34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 3d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Malware_60.0 Sample c35c95e1ff33… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample c35c95e1ff33…. Malware family: Malware_60.0. Threat score 70/100. 1/25 AV engines flagged this file. 1 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c35c95e1ff33b78902c2891f8f9fcd5975b9293564ddecaf245f5a477228738e","keywords":["Suspicious","Malware_60.0","malware analysis","sandbox report","threat intelligence","c35c95e1ff33b78902c2891f8f9fcd5975b9293564ddecaf245f5a477228738e"],"about":{"@type":"SoftwareApplication","name":"c35c95e1ff33b78902c2891f8f9fcd5975b9293564ddecaf245f5a477228738e","applicationCategory":["peexe","64bits","executable"],"identifier":"c35c95e1ff33b78902c2891f8f9fcd5975b9293564ddecaf245f5a477228738e","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Malware_60.0","antivirusDetections":{"malicious":1,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T740,Heuristic match: "t q.ad", Pattern match: "https://store.steampowered.com/api/appdetails?appids=730", Pattern match: "gamerpower.com/api/giveaways?platform=steam", Pattern match: "https://store.steampowered.com/api/appdetails?appids=", Pattern match: "https://www.python.org/downloads/", Heuristic match: " p.cg", Pattern match: "store.steampowered.com/api/appdetails", Pattern match: "https://api.steampowered.com/istorebrowseservice/getitems/v1/", Pattern match: "store.steampowered.com/search/results/?maxprice=free", Heuristic match: "x=b.vg", Pattern match: "https://store\.steampowered\.com/app/(\d+)[^]*(.*?)", Pattern match: "https://www.python.org/downloads/windows/", Pattern match: "www.gamerpower.com", Pattern match: "https://store.steampowered.com/app/%s/", Pattern match: "http://127.0.0.1:8666/api/diag", Pattern match: "https://www.gamerpower.com/api/giveaways?platform=steam&sort-by=date", Pattern match: "https://cdn.cloudflare.steamstatic.com", Pattern match: "https://store.steampowered.com/search/results/", Pattern match: "https://cdn.cloudflare.steamstatic.com/steam/apps/%s/capsule_231x87.jpg", Pattern match: "http://127.0.0.1:{args.port}/", Heuristic match: "s/); } } function openurl(u) { try { sh.run(u, 1, false); } catch (e) { showerror(could not open + u); } } /* ---------- steps ---------- */ function go(n) { s.step = n; for (var i = 1; i <= 4; i++) { var sec = $(s + i), chip = $(c + ", Heuristic match: " --- */ .grid{gap:18px} .card{ border-radius:var(--card-r); border:1px solid rgba(255,255,255,.08); background:linear-gradient(180deg,rgba(20,27,40,.92),rgba(12,17,26,.96)); box-shadow:0 18px 36px -28px rgba(0,0,0,.95); transition:transform .22s ", Pattern match: "http://127.0.0.1:{port}/api/health", Pattern match: "https://shared.fastly.steamstatic.com/store_item_assets/steam/apps/730/"37:T10a3,"e Games" pythonw.exe "%~dp0app.py" exit /b 0 ) where python.exe >nul 2>nul if %errorlevel%==0 ( python "%~dp0app.py" goto :eof ) echo. echo Python 3 was not found on this computer. echo. echo 1) Download it from https://www.python.org/downloads/ echo 2) During setup tick: "Add python.exe to PATH" echo 3) Run this file again. echo. pause @echo off title Steam Free Games - stop server powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*app.py*' -and $_.Name -like 'python*' } | ForEach-Object { try { Stop-Process -Id $_.ProcessId -Force; Write-Host ' Stopped process' $_.ProcessId } catch {} }" echo. echo The local server was stopped. Just start it again with START-WINDOWS.bat echo. timeout /t 4 >nul @echo off setlocal EnableExtensions