26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T494,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample b1c45d4cabbc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b1c45d4cabbc…. Malware family: Tedy.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec"],"about":{"@type":"SoftwareApplication","name":"bounty-89055468548992303","applicationCategory":["peexe","assembly","executable"],"identifier":"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c1,"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"28:T862,Observed unmanaged function "EnumWindows" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetForegroundWindow" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetAncestor" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetParent" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetWindow" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetWindowLongA" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetWindowTextA" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "IsWindowVisible" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetWindowRect" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "ShowWindow" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "SetForegroundWindow" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "SetCursorPos" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetCursorPos" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "mouse_event" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "SendInput" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetWindowThreadProcessId" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "SetWindowPos" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin" Observed unmanaged function "GetLastInputInfo" in "b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin"29:T666,System.Windows.Forms.Control::set_TabIndex(System.Int32) at 387757df8d881707f05aa77299174224-6000051-AboutBox1~InitializeComponent Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateIndexGet(System.Object,System.Object[],System.String[]) at 387757df8d881707f05aa77299174224-6000173-MainWindow~XCM0004 System.Windows.Forms.Control::set_TabIndex(System.Int32) at 387757df8d881707f05aa77299174224-60000d5-Splash~InitializeComponent Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateCall(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[],System.Boolean) at 387757df8d881707f05aa77299174224-600016f-MainWindow~XOQ007 System.Windows.Forms.Control::set_TabIndex(System.Int32) at 387757df8d881707f05aa77299174224-600016d-MainWindow~InitializeComponent Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 387757df8d881707f05aa77299174224-6000172-MainWindow~XCM0003 Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 387757df8d881707f05aa77299174224-6000170-MainWindow~XCM0001 System.Windows.Forms.Control::set_TabIndex(System.Int32) at 387757df8d881707f05aa77299174224-600006d-Form1~InitializeComponent Microsoft.VisualBasic.CompilerServices.NewLateBinding::LateGet(System.Object,System.Type,System.String,System.Object[],System.String[],System.Type[],System.Boolean[]) at 387757df8d881707f05aa77299174224-6000171-MainWindow~XCM00022a:Tb40,Found string "EnumWindows" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetAncestor" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetCursor" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetCursorPos" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetForegroundWindow" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetLastInputInfo" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetParent" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetWindow" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetWindowLongA" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetWindowRect" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetWindowTextA" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "GetWindowThreadProcessId" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "IsWindowVisible" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "Rectangle" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: GDI32.DLL) Found string "SendInput" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "SetCursorPos" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "SetForegroundWindow" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "SetWindowPos" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "ShowWindow" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL) Found