25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T10e1,Found api reference "NCryptFinalizeKey(hKey, acquireToFinalizeKeyFlags(fAcquire))" (Indicator: "NCryptFinalizeKey"; Source: "sample.bin"), Found api reference "NCryptOpenStorageProvider" (Indicator: "NCryptOpenStorageProvider"; Source: "sample.bin"), Found api reference " BCryptEnumContexts: " (Indicator: "BCryptEnumContexts"; Source: "sample.bin"), Found api reference "NCryptSetProperty(hProv, NCRYPT_USE_COUNT_ENABLED_PROPERTY, reinterpret_cast(&fEnable), sizeof (fEnable), 0)" (Indicator: "NCryptSetProperty"; Source: "sample.bin"), Found api reference "NCryptGetProperty( hKey, NCRYPT_PROVIDER_HANDLE_PROPERTY, reinterpret_cast(&hProv), cbOut, &cbOut, 0)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found api reference "CryptGetUserKey(hProv, nKeySpec, &hKey)" (Indicator: "CryptGetUserKey"; Source: "sample.bin"), Found api reference "CryptDecrypt( m_hKey, 0, fFinal ? TRUE : FALSE, 0, pbPlainText, pcbPlainText)" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found api reference "NCryptGetProperty( m_hKey, ple->pszNCryptProperty, pbValue, *pcbValue, pcbValue, fFlags)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found api reference "NCryptGetProperty( hKey, NCRYPT_ALGORITHM_PROPERTY, reinterpret_cast(m_szAlgorithm), cbOut, &cbOut, 0)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found api reference "NCryptSecretAgreement( m_hKey, (NCRYPT_KEY_HANDLE)pPublicCipher->GetHandle(), &hSecret, 0)" (Indicator: "NCryptSecretAgreement"; Source: "sample.bin"), Found api reference "CryptSetKeyParam( m_hKey, ple->nCapiProperty, pbValue, fFlags)" (Indicator: "CryptSetKeyParam"; Source: "sample.bin"), Found api reference "CryptGetHashParam(m_hHash, HP_HASHVAL, pbHash, &cbHash, 0)" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found api reference "NCryptSignHash( m_hKey, const_cast(pPaddingInfo), const_cast(pbHash), cbHash, pbSignature, *pcbSignature, pcbSignature, fPadding)" (Indicator: "NCryptSignHash"; Source: "sample.bin"), Found api reference "CryptImportPublicKeyInfo( (HCRYPTPROV)pCipher->GetProviderHandle(), nCertEncodingType, const_cast(pcpki), &hCapiKey)" (Indicator: "CryptImportPublicKeyInfo"; Source: "sample.bin"), Found api reference "BCryptSignHash( m_hKey, const_cast(pPaddingInfo), const_cast(pbHash), cbHash, pbSignature, *pcbSignature, pcbSignature, fPadding)" (Indicator: "BCryptSignHash"; Source: "sample.bin"), Found api reference "NCryptSetProperty(hKey, NCRYPT_LENGTH_PROPERTY, reinterpret_cast(&cBitsInKey), sizeof (cBitsInKey), 0)" (Indicator: "NCryptSetProperty"; Source: "sample.bin"), Found api reference "CryptSetProvParam( hProv, PP_CRYPT_COUNT_KEY_USE, reinterpret_cast(&fEnable), 0)" (Indicator: "CryptSetProvParam"; Source: "sample.bin"), Found api reference "BCryptOpenAlgorithmProvider(&hProv, pwszAlgorithm, pwszProvider, 0)" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found api reference "BCryptGetProperty( hKey, BCRYPT_ALGORITHM_NAME, reinterpret_cast(m_szAlgorithm), cbOut, &cbOut, 0)" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found api reference "BCryptGetProperty( hProv, BCRYPT_OBJECT_LENGTH, reinterpret_cast(&cbHashObject), cbcbHashObject, &cbcbHashObject, 0)" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found api reference "NCryptExportKey( (NCRYPT_KEY_HANDLE)pEphemeralCipher->GetHandle(), 0, BCRYPT_ECCPUBLIC_BLOB, 0, 0, 0, &cbPublicKey2, 0)" (Indicator: "CryptExportKey"; Source: "sample.bin"), Found api reference "NCryptExportKey( (NCRYPT_KEY_HANDLE)pEphemeralCipher->GetHandle(), 0, BCRYPT_ECCPUBLIC_BLOB, 0, 0, 0, &cbPublicKey2, 0)" (Indicator: "NCryptExportKey"; Source: "sample.bin"), Found api reference "NCryptSetProperty( hKey, NCRYPT_EXPORT_POLICY_PROPERTY, reinterpret_cast(&fExportPolicy), sizeof (fExportPolicy), 0)" (Indicator: "NCryptSetProperty"; Source: "sample.bin"), Found api reference " BCryptEnumAlgorithms: " (Indicator: "BCryptEnumAlgorithms"; Source: "sample.bin"), Found api reference " BCryptEnumContextFunctions: " (Indicator: "BCryptEnumContextFunctions"; Source: "sample.bin"), Found api reference "CryptGenKey( hProv, nKeySpec, fGenKey | (cBitsInKey << 16), &hKey)" (Indicator: "CryptGenKey"; Source: "sample.bin")27:T11ae,Found reference to API "NCryptSetProperty(hProv, NCRYPT_USE_COUNT_ENABLED_PROPERTY, reinterpret_cast(&fEnable), sizeof (fEnable), 0)" (Indicator: "NCryptSetProperty"; Source: "sample.bin"), Found reference to API "NCryptGetProperty( hKey, NCRYPT_PROVIDER_HANDLE_PROPERTY, reinterpret_cast(&hProv), cbOut, &cbOut, 0)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found reference to API "CryptGetUserKey(hProv, nKeySpec, &hKey)" (Indicator: "CryptGetUserKey"; Source: "sample.bin"), Found reference to API "CryptDecrypt( m_hKey, 0, fFinal ? TRUE : FALSE, 0, pbPlainText, pcbPlainText)" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "NCryptGetProperty( m_hKey, ple->pszNCryptProperty, pbValue, *pcbValue, pcbValue, fFlags)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found reference to API "NCryptGetProperty( hKey, NCRYPT_ALGORITHM_PROPERTY, reinterpret_cast(m_szAlgorithm), cbOut, &cbOut, 0)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found reference to API "CryptSetKeyParam( m_hKey, ple->nCapiProperty, pbValue, fFlags)" (Indicator: "CryptSetKeyParam"; Source: "sample.bin"), Found reference to API "CryptGetHashParam(m_hHash, HP_HASHVAL, pbHash, &cbHash, 0)" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API "NCryptSignHash( m_hKey, const_cast(pPaddingInfo), const_cast(pbHash), cbHash, pbSignature, *pcbSignature, pcbSignature, fPadding)" (Indicator: "CryptSignHash"; Source: "sample.bin"), Found reference to API "CryptImportPublicKeyInfo( (HCRYPTPROV)pCipher->GetProviderHandle(), nCertEncodingType, const_cast(pcpki), &hCapiKey)" (Indicator: "CryptImportPublicKeyInfo"; Source: "sample.bin"), Found reference to API "BCryptSignHash( m_hKey, const_cast(pPaddingInfo), const_cast(pbHash), cbHash, pbSignature, *pcbSignature, pcbSignature, fPadding)" (Indicator: "CryptSignHash"; Source: "sample.bin"), Found reference to API "NCryptSetProperty(hKey, NCRYPT_LENGTH_PROPERTY, reinterpret_cast(&cBitsInKey), sizeof (cBitsInKey), 0)" (Indicator: "NCryptSetProperty"; Source: "sample.bin"), Found reference to API "CryptSetProvParam( hProv, PP_CRYPT_COUNT_KEY_USE, reinterpret_cast(&fEnable), 0)" (Indicator: "CryptSetProvParam"; Source: "sample.bin"), Found reference to API "CryptAcquireContext() --> %x " (Indicator: "CryptAcquireContext"; Source: "sample.bin"), Found reference to API "BCryptGetProperty( hKey, BCRYPT_ALGORITHM_NAME, reinterpret_cast(m_szAlgorithm), cbOut, &cbOut, 0)" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API "BCryptGetProperty( hProv, BCRYPT_OBJECT_LENGTH, reinterpret_cast(&cbHashObject), cbcbHashObject, &cbcbHashObject, 0)" (Indicator: "BCryptGetProperty"; Source: "sample.bin"), Found reference to API "NCryptExportKey( (NCRYPT_KEY_HANDLE)pEphemeralCipher->GetHandle(), 0, BCRYPT_ECCPUBLIC_BLOB, 0, 0, 0, &cbPublicKey2, 0)" (Indicator: "CryptExportKey"; Source: "sample.bin"), Found reference to API "NCryptSetProperty( hKey, NCRYPT_EXPORT_POLICY_PROPERTY, reinterpret_cast(&fExportPolicy), sizeof (fExportPolicy), 0)" (Indicator: "NCryptSetProperty"; Source: "sample.bin"), Found reference to API "CryptGenKey( hProv, nKeySpec, fGenKey | (cBitsInKey << 16), &hKey)" (Indicator: "CryptGenKey"; Source: "sample.bin"), Found reference to API "CryptImportPublicKeyInfoEx2( nCertEncodingType, const_cast(pcpki), CRYPT_OID_INFO_PUBKEY_SIGN_KEY_FLAG, 0, &hBCryptKey)" (Indicator: "CryptImportPublicKeyInfo"; Source: "sample.bin"), Found reference to API "CryptCreateHash(hProv, nAlgId, 0, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "NCryptExportKey( hKey, pEncryptionKey ? reinterpret_cast(pEncryptionKey->GetHandle()) : 0, GetBlobLookupEntry(pszBlobType)->pszCngBlobType, 0, pbBlob, *pcbBlob, pcbBlob, 0)" (Indicator: "CryptExportKey"; Source: "sample.bin"), Found reference to API "NCryptImportKey" (Indicator: "CryptImportKey"; Source: "sample.bin"), Found reference to API "NCryptGetProperty( (NCRYPT_KEY_HANDLE)pCipher->GetHandle(), NCRYPT_ALGORITHM_PROPERTY, reinterpret_cast(szAlgorithmName), sizeof(szAlgorithmName), &cbOut, 0)" (Indicator: "NCryptGetProperty"; Source: "sample.bin"), Found reference to API "NCryptImportKey( hProv, 0, BCRYPT_ECCPUBLIC_BLOB, 0, &hNCryptPubKey2, pbPublicKey2, cbPublicKey2, 0)" (Indicator: "CryptImportKey"; Source: "sample.bin")28:T5b8,Found reference to API "CryptGetUserKey(hProv, nKeySpec, &hKey)" (Indicator: "CryptGetUserKey"; Source: "sample.bin"), Found reference to API "CryptDecrypt( m_hKey, 0, fFinal ? TRUE : FALSE, 0, pbPlainText, pcbPlainText)" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "CryptGetHashParam(m_hHash, HP_HASHVAL, pbHash, &cbHash, 0)" (Indicator: "CryptGetHashParam"; Source: "sample.bin"), Found reference to API "CryptGenKey( hProv, nKeySpec, fGenKey | (cBitsInKey << 16), &hKey)" (Indicator: "CryptGenKey"; Source: "sample.bin"), Found reference to API "CryptCreateHash(hProv, nAlgId, 0, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "CryptHashData(m_hHash, pbData, cbData, 0)" (Indicator: "CryptHashData"; Source: "sample.bin"), Found reference to API "CryptCreateHash(hProv, nAlgorithm, 0, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "sample.bin"), Found reference to API "CryptEncrypt( m_hKey, 0, fFinal ? TRUE : FALSE, 0, pbCipherText, pcbCipherText, cbCipherTextMax)" (Indicator: "CryptEncrypt"; Source: "sample.bin"), Found reference to API "CryptExportKey( hKey, pEncryptionKey ? reinterpret_cast(pEncryptionKey->GetHandle()) : 0, GetBlobLookupEntry(pszBlobType)->nCapiBlobType, 0, pbBlob, pcbBlob)" (Indicator: "CryptExportKey"; Source: "sample.bin"), Found reference to API "CryptDuplicateKey(hKey, 0, 0, &m_hKey)" (Indicator: "CryptDuplicateKey"; Source: "sample.bin")29:T6cd,Found reference to API "CryptDecrypt( m_hKey, 0, fFinal ? TRUE : FALSE, 0, pbPlainText, pcbPlainText)" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt( m_hKey, const_cast(pbCipherText), cbCipherText, 0, m_pbUpdatedIV.get(), m_cBytesPerBlock, pbPlainText, *pcbPlainText, pcbPlainText, getEncryptDecryptFlag(fFinal))" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptDecrypt( m_hKey, const_cast(pbCipherText), cbCipherText, 0, m_pbUpdatedIV.get(), m_cBytesPerBlock, pbPlainText, *pcbPlainText, pcbPlainText, getEncryptDecryptFlag(fFinal))" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "NCryptDecrypt( m_hKey, const_cast(pbCipherText), cbCipherText, 0, pbPlainText, *pcbPlainText, pcbPlainText, getEncryptDecryptFlag())" (Indicator: "NCryptDecrypt"; Source: "sample.bin"), Found reference to API "NCryptDecrypt( m_hKey, const_cast(pbCipherText), cbCipherText, 0, pbPlainText, *pcbPlainText, pcbPlainText, getEncryptDecryptFlag())" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "myCryptDecryptMessage" (Indicator: "CryptDecryptMessage"; Source: "sample.bin"), Found reference to API "myCryptDecryptMessage" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "myCryptDecryptMessage" (Indicator: "DecryptMessage"; Source: "sample.bin"), Found reference to API "cseCryptDecryptMessageFromCert" (Indicator: "CryptDecryptMessage"; Source: "sample.bin"), Found reference to API "cseCryptDecryptMessageFromCert" (Indicator: "CryptDecrypt"; Source: "sample.bin"), Found reference to API "cseCryptDecryptMessageFromCert" (Indicator: "DecryptMessage"; Source: "sample.bin")2a:Tb91,Found string "ldap:///CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6%11" (Indicator: "public key"; Source: "sample.bin"), Found string "[S/MIME] @Private Keys" (Indicator: "private key"; Source: "sample.bin"), Found string "CN=AIA,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=CDP,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=NTAuthCertificates,CN=Public Key Services,CN=Services," (Indicator: "public key"; Source: "sample.bin"), Found string "Encrypted Private Key" (Indicator: "private key"; Source: "sample.bin"), Found string "CN=%7,CN=AIA,CN=Public Key Services,CN=Services,%6" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=Certification Authorities,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "%ws,CN=Public Key Services,CN=Services,CN=Configuration,%ws%ws" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=Certificate Templates,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=Enrollment