23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSIL/TrojanDropper.Agent Sample b4a4f9767a7e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b4a4f9767a7e…. Malware family: MSIL/TrojanDropper.Agent. Threat score 100/100. 11/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35","keywords":["Malicious","MSIL/TrojanDropper.Agent","malware analysis","sandbox report","threat intelligence","b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35"],"about":{"@type":"SoftwareApplication","name":"setup.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSIL/TrojanDropper.Agent","antivirusDetections":{"malicious":11,"total":29},"behavioralIndicators":{"malicious":5,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T555,Antivirus vendors marked dropped file "libcurl.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "libeay32.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "libgcc_s_dw2-1.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "libidn-11.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "msvcr120.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "pthreadGC2.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "pthreadVC2.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ssleay32.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"), Antivirus vendors marked dropped file "zlib1.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows")25:T5f2,"" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM\9E0A3B9B9F457233A335D7FBA8F95419\SYSTEM.NI.DLL" at base 69DB0000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.DRAWING\DBFE8642A8ED7B2B103AD28E0C96418A\SYSTEM.DRAWING.NI.DLL" at base 69C20000 "" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V2.0.50727_32\SYSTEM.WINDOWS.FORMS\3AFCD5168C7A6CB02EAB99D7FD71E102\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 69040000 "" loaded module "SHELL32.DLL" at base 761C0000 "" loaded module "PROPSYS.DLL" at base 74A70000 "" loaded module "OLE32.DLL" at base 77A10000 "" loaded module "COMCTL32.DLL" at base 74B90000 "" loaded module "OLEAUT32.DLL" at base 76F40000 "" loaded module "ADVAPI32.DLL" at base 77700000 "" loaded module "CLBCATQ.DLL" at base 77D00000 "" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 74A70000 "" loaded module "NTMARTA.DLL" at base 75250000 "" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 778D0000 "" loaded module "MPR.DLL" at base 72900000 "" loaded module "USER32.DLL" at base 777A0000 "" loaded module "%WINDIR%\SYSTEM32\DRPROV.DLL" at base 700C0000 "" loaded module "%WINDIR%\SYSTEM32\NTLANMAN.DLL" at base 6FC70000 "" loaded module "%WINDIR%\SYSTEM32\DAVCLNT.DLL" at base 6F73000026:T517,"libcurl.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libgcc_s_dw2-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libidn-11.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "msvcr120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "pthreadGC2.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "pthreadVC2.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "rthdcpl.exe" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "decred.cl" has type "ASCII text with very long lines" "config.xml" has type "XML 1.0 document Little-endian UTF-16 Unicode text with CRLF line terminators" "Realtek HD Audio" has type "XML 1.0 document Little-endian UTF-16 Unicode text with CRLF line terminators"27:T40b,"libcurl.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libeay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libgcc_s_dw2-1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "libidn-11.dll" has type "PE32 executable (DLL) (console) Intel 80386 for MS Windows" "msvcr120.