","parent_uid":"00014343-00002628","uid":"00014894-00002972"}],"all_imported_dlls":["kernel32.dll","cfgmgr32.dll","devrtl.dll","duser.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","ntdll.dll","userenv.dll","comres.dll","mpr.dll","api-ms-win-crt-time-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","oleaut32.dll","uxtheme.dll","tiptsf.dll","sspicli.dll","api-ms-win-crt-runtime-l1-1-0.dll","KernelBase.dll","oleacc.dll","msimg32.dll","apphelp.dll","dwmapi.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","clbcatq.dll","rpcss.dll","ExplorerFrame.dll","api-ms-win-crt-heap-l1-1-0.dll","advapi32.dll","imm32.dll","ncrypt.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-multibyte-l1-1-0.dll","nklaprok.dll","gdi32.dll","lpk.dll","ole32.dll","profapi.dll","shell32.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","comdlg32.dll","msvcp140.dll","rpcrt4.dll","comctl32.dll","usp10.dll","shfolder.dll","RstrtMgr.dll","msasn1.dll","sfc_os.dll","dui70.dll","bcryptprimitives.dll","sfc.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-core-file-l1-2-0.dll","shlwapi.dll","msctf.dll","setupapi.dll","oleaccrc.dll","mozglue.dll","ucrtbase.dll","api-ms-win-core-timezone-l1-1-0.dll","sechost.dll","msvcrt.dll","cryptbase.dll","bcrypt.dll","vcruntime140.dll","netmsg.dll","imageres.dll","api-ms-win-crt-utility-l1-1-0.dll","user32.dll","devobj.dll","propsys.dll","version.dll","dbghelp.dll","api-ms-win-crt-filesystem-l1-1-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"is-B0TM2.tmp","sha256":"70225f14a28007815b0410b1f41f7ea6a16b6329fd69f7ec06386b05862cf5c4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-BT8JO.tmp","sha256":"c8b95d5b007add4d02eedea7c1c9d455020b5bd4e625cf74ccdaa33037812ac7","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-JRN0K.tmp","sha256":"13f8b0dfe37a19dd99b5e77e4a1fc5c6f747252450414714f5d4d3f5c548084e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-3J3S8.tmp","sha256":"8a85673f24ae7a5cfe6faa03f786268b730326d95a254e86a7e84d3bf4d902bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-5GGFK.tmp","sha256":"22dfcccff2a50ce290e62444a2613ab34fea4b05e233a25cf817f481900d07ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-8MCUU.tmp","sha256":"b30160e759115e24425b9bcdf606ef6ebce4657487525ede7f1ac40b90ff7e49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-9GB33.tmp","sha256":"cc7293ab50e2b1d267d0dff676bbf8e54395ec199c76b03d6d14624cfb33004f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-DF12G.tmp","sha256":"1bafbdf42dc31d3cc336bb39c47631dde9a5af5a6465cc45bb7ae2d0065526af","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-EM4RC.tmp","sha256":"1bfc7a5ec4deccad431e611cd91f561e6db1937a1261f1ba47f657b79ae062ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-JKN8F.tmp","sha256":"9019976df7d3423dcceff61397360bb300f693a1bf98e5bfd33ad3fbeadd24d8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-P4EM8.tmp","sha256":"c8d5572ca8d7624871188f0acabc3ae60d4c5a4f6782d952b9038de3bc28b39a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-TLROC.tmp","sha256":"7df3df72dfe23196c3033482dc1676bcbbe24a0a338e2d308cdd3cbfd9d644d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-ULT1I.tmp","sha256":"8e09c794b8611e07a9a61b7d72d20947c42623e20838b02dce6edd8a0df85481","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-VDD8J.tmp","sha256":"daf91e9b6190b88c39fbc92d46cac32d05eba28d0a5d1fd38f2c66f1fce96be9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"faktura_03.08.2018.pdf.tmp","sha256":"27bae3876335bfed11a0a5ad6919ffc01802978eb30dcd3243ff0d73e3565493","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-IPUOM.tmp","sha256":"2ab71148b3dcc56780c7f66aab7d4736dffcf0e5b5c3d2af7390a58ba9061438","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"is-KTTMA.tmp","sha256":"aef2c1564a540d6df5eb092061bf2f5384e1b95ef95001518e4dfc8f9798e1a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\netmsg.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\en-US\\netmsg.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"C:\\faktura_03.08.2018.pdf.exe","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%LOCALAPPDATA%\\Programs","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%LOCALAPPDATA%\\Programs\\Common","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\_isetup","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\shfolder.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\en-US\\imageres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-datetime-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-debug-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\tor.exe","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-processthreads-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\msvcp140.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\ssleay32.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-crt-process-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libgmp-10.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\msvcr110.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\ucrtbase.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-handle-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\vcruntime140.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libevent_core-2-0-5.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\msvcp110.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-libraryloader-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-errorhandling-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-rtlsupport-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-synch-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libevent-2-0-5.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-file-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-heap-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-processenvironment-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libevent_extra-2-0-5.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libssp-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-sysinfo-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libeay32.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-util-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-crt-conio-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-memory-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-profile-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-string-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-console-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-namedpipe-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-core-interlocked-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\libgcc_s_sjlj-1.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\api-ms-win-crt-private-l1-1-0.dll","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\firefox.exe","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"path":"%TEMP%\\is-BUPHJ.tmp\\dependentlibs.list","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\\","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"Local\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]},{"name":"Local\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"5b6804a19ac508f90ba1a561"}]}]}},"report_ids":{"sandbox_job_ids":["5b6804a19ac508f90ba1a561"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample b08979af247a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b08979af247a…. Malware family: Trojan.Generic. Threat score 100/100. 11/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample b08979af247a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b08979af247a…. Malware family: Trojan.Generic. Threat score 100/100. 11/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b08979af247a96fa252be4c285cb448c1b278449f2e9591dcb63e4837614f840"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample b08979af247a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b08979af247a…. Malware family: Trojan.Generic. Threat score 100/100. 11/26 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]