Services,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "ldap:///CN=AIA,CN=Public Key Services,CN=Services,%6?cACertificate?one?objectClass=certificationAuthority" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string ",CN=Certification Authorities,CN=Public Key Services,CN=Services," (Indicator: "public key"; Source: "sample.bin"), Found string "CN=KRA,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "ldap:///CN=%7,CN=Certification Authorities,CN=Public Key Services,CN=Services,%6%11" (Indicator: "public key"; Source: "sample.bin"), Found string "cn=public key services," (Indicator: "public key"; Source: "sample.bin"), Found string "ldap:///CN=%7,CN=KRA,CN=Public Key Services,CN=Services,%6%13" (Indicator: "public key"; Source: "sample.bin"), Found string "Private Keys" (Indicator: "private key"; Source: "sample.bin"), Found string "ldap:///CN=KRA,CN=Public Key Services,CN=Services,%6?userCertificate?one?objectClass=msPKI-PrivateKeyRecoveryAgent" (Indicator: "public key"; Source: "sample.bin"), Found string "ldap:///CN=NTAuthCertificates,CN=Public Key Services,CN=Services,%6%11" (Indicator: "public key"; Source: "sample.bin"), Found string "CN=OID,CN=Public Key Services,CN=Services" (Indicator: "public key"; Source: "sample.bin"), Found string "ldap:///CN=%7%8,CN=%2,CN=CDP,CN=Public Key Services,CN=Services,%6%10" (Indicator: "public key"; Source: "sample.bin"), Found string "Private Key Usage Period" (Indicator: "private key"; Source: "sample.bin")2b:T6f8,Found reference to API "BCryptOpenAlgorithmProvider(&hProv, pwszAlgorithm, pwszProvider, 0)" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "sample.bin"), Found reference to API "BCryptDecrypt( m_hKey, const_cast(pbCipherText), cbCipherText, 0, m_pbUpdatedIV.get(), m_cBytesPerBlock, pbPlainText, *pcbPlainText, pcbPlainText, getEncryptDecryptFlag(fFinal))" (Indicator: "BCryptDecrypt"; Source: "sample.bin"), Found reference to API "BCryptExportKey( hBCryptKey, 0, BCRYPT_ECCPUBLIC_BLOB, 0, 0, &cbPublicKey1, 0)" (Indicator: "BCryptExportKey"; Source: "sample.bin"), Found reference to API "BCryptSetProperty( m_hProv, ple->pszBCryptProperty, const_cast(pbValue), cbValue, fFlags)" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API "BCryptExportKey( hBCryptKey, 0, BCRYPT_ECCPUBLIC_BLOB, pbPublicKey1, cbPublicKey1, &cbPublicKey1, 0)" (Indicator: "BCryptExportKey"; Source: "sample.bin"), Found reference to API "BCryptSetProperty( m_hKey, ple->pszBCryptProperty, const_cast(pbValue), cbValue, fFlags)" (Indicator: "BCryptSetProperty"; Source: "sample.bin"), Found reference to API "BCryptExportKey( hKey, pEncryptionKey ? pEncryptionKey->GetHandle() : 0, GetBlobLookupEntry(pszBlobType)->pszCngBlobType, pbBlob, *pcbBlob, pcbBlob, 0)" (Indicator: "BCryptExportKey"; Source: "sample.bin"), Found reference to API "BCryptEncrypt( m_hKey, const_cast(pbPlainText), cbPlainText, 0, m_pbUpdatedIV.get(), m_cBytesPerBlock, pbCipherText, *pcbCipherText, pcbCipherText, getEncryptDecryptFlag(fFinal))" (Indicator: "BCryptEncrypt"; Source: "sample.bin"), Found reference to API "BCryptSetProperty( m_hHash, ple->pszBCryptProperty, const_cast(pbValue), cbValue, fFlags)" (Indicator: "BCryptSetProperty"; Source: "sample.bin")2c:T828,Found string "CALG_AES_192" (Indicator: "aes"; Source: "sample.bin"), Found string "CALG_AES_128" (Indicator: "aes"; Source: "sample.bin"), Found string "ALG_SID_3DES" (Indicator: "3des"; Source: "sample.bin"), Found string "CALG_AES_256" (Indicator: "aes"; Source: "sample.bin"), Found string "ALG_SID_ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "Aes256-Sha256" (Indicator: "aes"; Source: "sample.bin"), Found string "Aes256-Sha256" (Indicator: "aes256"; Source: "sample.bin"), Found string "2sha256ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "sha1ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ECDSA_P521" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAESPNZ8/YFGNPbsu1Gfs/IEbVXsajWTOaft0oaFIZDqUiwy1o/PErK38SCFFWa+PeOQFXc9NKv6nV0+05/YIYuUQ==" (Indicator: "aes"; Source: "sample.bin"), Found string "PROV_EC_ECDSA_SIG" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "3sha384ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ECDSA_" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ALG_SID_AES" (Indicator: "aes"; Source: "sample.bin"), Found string "OID_INFO_ECC_CURVE_ECDSA_ALLOWED" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "CALG_AES" (Indicator: "aes"; Source: "sample.bin"), Found string "CALG_3DES" (Indicator: "3des"; Source: "sample.bin"), Found string "ALG_SID_AES_192" (Indicator: "aes"; Source: "sample.bin"), Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "ALG_SID_AES_128" (Indicator: "aes"; Source: "sample.bin"), Found string "4sha512ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAETtK8v7MICve56qTHHDhhBOuV4IlUaESxZryCfk9QbG9co/CqPvTsgPDbCpp6oFtyAHwlDhnvr7JijXRD9Cb2FA==" (Indicator: "aes"; Source: "sample.bin"), Found string "ALG_SID_3DES_112" (Indicator: "3des"; Source: "sample.bin"), Found string "ECDSA" (Indicator: "ecdsa"; Source: "sample.bin"), Found string "PROV_EC_ECDSA_FULL" (Indicator: "ecdsa"; Source: "sample.bin")2d:T8b2,Found reference to "SHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "szOID_KMOD_CERT_SHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "TemplatePropSymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "sample.bin"), Found reference to "TemplatePropAsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "sample.bin"), Found reference to "Aes256-Sha256" (Indicator: "Aes"; Source: "sample.bin"), Found reference to "szOID_IntuneUserCredsOid" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "msPKI-Enterprise-Oid" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "ALG_SID_RC2" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "CALG_RC2" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "SignatureHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "ALG_SID_HMAC" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "szOID_KMOD_IMAGE_SHA512" (Indicator: "SHA512"; Source: "sample.bin"), Found reference to "szOID_PKCS_12_pbeWithSHA1And3KeyTripleDES" (Indicator: "TripleDES"; Source: "sample.bin"), Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "szOID_PKCS_12_pbeWithSHA1And128BitRC2" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "szOID_IntuneUserOid" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "szOID_IntuneAgentOid" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "CALG_HMAC" (Indicator: "HMAC"; Source: "sample.bin"), Found reference to "szOID_PKCS_12_pbeWithSHA1And40BitRC2" (Indicator: "RC2"; Source: "sample.bin"), Found reference to "TemplatePropHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "szOID_IntuneTenantOid" (Indicator: "Oid"; Source: "sample.bin"), Found reference to "SHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "szOID_KMOD_CERT_SHA384" (Indicator: "SHA384"; Source: "sample.bin"), Found reference to "CNGHashAlgorithm" (Indicator: "HashAlgorithm"; Source: "sample.bin"), Found reference to "szOID_PKCS_12_pbeWithSHA1And2KeyTripleDES" (Indicator: "TripleDES"; Source: "sample.bin")2e:T737,"Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: sample.bin, "Software\Policies\Microsoft\Cryptography\AutoEnrollment" in Source: sample.bin, "Software\Microsoft\SystemCertificates\AuthRoot\AutoUpdate" in Source: sample.bin, "System\CurrentControlSet\Control\Cryptography\Ngc" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\CertSvc\Configuration" in Source: sample.bin, "Software\Microsoft\Cryptography\AutoEnrollment" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Group Policy\History" in Source: sample.bin, "SYSTEM\CurrentControlSet\Control\Cryptography\ECCParameters" in Source: sample.bin, "System\CurrentControlSet\Services\crypt32" in Source: sample.bin, "Software\Policies\Microsoft\PassportForWork" in Source: sample.bin, "Software\Microsoft\Cryptography\PolicyServers" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\CertSvc\Configuration\" in Source: sample.bin, "Software\Microsoft\Policies\PassportForWork" in Source: sample.bin, "HKEY_USERS\" in Source: sample.bin, "Software\Policies\Microsoft\Cryptography\PolicyServers" in Source: sample.bin, "Software\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config" in Source: sample.bin, "Software\Microsoft\Cryptography\CertificateTemplateCache" in Source: sample.bin, "Software\Microsoft\Cryptography\MSCEP" in Source: sample.bin, "Software\Policies\Microsoft\SystemCertificates\AuthRoot" in Source: sample.bin, "Software\Policies\Microsoft\SystemCertificates\Root\ProtectedRoots" in Source: sample.bin, "Software\Microsoft\Windows NT\CurrentVersion\DIMS" in Source: sample.bin, "SOFTWARE\Microsoft\Windows NT\CurrentVersion\WorkplaceJoin\AADNGC" in Source: sample.bin, "HKEY_CLASSES_ROOT\" in Source: sample.bin, "HKEY_LOCAL_MACHINE\" in Source: sample.bin2f:T879,Found reference to API (Indicator: "RegEnumKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyEx"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstChangeNotification"; Source: "sample.bin"), Found reference to API (Indicator: "CryptGetObjectUrl"; Source: "sample.bin"), Found reference to API (Indicator: "CryptRetrieveObjectByUrlW"; Source: "sample.bin"), Found reference to API (Indicator: "FDICreate"; Source: "sample.bin"), Found reference to API (Indicator: "CertOpenStore"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingCreateW"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingFree"; Source: "sample.bin"), Found reference to API (Indicator: "SetThreadUILanguage"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetCertificateChain"; Source: "sample.bin"), Found reference to API (Indicator: "CryptFormatObject"; Source: "sample.bin"), Found reference to API (Indicator: "CertSetCertificateContextProperty"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseFailFastException"; Source: "sample.bin"), Found reference to API (Indicator: "CryptFindCertificateKeyProvInfo"; Source: "sample.bin"), Found reference to API (Indicator: "K32EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "GetComputerNameEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptExportPublicKeyInfo"; Source: "sample.bin"), Found reference to API (Indicator: "FDICopy"; Source: "sample.bin"), Found reference to API (Indicator: "WerSetFlags"; Source: "sample.bin"), Found reference to API (Indicator: "RpcBindingBind"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserNameEx"; Source: "sample.bin"), Found reference to API (Indicator: "CryptImportPublicKeyInfoEx2"; Source: "sample.bin"), Found reference to API (Indicator: "NCryptCreateProtectionDescriptor"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueEx"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample c314ecf62855… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample c314ecf62855…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"certutil.exe\",\"applicationCategory\":[\"peexe\",\"executable\"],\"identifier\":\"c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":2},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793748688909,"unified_at":"2026-11-03T23:31:28.909Z","metadata":{"hashes":{"sha256":"c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","sha1":"a56d7ff56a275c242f1bbd356e9b3e8b1bfb47d3","md5":"a8ebe4bcc60f8187e7813d9ca1f6d306","imphash":"2171ef4f4da833eba24598f942de392e","pehash":"1eba3b3a640663b6b8b4a9648ed2bb10aa49d9db"},"file_info":{"file_name":"certutil.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1289216,"entropy":6.48,"compile_timestamp":"2031-08-19T19:47:12","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793748671000,"last_seen":1793748671000,"last_multi_scan":1793748671000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":6,"import_count":0,"export_count":0,"embedded_file_count":9,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":1157860,"raw_size":1158144},{"name":".data","virtual_address":"0x11c000","virtual_size":50944,"raw_size":40448},{"name":".idata","virtual_address":"0x129000","virtual_size":20500,"raw_size":20992},{"name":".didat","virtual_address":"0x12f000","virtual_size":388,"raw_size":512},{"name":".rsrc","virtual_address":"0x130000","virtual_size":4160,"raw_size":4608},{"name":".reloc","virtual_address":"0x132000","virtual_size":63392,"raw_size":63488}],"section_names":[".text",".data",".idata",".didat",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":25},"sandbox_signatures":{"informative_count":35,"suspicious_count":2,"malicious_count":0,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Contains