string "WaitForInputIdle" (Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin, API is part of module: USER32.DLL)2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A////+JmZmZmZmZmZmf///////5mIiIiIiIiIiIiZ//////l/////////////+f/////5//////////////+f////+f//////////////n///+ZmZmZmZmZmX/////5////mZmZmZmZmZmZ////+f///5mYmZn/iZmZmf////n///+ZmJmZ+ZmZmZmf///5////mZj/+fmYn/mZn///+f///5mYmfn5mZmZmZ////n///+ZmP/5//mf+Zn////5////mZmZmZmZmZmZ////+f///5mZmZmZmZmZn/////n/////n//////////////5/////5//////////////+f////+f//////////////n/////n//////////////5/////5//////////////+f////+f//////////////n/////n//////////////5/////5//////////////+f////+f//////////////n/////n///////////mZmZ/////5//////////mY//mf////+f////////+Z//+Z//////n/////////n//5n//////5/////////5//mf//////+f////////+f+Z////////l/////////n5n/////////mYiIiIiIiJmf//////////iZmZmZmZmZ//////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791674970593,"unified_at":"2026-10-10T23:29:30.593Z","metadata":{"hashes":{"sha256":"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec","sha1":"1d92729f9dc8bde0bbcb198ddeefa7263d469395","md5":"387757df8d881707f05aa77299174224","sha512":"f7bfc9ca55a66aac856f2fd4643da1d8dbc2ffa5f103bf894d50fad3e23867197690545752a7a0f7c936046347c3792b9790627119d00c3f57e5c8bad9386dc6","ssdeep":"24576:J3PXVv7nj4Ui1C8Ko2bkTU/a5KR5OyW1Cw+85Zgb2ALTsIBMNjnNNOhAe/S0:J/XVvLjQlF2H1cyI+kZ22A","ssdeep_chunks":["24576:J3PXVv7","24576:3PXVv7n","24576:PXVv7nj","24576:XVv7nj4","24576:Vv7nj4U","24576:v7nj4Ui","24576:7nj4Ui1","24576:nj4Ui1C","24576:j4Ui1C8","24576:4Ui1C8K","24576:Ui1C8Ko","24576:i1C8Ko2","24576:1C8Ko2b","24576:C8Ko2bk","24576:8Ko2bkT","24576:Ko2bkTU","24576:o2bkTU/","24576:2bkTU/a","24576:bkTU/a5","24576:kTU/a5K","24576:TU/a5KR","24576:U/a5KR5","24576:/a5KR5O","24576:a5KR5Oy","24576:5KR5OyW","24576:KR5OyW1","24576:R5OyW1C","24576:5OyW1Cw","24576:OyW1Cw+","24576:yW1Cw+8","24576:W1Cw+85","24576:1Cw+85Z","24576:Cw+85Zg","24576:w+85Zgb","24576:+85Zgb2","24576:85Zgb2A","24576:5Zgb2AL","24576:Zgb2ALT","24576:gb2ALTs","24576:b2ALTsI","24576:2ALTsIB","24576:ALTsIBM","24576:LTsIBMN","24576:TsIBMNj","24576:sIBMNjn","24576:IBMNjnN","24576:BMNjnNN","24576:MNjnNNO","24576:NjnNNOh","24576:jnNNOhA","24576:nNNOhAe","24576:NNOhAe/","24576:NOhAe/S","24576:OhAe/S0","49152:J3PXVv7","49152:3PXVv7n","49152:PXVv7nj","49152:XVv7nj4","49152:Vv7nj4U","49152:v7nj4Ui","49152:7nj4Ui1","49152:nj4Ui1C","49152:j4Ui1C8","49152:4Ui1C8K","49152:Ui1C8Ko","49152:i1C8Ko2","49152:1C8Ko2b","49152:C8Ko2bk","49152:8Ko2bkT","49152:Ko2bkTU","49152:o2bkTU/","49152:2bkTU/a","49152:bkTU/a5","49152:kTU/a5K","49152:TU/a5KR","49152:U/a5KR5","49152:/a5KR5O","49152:a5KR5Oy","49152:5KR5OyW","49152:KR5OyW1","49152:R5OyW1C","49152:5OyW1Cw","49152:OyW1Cw+","49152:yW1Cw+8","49152:W1Cw+85","49152:1Cw+85Z","49152:Cw+85Zg","49152:w+85Zgb","49152:+85Zgb2","49152:85Zgb2A","49152:5Zgb2AL","49152:Zgb2ALT","49152:gb2ALTs","49152:b2ALTsI","49152:2ALTsIB","49152:ALTsIBM","49152:LTsIBMN","49152:TsIBMNj","49152:sIBMNjn","49152:IBMNjnN","49152:BMNjnNN","49152:MNjnNNO","49152:NjnNNOh","49152:jnNNOhA","49152:nNNOhAe","49152:NNOhAe/","49152:NOhAe/S","49152:OhAe/S0","24576:J/XVvLj","24576:/XVvLjQ","24576:XVvLjQl","24576:VvLjQlF","24576:vLjQlF2","24576:LjQlF2H","24576:jQlF2H1","24576:QlF2H1c","24576:lF2H1cy","24576:F2H1cyI","24576:2H1cyI+","24576:H1cyI+k","24576:1cyI+kZ","24576:cyI+kZ2","24576:yI+kZ22","24576:I+kZ22A"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-89055468548992303","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":888320,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678356774000,"last_seen":1678646406000,"last_multi_scan":1678646406000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nanocore"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":20,"suspicious_count":8,"malicious_count":3,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AgentTesla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.306938","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.EWB.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.306938 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AIGZ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/MSIL.Injector.my","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.MSIL.Stealer.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.MSIL.AgentTesla.