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "pthreadGC2.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "pthreadVC2.dll" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" "rthdcpl.exe" has type "PE32 executable (GUI) Intel 80386 (stripped to external PDB) for MS Windows" "ssleay32.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows" "zlib1.dll" has type "PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB) for MS Windows"28:T1253,"" wrote 640000 bytes starting with PE header signature to file "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 1707520 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 118784 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 279955 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 970912 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 94300 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 55808 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 1675264 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 368640 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "" wrote 113166 bytes starting with PE header signature to file "\REGISTRY\USER\S-1-5-21-4162757579-3804539371-4239455898-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000800000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...29:Tba4,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAhPSURBVFhHhVcNaJVVGP4YLa7DG7dbN766bnjLhrdseJsOR+YyrOHSRktbKss/VsslGUMrhvavrcRAxtQcLfthYFkmmDZbmBGFw6mMLurkgmy4lpfG0LhdnLw9z3vO93mVIuH1fPvuOe/zvM/7nvO9x3HygnKthcS5ISR5MB3zw5J3o7VARPJg+ePMqMbnca5afgFGvvPmY63D9daXkwef1+P9G7gCWyf5OSAEuGE8gIJRHfPwd37Q/O0Z3xlClqD14wd1PYl/jd6LgE4saB5BbiqS/ND/GOfQxkd1LYk4AYzwSTVI5BpM/4/rJWcUjNaCBsJ3SeBW2G3FEnBhERifaXz2/saYf7MlaYloahgMSfjpsKk3eTHm5VsXIAJGq8AEub1YCu64F+BxqV7RqM++TTDvQxPiUmCflVAoZhQDEU8NJZGD6ZhCAwEWSwDmRY0oAhGAI1o6DU4skdBd02TkckYqlzRI8O4yCd5ZKgWxUglOKpPA5HLJiEgAJIJFJT5ZJR8GEZKg7xwltDivqXJOyInaACcULASAwKSEgvA5dE+FhOIzffMIDF0ckQIQU3KFOUSYGvhWZS0Jo8aNdht54JQOcjLi4CQ4IjiBpszS6EcYJQiEp86RSKJSwiVz9PmWxBz8Lj7BIOYEJ89UIvTlpS8/VGjSYreso9uIxULJIVfBBAOsURL4vgoFcKdVKTjNmVQukfJq39yZNUI70ndKRq+MycrmFhB+WEJTYVBKiTAYEGFwWhs2JQ4fvEKj5AXIZ+iemX5k4WmVCrRi/QdyiQQQZWBqlbiPLBb3oVpx59SJ++gyHbuOJ2UUc5JDIwCvwrp5Er4fKiEAJQLfTEvgdhQtiptKOLq1wGritNnKNELAGfMU1J21QNwKgABsw85Odc4acOeulKLHGyT6WL2OsZrVUvREg/ScOacKDWUyEuZ6JbnAKFU2D6RIxKRFlUC6cUZg66BqK59ZJS+2tErkAciJaKKP1EnR3GVSNL9eYk80yvu7v1PnJFD2wlsSW7JWYotgGIuXb5DiunVy6ve0SRNUijy6FORAED5UpYcRSMUCTU1qBIVqd4pDSRi55hgLa9a+hciw+MnVEntqjQFZ3izNn+3XFJDAws2fSPzFLVL87BsSf36jxF/agvFt/Y0qpS5mpMiSiy1qkthCKrRalbumUKGEo1U+pUIJZC6PqZMFr7WayOhcrUViOQCdPUkpWd8hJS+3qSXe/Fzir7brWiqQGslIfPVmKX5uo2/uwiYFT2eyMoIUaU0A2wmhorVIUDR0MAT2HBtaOyW+qsWAvLpD4muvAtBR4r09kninU0o37pbS976Whi9+NkUK23M8JYn17Wbtujapa91z1TeC7B0YMphQ3uF/rHRuIzq+AHYsIpKo2/41HHVIYtNuBfQk1jrYesDafilv65Z9p4dV/tErIuVbQA5rSjd2KhENDD6HLxm/lY2vS2Q6ihJb3NEthwp1Zy+WNe17ZAgT0pYECcUhL8HKP+yWtV19CsIoEwAlMI3PJy6M+rukrK1Lylu7pHTLPuns7ZfRsTEZtj5T8BlCsNxpPCcsASiASo0tbJQUnHPy8N9Z+RNy7TjaL+XbDysBGiNIw7x//FvfjSFKjHvPpqW01cxNbDXzNXpYCkTaD/2q25Nb0xDwUjC7VrcbGSYtgfMsGOYbEa76tk9/G7iclYtWBZJUy2Y1+mEAMADOK9vWLftTaRM95vSTAN7PfWWzBnuVQHGZqQGcalEcKvH6ZknCYYqSYSHlXvrNMV3ch7/PZY3D9FhWLmQvq6UBwnEQv/XD+kCcQZA8o6f1orjpw53faAgwBVNQA3r04oPiPoCTC/u0CluQE09mCDQmA0wFCqvvb5F+AJHAHxbYI8CRcwdh/UhbEutTSEkagZDsKYynsyJPt7TryckDiScuzx+HJ5KmoaxSojYNtS0dBhBgA3BIWdt7TqnjQZAZxvtccCWAd6wBzt30/TF9HiBhEEgCPIViiOEsiOKE5DeCX1d+oMxRTBVwRLoojOjcpTj9mmTX0aT0UUI4qv94n0SrG/X9/sERSYPEAKIaspHrs53bebJfa8ld/raupSIqPcCLqleJ+yB2gI2eX16HXQ8fQl