asymmetric cryptographic functions (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$26","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-195","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$29","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains asymmetric cryptographic functions (API string)","description":"$2b","origin":"sample.bin","mitre_attack_id":"T1573.002","id":"string-398","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider(&hProv, pwszAlgorithm, pwszProvider, 0)\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"sample.bin\"), Found reference to API \"BCryptDecrypt( m_hKey, const_cast(pbCipherText), cbCipherText, 0, m_pbUpdatedIV.get(), m_cBytesPerBlock, pbPlainText, *pcbPlainText, pcbPlainText, getEncryptDecryptFlag(fFinal))\" (Indicator: \"BCryptDecrypt\"; Source: \"sample.bin\"), Found reference to API \"BCryptEncrypt( m_hKey, const_cast(pbPlainText), cbPlainText, 0, m_pbUpdatedIV.get(), m_cBytesPerBlock, pbCipherText, *pcbCipherText, pcbCipherText, getEncryptDecryptFlag(fFinal))\" (Indicator: \"BCryptEncrypt\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-927","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$2c","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegEnumKeyEx\" in \"sample.bin\", Found registry query API: \"RegOpenKeyEx\" in \"sample.bin\", Found registry query API: \"RegConnectRegistry/RegOpenKeyEx\" in \"sample.bin\", Found registry query API: \"RegQueryValueEx\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"sample.bin\"), Found string \"KerberosAuthentication\" (Indicator: \"kerberos\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1558","id":"string-868","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"tGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"K32EnumProcesses\" (Indicator: \"EnumProcesses\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameEx\" (Indicator: \"GetComputerName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-122","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"DsGetDCName\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameEx\" (Indicator: \"GetUserName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2d","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcBindingFree\" (Indicator: \"RpcBindingFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1021","id":"string-160","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-417","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"ct.googleapis.com/pilot\", Pattern match: \"https://foo\", Pattern match: \"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/flight\", Heuristic match: \"ct.ws.symantec.com\", Heuristic match: \"ctlog.api.venafi.com\", Pattern match: \"ct.googleapis.com/skydiver\", Heuristic match: \"log.certly.io\", Heuristic match: \"ct.izenpe.com\", Pattern match: \"ct.googleapis.com/icarus\", Heuristic match: \"vega.ws.symantec.com\", Pattern match: \"https://%ws/%ws_%ws_%ws/service.svc/%ws\", Pattern match: \"ct1.digicert-ct.com/log\", Heuristic match: \"ctserver.cnnic.cn\", Pattern match: \"https://machine*\", Pattern match: \"http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en\", Heuristic match: \"ctlog-gen2.api.venafi.com\", Heuristic match: \"ct.startssl.com\", Pattern match: \"ct.googleapis.com/aviator\", Pattern match: \"ct.googleapis.com/rocketeer\", Heuristic match: \"ctlog.wosign.com\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"ct.googleapis.com/pilot\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"ct.googleapis.com/skydiver\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"ct.googleapis.com/icarus\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"ct.googleapis.com/aviator\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"ct.googleapis.com/rocketeer\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://foo\", Found HTTPS url \"https://machine\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"getsmtpinfo\" (Indicator: \"smtp\"; Source: \"sample.bin\"), Found string \"setsmtpinfo\" (Indicator: \"smtp\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.46\", \"2.5.29.28\", \"2.5.29.20\", \"2.5.29.21\", \"2.5.29.23\", \"2.5.29.24\", \"2.5.29.27\", \"2.5.29.31\", \"2.5.29.32\", \"2.5.29.33\", \"2.5.29.35\", \"2.5.29.36\", \"2.5.29.37\", \"2.5.29.30\", \"2.5.29.17\", \"2.5.29.18\", \"2.5.29.19\", \"2.5.29.14\", \"2.5.29.15\", \"2.5.29.16\", Potential IP \"2.5.29.15\" found in string \"2.5.29.15 = \"{hex}\" ;\", \"1.3.101.77\", \"1.3.101.76\", \"2.5.4.6\", \"2.5.4.5\", \"2.5.4.4\", \"2.5.4.3\", \"2.5.4.9\", \"2.5.4.8\", \"2.5.4.7\", \"2.5.5.52\", \"2.5.4.10\", \"2.5.4.11\", \"2.5.4.15\", \"2.5.4.12\", \"2.5.4.52\", \"2.5.4.43\", \"2.5.4.42\", \"2.5.29.2\", \"2.5.29.8\", \"2.5.29.9\", \"2.5.29.7\", \"2.5.29.1\", Potential IP \"2.5.29.31\" found in string \"2.5.29.31 = ;\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"ExtraCert\" (Indicator: \"tracert\"; Source: \"sample.bin\"), Found string \"ExtraCerts\" (Indicator: \"tracert\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-430","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2e","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2f","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"certutil.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"fSuccess || (fOverwriteIfNecessary && GetLastError() == NTE_EXISTS)\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Symantec log\" (Indicator: \"symantec\") in Source: sample.bin, \"Symantec\" (Indicator: \"symantec\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-8","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistry/RegOpenKeyEx\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Active Setup\\Installed Components\\{89820200-ECBD-11CF-8B85-00AA005B4383}\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CACertTypeAccessCheck\" (Indicator: \"AccessCheck\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{"File:426520180ee94ef36224225e32706bc9f2be242acf51bb23d69fea7e6d92a20a":{"type":"File","value":"426520180ee94ef36224225e32706bc9f2be242acf51bb23d69fea7e6d92a20a","verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","Very short text file without any suspicious content"]},"filetype":"ASCII text, with CRLF line terminators","filetype_short":"ASCIITEXT","mime_type":"text/plain"},"File:c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b":{"type":"File","value":"c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","filetype":"PE32 executable (console) Intel 80386, for MS Windows, 6 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"}},"chains":[{"id":"1567320293122737364","root":"File:c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","to_key":"File:426520180ee94ef36224225e32706bc9f2be242acf51bb23d69fea7e6d92a20a"}],"verdict":{"verdict":"clean","verdict_source":"Known legitimate files database lookup","reasons":["File found in known legitimate files database","Very short text file without any suspicious content"]}},{"id":"sandbox_files","root":"File:c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","edges":[{"edge_kind":"extracted","from_key":"File:c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b","to_key":"File:426520180ee94ef36224225e32706bc9f2be242acf51bb23d69fea7e6d92a20a"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"426520180ee94ef36224225e32706bc9f2be242acf51bb23d69fea7e6d92a20a","sha256":"426520180ee94ef36224225e32706bc9f2be242acf51bb23d69fea7e6d92a20a","verdict":"clean","sources":[{"report_type":"qsp","report_id":""}]}],"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample c314ecf62855… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample c314ecf62855…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b"}],["$","meta","4",{"property":"og:title","content":"Sample c314ecf62855… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample c314ecf62855…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c314ecf62855f0e967a920a4c5553e1a79ba6b13f0e322afbf2715d3fc3fe54b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample c314ecf62855… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample c314ecf62855…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]