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Tedy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to start a process"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Found API related strings"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Contains ability to load content from resource"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime"},{"type":"informative","value":"Contains ability to load content into memory"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"suspicious","value":"Contains ability to simulate user keyboard/mouse input"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to gather process details"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function \"MemoryStream\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethod\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"ToString\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"\n Observed function \"Concat\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"\n Observed function \"Split\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"\n Observed function \"Replace\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin]\n Observed api:\"GetForegroundWindow\"[Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin]\n Observed api:\"GetForegroundWindow\"[Source: 00000000-00002780.00000000.67217.00D42000.00000020.mdmp\n 00000000-00002780.00000000.67224.00D42000.00000020.mdmp]\n Observed api:\"GetWindowText\"[Source: 00000000-00002780.00000000.67217.00D42000.00000020.mdmp\n 00000000-00002780.00000000.67224.00D42000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function \"Process.set_StartInfo\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"\n Observed function \"Process.Start\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"tnFillRectangle\" (Indicator: \"FillRect\")\n \"_BtnFillRectangle\" (Indicator: \"FillRect\")\n \"get_BtnFillRectangle\" (Indicator: \"FillRect\")\n \"set_BtnFillRectangle\" (Indicator: \"FillRect\")\n \"BtnFillRectangle_Click\" (Indicator: \"FillRect\")\n \"FillRectangle\" (Indicator: \"FillRect\")\n \"BtnFillRectangle\" (Indicator: \"FillRect\")\n \"Sleep\" (Indicator: \"Sleep\")\n \"EnumWindows\" (Indicator: \"EnumWindows\")\n \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\")\n \"GetParent\" (Indicator: \"GetParent\")\n \"GetWindow\" (Indicator: \"GetWindow\")\n \"GetWindowInteger\" (Indicator: \"GetWindow\")\n \"GetWindowLongA\" (Indicator: \"GetWindow\")\n \"GetWindowText\" (Indicator: \"GetWindow\")\n \"GetWindowTextA\" (Indicator: \"GetWindow\")\n \"IsWindowVisible\" (Indicator: \"IsWindow\")\n \"GetWindowRect\" (Indicator: \"GetWindow\")\n \"ShowWindow\" (Indicator: \"ShowWindow\")\n \"SetForegroundWindow\" (Indicator: \"SetForegroundWindow\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"KERNEL32\" at base 77970000\n \".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 72e30000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 76060000\n \".exe\" loaded module \"GDI32.DLL\" at base 75ee0000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 75bc0000\n \".exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE.DLL\" at base 6d500000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 6d470000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"150016002c7a586d@ADVAPI32.dll\"\n \"0e000f00a47a586d@ADVAPI32.dll\"\n \"0e000f00d87a586d@ADVAPI32.dll\"\n \"11001200387f586d@ADVAPI32.dll\"\n \"11001200a47f586d@ADVAPI32.dll\"\n \"12001300b87f586d@ADVAPI32.dll\"\n \"12001300e07f586d@ADVAPI32.dll\"\n \"14001500bc93586d@ADVAPI32.dll\"\n \"100011000e030973@ADVAPI32.dll\"\n \"0d000e0022030973@ADVAPI32.dll\"\n \"0d000e00fe020973@ADVAPI32.dll\"\n \"0b000c00cc020973@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"FuzzForms.My\"\n Heuristic match: \"~j.HU\"\n Heuristic match: \"@G.et\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details","description":"Observed function \"GetProcessById\" in \"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\"","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"$28","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.38977140979\n 0.0980041756627","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\n Found - (Indicator: \"cast\") in Source: b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.bin\n Found - (Indicator: \"des\") in Source: 00000000-00002780.00000000.67217.00D42000.00000020.mdmp\n Found - (Indicator: \"des\") in Source: 60000c5-Form1~NuevoToolStripMenuItem_Click_1\n