4tYIuwFmJ1qAWwZkQrP+3S45gnmOYV785BYqaDRgC+a/6Fs83HqnrHQf+9guNo93PPzzM6KX7+HX6btQ9gyxWfZQoSqVASiJjOvzxzXqqwrWI4DXkuHElfgqxjcuyvLAxFh9z3XcxK5c5ujXRy/RvStK9HVanZtMNIj49beAa2npXe6wvQFEe1QdBUkAQmaA+Az7BHQpWAs4bPD0vVtoOy67dBaepOyuKvemXDT6d13Ht2WGo6uqV25wHNN8Fr30XRMfJKVD2U5eeYedfuCG0AexFHu9X/IKFbE19GFzlt+6FHSfTCOa3z9Hmp+ahbGr78VZoPncA24/nBtBiyXKMVjy0XnlGl4Kw1pptpN/2hy54QnTBvOGxGfSXYktlvBAsTlVtYg8KClLXvdshuHK+eKgRTA3j7jydU7kI2K1jDAKimkR3gjNx2QorJS4t/DeNVK1cJbk/9VCMl09GCoXrpNFq1QgqfXAMyhhAjJehE1Et0/lVgHjTeF4+pDfC+wM6Y/SdwtBlmV+zdVFQJ3oY8EnoDsnUBNbhNtUDZajE1+HgpIUaKZ+0P8RvPEw9Yo6bkejcwOdeU59wXHb2l8ILg3YLZs+feivRigraaBYreQRVBPklGrdSOaNH5G1OnuYaCXt/HVpyBedcz/4pGbHM3tCS8W7FeSmGeGt4Nidcxe1/Qw4spgikgjf0/u169O6LZzWm//buhf0E1mP8Ax/phLHrpLCYAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791164426726,"unified_at":"2026-10-05T01:40:26.726Z","metadata":{"hashes":{"sha256":"b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35","sha1":"d108fd7b2f3a43d896977c261f4f349f215be7d2","md5":"48254975771ae7e37e9326ec98fbbafe","sha512":"403f46c9b2154911c870b22fede4df7746b79428ea89c2c8b3f43ee30fbf7f0f5e3d38a76f968b10995964e022ace3f1682558e2e93d69793c227f3e8c456a4d","ssdeep":"98304:tUe3G8A2zg7gafFu0zB04dvVkzUHfL4HjCDv+AE:t733FEMafA0zB04dy8L4DCDv+A","ssdeep_chunks":["98304:tUe3G8A","98304:Ue3G8A2","98304:e3G8A2z","98304:3G8A2zg","98304:G8A2zg7","98304:8A2zg7g","98304:A2zg7ga","98304:2zg7gaf","98304:zg7gafF","98304:g7gafFu","98304:7gafFu0","98304:gafFu0z","98304:afFu0zB","98304:fFu0zB0","98304:Fu0zB04","98304:u0zB04d","98304:0zB04dv","98304:zB04dvV","98304:B04dvVk","98304:04dvVkz","98304:4dvVkzU","98304:dvVkzUH","98304:vVkzUHf","98304:VkzUHfL","98304:kzUHfL4","98304:zUHfL4H","98304:UHfL4Hj","98304:HfL4HjC","98304:fL4HjCD","98304:L4HjCDv","98304:4HjCDv+","98304:HjCDv+A","98304:jCDv+AE","196608:tUe3G8A","196608:Ue3G8A2","196608:e3G8A2z","196608:3G8A2zg","196608:G8A2zg7","196608:8A2zg7g","196608:A2zg7ga","196608:2zg7gaf","196608:zg7gafF","196608:g7gafFu","196608:7gafFu0","196608:gafFu0z","196608:afFu0zB","196608:fFu0zB0","196608:Fu0zB04","196608:u0zB04d","196608:0zB04dv","196608:zB04dvV","196608:B04dvVk","196608:04dvVkz","196608:4dvVkzU","196608:dvVkzUH","196608:vVkzUHf","196608:VkzUHfL","196608:kzUHfL4","196608:zUHfL4H","196608:UHfL4Hj","196608:HfL4HjC","196608:fL4HjCD","196608:L4HjCDv","196608:4HjCDv+","196608:HjCDv+A","196608:jCDv+AE","98304:t733FEM","98304:733FEMa","98304:33FEMaf","98304:3FEMafA","98304:FEMafA0","98304:EMafA0z","98304:MafA0zB","98304:afA0zB0","98304:fA0zB04","98304:A0zB04d","98304:0zB04dy","98304:zB04dy8","98304:B04dy8L","98304:04dy8L4","98304:4dy8L4D","98304:dy8L4DC","98304:y8L4DCD","98304:8L4DCDv","98304:L4DCDv+","98304:4DCDv+A"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"setup.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":3687936,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499294557000,"last_seen":1657192803000,"last_multi_scan":1657192803000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":9,"suspicious_count":17,"malicious_count":5,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Drop.Agent.tnvjt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Bulz.343876","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Bulz.343876 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDropper.Agent.CPC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.CoinMiner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f7f951 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"malicious","threat_name":"Unavailable (production)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSIL/TrojanDropper.