26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ba,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample c02f8d757dd3… — Score 75/100 — Hybrid Analysis","description":"Malicious verdict for sample c02f8d757dd3…. Malware family: Win/malicious_confidence_100%. Threat score 75/100. 7/27 AV engines flagged this file. 2 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910","additionalType":"Malicious sample"},"threatScore":75,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7d7,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003552.00000000.165743.00401000.00000020.mdmp, 00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp")28:T7a4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "NtWaitForSingleObject" (Indicator: "NtWaitForSingleObject"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp")29:T526,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp")2a:T909,Assembly shows XOR instruction xor bh byte ptr [edx] in Stream UID: 56658-605-00406E88 Assembly shows XOR instruction xor eax 35760006h in Stream UID: 56658-704-004069A8 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 56658-707-00406B80 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 56658-711-00406B90 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 56658-730-00406AF8 Assembly shows XOR instruction xor al B7h in Stream UID: 56658-830-0042B700 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 56658-830-0042B700 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 56658-833-00406978 Assembly shows XOR instruction xor byte ptr [3D400006h] bh in Stream UID: 56658-845-00406D08 Assembly shows XOR instruction xor byte ptr [esi+eax] 00h in Stream UID: 56658-877-00406A00 Assembly shows XOR instruction xor al 06h in Stream UID: 56658-887-00406A10 Assembly shows XOR instruction xor al 06h in Stream UID: 56658-888-00406A08 Assembly shows XOR instruction xor eax 00000006h in Stream UID: 56658-892-00406998 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 56658-896-00406A80 Assembly shows XOR instruction xor ch byte ptr [edi] in Stream UID: 56658-1319-004067D8 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 56658-1613-00406760 Assembly shows XOR instruction xor byte ptr [esi] al in Stream UID: 56658-1764-00406758 Assembly shows XOR instruction xor dword ptr fs:[esi] eax in Stream UID: 56658-1782-00406B78 Assembly shows XOR instruction xor eax 35600006h in Stream UID: 56658-1786-004069B0 Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 56658-1789-00406A90 Assembly shows XOR instruction xor byte ptr [35460006h] dh in Stream UID: 56658-1790-004069B8 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 56658-1792-00406B10 Assembly shows XOR instruction xor al byte ptr [esi] in Stream UID: 56658-1794-00406AF0 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 56658-1800-00406A68 Assembly shows XOR instruction xor eax dword ptr [esi] in Stream UID: 56658-1853-00406A70 Assembly shows XOR instruction xor dword ptr [esi] eax in Stream UID: 56658-1869-00406B602b:T103f,Found XOR loop in file "sample.bin" at offset 363644; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 409737; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 414495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 417903; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 421651; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 425493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 427611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 443329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 443377; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 460341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 492023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 509441; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 551061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 553953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 403549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 405397; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 180056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 182541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311696; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 311729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323026; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 323420; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 407592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 409698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 414846; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420892; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421612; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 425454; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 427572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 707613; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 710693; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 711721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 712749; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 713777; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 714101; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 714805; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 716349; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 717377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 717889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 718401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 718913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 719425; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 719937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 720449; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 720961; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 721473; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 721985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 722497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 723009; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 723521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 724033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 724545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 725057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 725569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 746529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 747721; code bytes = 80302c:T4f8,Found system information discovery API: "GetSystemInfo" in file "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin" Found system information discovery API: "GetMonitorInfoA" in file "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin" Found system information discovery API: "GetMonitorInfo" in file "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin" Found system information discovery API: "GetMonitorInfoW" in file "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin" Found system information discovery API: "GetMonitorInfoA" in "00000000-00003552.00000000.165743.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfo" in "00000000-00003552.00000000.165743.00401000.00000020.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00003552.00000000.165743.00401000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00003552.00000000.165743.0045F000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp"2d:T506,Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00003552.00000000.165743.02FB0000.00000004.mdmp")2e:T4f8,"" (Indicator: "GetDC"; Source: "00000000-00003552.00000000.165743.02FB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003552.00000000.165743.02FB0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003552.00000000.165743.02FB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003552.00000000.165743.02FB0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003552.00000000.165743.02FB0000.00000004.mdmp")3c:T908,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp")3d:T7a4,Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp, 00000000-00003552.00000000.165743.04C50000.00000040.mdmp, 00000000-00003552.00000000.165743.04C90000.00000040.mdmp, 00000000-00003552.00000000.165743.04FA0000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003552.00000000.165743.0045F000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; Source: "00000000-00003552.00000000.165743.04C50000.00000040.mdmp")3e:Te01,Found string "GetLongPathNameA" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: KERNELBASE.DLL) Found string "VariantChangeTypeEx" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarNeg" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarNot" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarAdd" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarSub" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarMul" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarDiv" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarIdiv" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarMod" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarAnd" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarOr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarXor" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarCmp" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarI4FromStr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarR4FromStr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarR8FromStr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarDateFromStr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarCyFromStr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarBoolFromStr" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromCy" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromDate" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "VarBstrFromBool" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: OLEAUT32.DLL) Found string "GetMonitorInfoA" (Source: c02f8d757dd3b6737450f50cddebc35712ea6f5573e0b5d30dc0de34a4a67910.bin, API is part of module: USER32.DLL)3f:T6d2,GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-886-0040CBB8 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-889-00406E20 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1529-00422144 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1629-00427E58 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1630-00427EE0 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1632-00428008 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1633-004280A0 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1635-00428174 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1636-00428248 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1637-0042831C GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1707-0042C180 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1770-0043BF28 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1900-004510B4 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1901-00454210 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-1989-0043B514 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2002-004510C0 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2003-004510CC GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2004-004510E4 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2005-004510D8 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2089-00451104 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2108-00452274 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2130-0043EE6C GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2132-0043EE50 GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2288-0044AC4C GetSystemMetrics@USER32.DLL at 00000000-00003552-57892-2308-0044BEC040:T425,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003552.00000000.165743.02FB0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6978931c24e973a3bc0106b9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00003552.00000000.165743.04C50000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6978931c24e973a3bc0106b9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003552.00000000.165743.04C50000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003552.00000000.165743.04C90000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003552.00000000.165743.04FA0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6978931c24e973a3bc0106b9"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\" BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6978931c24e973a3bc0106b9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"