Found - (Indicator: \"des\") in Source: 00000000-00002780.00000000.67217.00D42000.00000020.mdmp\n 00000000-00002780.00000000.67224.00D42000.00000020.mdmp\n Found - (Indicator: \"cast\") in Source: 00000000-00002780.00000000.67217.00D42000.00000020.mdmp\n 00000000-00002780.00000000.67224.00D42000.00000020.mdmp\n Found - (Indicator: \"des\") in Source: 00000000-00002780.00000000.67217.00E0C000.00000002.mdmp\n 00000000-00002780.00000000.67224.00E0C000.00000002.mdmp\n Found - (Indicator: \"des\") in Source: 00000000-00002780.00000000.67217.7F6F0000.00000002.mdmp\n 00000000-00002780.00000000.67224.7F6F0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/68 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"11.0.0.0\"\n \"16.0.0.0\"\n Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"\n Potential IP \"1.0.0.0\" found in string \"MyApplication.app,version=\"1.0.0.0\"C:\\b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.exe\"\n Potential IP \"16.10.0.0\" found in string \"KMicrosoft.VisualStudio.Editors.SettingsDesigner.SettingsSingleFileGenerator\t16.10.0.0\"\n Potential IP \"1.0.0.0\" found in string \"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains ability to simulate user keyboard/mouse input","description":"FuzzForms.WindowHelperNativeMethods::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.UIntPtr) at 387757df8d881707f05aa77299174224-600014a-WindowHelperNativeMethods~ClickRight\n FuzzForms.WindowHelperNativeMethods::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.UIntPtr) at 387757df8d881707f05aa77299174224-600014b-WindowHelperNativeMethods~ClickMiddle\n FuzzForms.WindowHelperNativeMethods::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.UIntPtr) at 387757df8d881707f05aa77299174224-6000149-WindowHelperNativeMethods~ClickLeft\n FuzzForms.WindowHelperNativeMethods::mouse_event(System.Int32,System.Int32,System.Int32,System.Int32,System.UIntPtr) at 387757df8d881707f05aa77299174224-600014c-WindowHelperNativeMethods~ClickAndDrag","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056","relevance":6,"id":"stream-35","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"db4d057300000000\" to virtual address \"0x00D42000\" (part of module \"B1C45D4CABBCE2828022B098CA7A2FC9369BE4EF140B23C50A6F9598C9CC96EC.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/68 Antivirus vendors marked sample as malicious (61% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":21,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nanocore"],"sandbox_reports":[{"id":"640e252c4f8e5bb8690c6315","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Tedy","submit_name":"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.exe","analysis_start_time":"2023-03-12T19:17:00+00:00","indicators_count":{"informative":20,"suspicious":9,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}],"processes":[{"pid":2780,"ppid":0,"name":"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.exe","command_line":"","sha256":"b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec","normalized_path":"C:\\b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec.exe","uid":"00000000-00002780","icon":"$2b"}],"all_imported_dlls":["gdi32.dll","usp10.dll","msctf.dll","kernel32.dll","advapi32.dll","rpcrt4.dll","ws2_32.dll","fltLib.dll","ntdll.dll","lpk.dll","ole32.dll","oleaut32.dll","imm32.dll","mscoree.dll","sechost.dll","mscoreei.dll","msvcrt.dll","user32.dll","KernelBase.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"640e252c4f8e5bb8690c6315"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["640e252c4f8e5bb8690c6315"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Tedy.Generic Sample b1c45d4cabbc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b1c45d4cabbc…. Malware family: Tedy.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec"}],["$","meta","4",{"property":"og:title","content":"Malicious Tedy.Generic Sample b1c45d4cabbc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b1c45d4cabbc…. Malware family: Tedy.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b1c45d4cabbce2828022b098ca7a2fc9369be4ef140b23c50a6f9598c9cc96ec"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Tedy.Generic Sample b1c45d4cabbc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b1c45d4cabbc…. Malware family: Tedy.Generic. Threat score 100/100. 10/28 AV engines flagged this file. 3 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]