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$24","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$25","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\62a0b3e4b40ec0e8c5cfaa0c8848e64a\\mscorlib.ni.dll\" at 6A880000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"ShellExecuteEx@SHELL32.dll\"\n \"ShellExecuteExW@SHELL32.dll\"\n \"PSCreateMemoryPropertyStore@PROPSYS.dll\"\n \"PSPropertyBag_WriteDWORD@PROPSYS.dll\"\n \"RegEnumKeyA@ADVAPI32.dll\"\n \"PSPropertyBag_ReadDWORD@PROPSYS.dll\"\n \"RegEnumKeyW@ADVAPI32.dll\"\n \"PSPropertyBag_ReadBSTR@PROPSYS.dll\"\n \"PSPropertyBag_ReadStrAlloc@PROPSYS.dll\"\n \"GetCatalogObject@CLBCatQ.DLL\"\n \"GetCatalogObject2@CLBCatQ.DLL\"\n \"DllGetClassObject@PROPSYS.dll\"\n \"DllCanUnloadNow@PROPSYS.dll\"\n \"InitializeSecurityDescriptor@ADVAPI32.dll\"\n \"SetEntriesInAclW@ADVAPI32.dll\"\n \"GetMartaExtensionInterface@ntmarta.dll\"\n \"SetSecurityDescriptorDacl@ADVAPI32.dll\"\n \"IsTextUnicode@ADVAPI32.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegGetValueW@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"schtasks.exe\" with commandline \"/create /tn \"Realtek HD Audio\" /f /xml \"%LOCALAPPDATA%\\History\\Realtek HD\\config.xml\"\" (UID: 00272812-00002072)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00133796-00003568-77BD228D-147031\n LookupAccountNameLocalW@SECHOST.DLL at 00133796-00003568-77BD228D-151484\n GetUserNameExW@SSPICLI.DLL at 00153343-00003652-77BD228D-269048\n LookupAccountNameLocalW@SECHOST.DLL at 00153343-00003652-77BD228D-270844","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$26","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"kernel\\x11mod.cl\"\n Heuristic match: \"aes_helper.cl\"\n Heuristic match: \"alexkarnew.cl\"\n Heuristic match: \"alexkarold.cl\"\n Heuristic match: \"animecoin.cl\"\n Heuristic match: \"ckolivas.cl\"\n Heuristic match: \"cubehash.cl\"\n Heuristic match: \"darkcoin.cl\"\n Heuristic match: \"fuguecoin.cl\"\n Heuristic match: \"groestl.cl\"\n Heuristic match: \"groestlcoin.cl\"\n Heuristic match: \"hamsi_helper.cl\"\n Heuristic match: \"inkcoin.cl\"\n Heuristic match: \"keccak.cl\"\n Heuristic match: \"marucoin.cl\"\n Heuristic match: \"myriadcoin-groestl.cl\"\n Heuristic match: \"panama.cl\"\n Heuristic match: \"quarkcoin.cl\"\n Heuristic match: \"qubitcoin.cl\"\n Heuristic match: \"shavite.cl\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00133796-00003568-77BB61F8-156126\n \"\" at 00153343-00003652-77BB61F8-274473","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text with unusual entropies 7.97682477712","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"schtasks.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds\n \"\" sleeping for \"00120000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db\"\n \"\" created file \"C:\\Windows\\SYSTEM32\\en-US\\ntdll.dll.mui\"\n \"\" created file \"C:\\Windows\\system32\\rsaenh.dll\"\n \"\" created file \"C:\\Windows\\Fonts\\staticcache.dat\"\n \"\" created file \"C:\\Windows\\system32\\schtasks.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"$27","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.3568.3737546\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.3568.3737546\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3568.3737781\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch.3652.3756234\" with delete access\n \"\" opened \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch.3652.3756250\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch.3652.3756609\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetEntriesInAclW@ADVAPI32.DLL at 00133796-00003568-77BD228D-144765\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00133796-00003568-77BD228D-144813\n SetEntriesInAclW@ADVAPI32.DLL at 00153343-00003652-77BD228D-266283\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00153343-00003652-77BD228D-266343","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"libcurl.dll\" claimed CRC 641654 while the actual is CRC 3736457\n \"libeay32.dll\" claimed CRC 1716374 while the actual is CRC 641654\n \"libgcc_s_dw2-1.dll\" claimed CRC 145909 while the actual is CRC 1716374\n \"libidn-11.dll\" claimed CRC 335596 while the actual is CRC 145909\n \"msvcr120.dll\" claimed CRC 1028896 while the actual is CRC 335596\n \"pthreadGC2.dll\" claimed CRC 96924 while the actual is CRC 1028896\n \"rthdcpl.exe\" claimed CRC 1689837 while the actual is CRC 67861\n \"ssleay32.dll\" claimed CRC 425739 while the actual is CRC 1689837\n \"zlib1.dll\" claimed CRC 128542 while the actual is CRC 425739","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"CreateFileMappingA\n GetModuleHandleA\n GetProcAddress\n GetTickCount\n GetVersionExA\n LoadLibraryA\n MapViewOfFile\n Sleep\n SleepEx\n VirtualProtect\n FindWindowA\n WSAStartup\n accept\n bind\n closesocket\n connect\n listen\n recv\n recvfrom\n send\n sendto\n socket\n FindFirstFileA\n FindNextFileA\n GetModuleHandleW\n GetModuleHandleExW\n GetCommandLineA\n GetCommandLineW\n GetModuleFileNameA\n GetModuleFileNameW\n WriteFile\n FindFirstFileExA\n FindFirstFileExW\n FindNextFileW\n CreateThread\n ExitThread\n LoadLibraryExW\n GetFileAttributesExW\n CreateDirectoryW\n GetDriveTypeW\n DeleteFileW\n CreateProcessA\n LoadLibraryExA\n CreateProcessW\n GetTempPathA\n GetTempPathW\n GetVersionExW\n VirtualAlloc\n LoadLibraryW\n OutputDebugStringW\n GetStartupInfoW\n CreateFileW\n IsDebuggerPresent\n UnhandledExceptionFilter\n TerminateProcess\n OutputDebugStringA\n GetThreadContext\n OpenProcess\n GetStartupInfoA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"05FCC73E\" to virtual address \"0x6B381FDC\" (part of module \"MSCORWKS.DLL\")\n \"\" wrote bytes \"D95FCD0E\" to virtual address \"0x6B381FDC\" (part of module \"MSCORWKS.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/57 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"malicious","category":"General","name":"The input sample dropped a file that was identified as malicious","description":"20/56 Antivirus vendors marked dropped file \"rthdcpl.exe\" as malicious (classified as \"Unwanted\" with 35% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00001500 bytes of memory in \"setup.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"setup.exe\" (Protection: \"read/write\")\n \"\" allocated 00001500 bytes of memory in \"schtasks.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"schtasks.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"$28","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 1500 bytes to a foreign process \"setup.exe\" (PID: 00003652)\n \"\" wrote 4 bytes to a foreign process \"setup.exe\" (PID: 00003652)\n \"\" wrote 32 bytes to a foreign process \"setup.exe\" (PID: 00003652)\n \"\" wrote 52 bytes to a foreign process \"setup.exe\" (PID: 00003652)\n \"\" wrote 1500 bytes to a foreign process \"schtasks.exe\" (PID: 00002072)\n \"\" wrote 4 bytes to a foreign process \"schtasks.exe\" (PID: 00002072)\n \"\" wrote 32 bytes to a foreign process \"schtasks.exe\" (PID: 00002072)\n \"\" wrote 52 bytes to a foreign process \"schtasks.exe\" (PID: 00002072)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"File system monitor detected a system task modification"}],"sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":13,"files_written_count":61,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"572a729caac2ed206b5319d4","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"QVM03.0.0000.Malware","submit_name":"setup.exe","analysis_start_time":"2016-05-04T18:24:56+00:00","indicators_count":{"informative":9,"suspicious":21,"malicious":9},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}],"processes":[{"pid":3568,"ppid":0,"name":"setup.exe","command_line":"","normalized_path":"Z:\\setup.exe","uid":"00133796-00003568","icon":"$29"},{"pid":3652,"ppid":3568,"name":"setup.exe","command_line":"runas","normalized_path":"Z:\\setup.exe","parent_uid":"00133796-00003568","uid":"00153343-00003652"},{"pid":2072,"ppid":3652,"name":"schtasks.exe","command_line":"/create /tn \"Realtek HD Audio\" /f /xml \"%LOCALAPPDATA%\\History\\Realtek HD\\config.xml\"","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00153343-00003652","uid":"00272812-00002072"}],"all_imported_dlls":["ntlanman.dll","WINMM.dll","WININET.dll","dwmapi.dll","SHLWAPI.dll","CRYPTBASE.dll","davclnt.dll","SspiCli.dll","CLBCatQ.DLL","wkscli.dll","OLEAUT32.dll","MSASN1.dll","PROPSYS.dll","DEVOBJ.dll","sfc_os.DLL","ntdll.dll","GDI32.dll","USP10.dll","KERNELBASE.dll","mscoreei.dll","cscapi.dll","culture.dll","shfolder.dll","taskschd.dll","comctl32.dll","drprov.dll","samcli.dll","PSAPI.DLL","mscorwks.dll","ntmarta.dll","mscorjit.dll","System.ni.dll","sechost.dll","VERSION.dll","MSCOREE.DLL","IMM32.DLL","SETUPAPI.dll","LPK.dll","sfc.dll","RPCRT4.dll","apphelp.dll","CRYPTSP.dll","SHELL32.dll","profapi.dll","MSCTF.dll","KERNEL32.dll","System.Drawing.ni.dll","USERENV.dll","CRYPT32.dll","UxTheme.dll","USER32.dll","urlmon.dll","System.Windows.Forms.ni.dll","ktmw32.dll","MPR.dll","ole32.dll","MSACM32.dll","mscorlib.ni.dll","rsaenh.dll","CFGMGR32.dll","msvcrt.dll","netutils.dll","iertutil.dll","AcGenral.DLL","ADVAPI32.dll","kernel32.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"rthdcpl.exe","sha256":"9843735dd57e2b7d828061c9ddbf70e38f4f56efd0aa51bc33057a3bee17248c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"libcurl.dll","sha256":"87afaa3b6fba45af63c1e87706a45a03bde4ab791ff353bbfdf06eb4d9571b04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"libeay32.dll","sha256":"1018b24154c60d4276e3c08391dd9ed6a4545611700d85859dfbbbce8a89629e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"libgcc_s_dw2-1.dll","sha256":"63843b68b9887080c6d6abe74abd4382312c2082d92b5f527ba13fd90ea5c956","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"libidn-11.dll","sha256":"1869c96af7c8f1130490b626f9b2c335f14a7b014035310d2421200e6cd98a81","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"msvcr120.dll","sha256":"86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"pthreadGC2.dll","sha256":"c271f42da9f1483de15869914d216a8ef44ca80c0d5907789b6e9873e3aa245f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"pthreadVC2.dll","sha256":"bac4472990c1dc2f037019791bd18888e78a3ae86605f3aae86f812a4d7d4f60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"ssleay32.dll","sha256":"8d7d5d574de8f5535e41ca4467493aebe987502990b5908de91496f33d902010","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"zlib1.dll","sha256":"f4b42f671cf34329584afe4193c311dbb2a0396524499a23819467431a2b673d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"config.xml","sha256":"4aa64a7c3adb507b0f156828eaf89ae9d020f0e1efcd836aef452f052c570fdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"decred.cl","sha256":"f62d89bd5fbb1ab13cb80438b917da4b8f449340dd1b8d58055e15f2c2e85411","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"Realtek HD Audio","sha256":"c61ac1efef3ce8dffc246e004fd9f167baa5a64ba444227d92e246c7a8f86fa4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]}],"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%SAMPLEDIR%\\setup.exe.config","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index137.dat","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\assembly\\pubpol15.dat","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\SYSTEM32\\en-US\\ntdll.dll.mui","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%SAMPLEDIR%\\setup.exe","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\libcurl.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\libcurl.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\libeay32.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\libeay32.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\libgcc_s_dw2-1.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\libgcc_s_dw2-1.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\libidn-11.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\libidn-11.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\msvcr120.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\msvcr120.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\pthreadGC2.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\pthreadGC2.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\pthreadVC2.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\pthreadVC2.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\rthdcpl.exe","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\rthdcpl.exe","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\ssleay32.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\ssleay32.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\zlib1.dll","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\kernel","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\kernel\\decred.cl","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\kernel\\decred.cl","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\History\\Realtek HD\\config.xml","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Realtek HD\\config.xml","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"path":"%WINDIR%\\system32\\schtasks.exe","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"572a729caac2ed206b5319d4"}]}]}},"report_ids":{"sandbox_job_ids":["572a729caac2ed206b5319d4"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious MSIL/TrojanDropper.Agent Sample b4a4f9767a7e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b4a4f9767a7e…. Malware family: MSIL/TrojanDropper.Agent. Threat score 100/100. 11/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35"}],["$","meta","4",{"property":"og:title","content":"Malicious MSIL/TrojanDropper.Agent Sample b4a4f9767a7e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b4a4f9767a7e…. Malware family: MSIL/TrojanDropper.Agent. Threat score 100/100. 11/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b4a4f9767a7e28a645544e0e450cf9383537e59ca5f5c4ff1638672eab202b35"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSIL/TrojanDropper.Agent Sample b4a4f9767a7e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b4a4f9767a7e…. Malware family: MSIL/TrojanDropper.Agent. Threat score 100/100. 11/29 AV engines flagged this file. 5 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]