title Steam Free Games - uninstall cd /d "%~dp0" set "APPDIR=%CD%" echo. echo ================================================== echo Steam Free Games - uninstall" (Indicator: " win32_process"; Source: "sample.bin"), "Windows\\Start Menu\\Programs\\Startup"; } else if (name === "Programs") { p = env("%APPDATA%") + "\\Microsoft\\Windows\\Start Menu\\Programs"; } } return p; } function killApp() { try { var loc = new ActiveXObject("WbemScripting.SWbemLocator"); var svc = loc.ConnectServer(".", "root\\cimv2"); var procs = svc.ExecQuery("SELECT ProcessId, Name, CommandLine FROM Win32_Process " + "WHERE Name='pythonw.exe' OR Name='python.exe'"); var e = new Enumerator(procs); var killed = 0; for (; !e.atEnd(); e.moveNext()) { var p = e.item(); if (/app\.py/i.test(String(p.CommandLine || ""))) { try { p.Terminate(); killed++; } catch (e2) { } } } logLine(killed ? ("running app closed (" + killed + ")") : "app was not running", killed ? "ok" : "wa"); } catch (e) { logLine("could not query running processes (continuing)", "wa"); } } function tryDelete(path, isFolder) { try { if (isFolder) { if (FSO.FolderEx" (Indicator: " win32_process"; Source: "sample.bin"), "sts(base)) { var subs = new Enumerator(fso.GetFolder(base).SubFolders); for (; !subs.atEnd(); subs.moveNext()) { var c = join(subs.item().Path, "pythonw.exe"); if (fileExists(c)) { return c; } } } } catch (e) { } return ""; } function killApp() { try { var loc = WScript.CreateObject("WbemScripting.SWbemLocator"); var svc = loc.ConnectServer(".", "root\\cimv2"); var procs = svc.ExecQuery("SELECT ProcessId, Name, CommandLine FROM Win32_Process " + "WHERE Name='pythonw.exe' OR Name='python.exe'"); var e = new Enumerator(procs); for (; !e.atEnd(); e.moveNext()) { var p = e.item(); if (/app\.py/i.test(String(p.CommandLine || ""))) { try { p.Terminate(); } catch (e2) { } } } } catch (err) { } } function doUninstall() { var installDir = opt.dir || dirOf(payload); killApp(); try { if (fileExists(join(special("Desktop"), APPNAME + ".lnk"))) { fso.DeleteFile(join(special("Desktop"), APPNAME + ".ln" (Indicator: " win32_process"; Source: "sample.bin"), " echo ================================================== echo. echo This will remove: echo - the Windows startup item echo - the desktop shortcut echo - any running copy of the app echo. rem ---------- 1) stop running copies ---------- powershell -NoProfile -Command "Get-CimInstance Win32_Process | Where-Object { $_.CommandLine -like '*app.py*' -and $_.Name -like 'python*' } | ForEach-Object { try { Stop-Process -Id $_.ProcessId -Force } catch {} }" >nul 2>nul echo [OK] running copies stopped rem ---------- 2) startup item ---------- set "STARTUP=%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" if exist "%STARTUP%\Steam Free Games.vbs" ( del /f /q "%STARTUP%\Steam Free Games.vbs" >nul 2>nul echo [OK] startup item removed ) else ( echo [--] no startup item found ) rem ---------- 3) desktop shortcut ---------- set "LNK=%USERPROFILE%\Desktop\Steam Free Games.lnk" if exist "%LNK%" ( del /f /q "%LNK%" >nul 2>nul echo [OK] desktop shor" (Indicator: " win32_process"; Source: "sample.bin")38:T2073,""> var APPNAME = "Steam Free Games"; var UNKEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SteamFreeGames"; var FSO = null, SH = null, installDir = "", busy = false, errors = 0; function $(id) { return document.getElementById(id); } function logLine(text, cls) { var box = $("log"); if (!box) { return; } var row = document.createElement("div"); row.className = cls || ""; row.textContent = text; box.appendChild(row); box.scrollTop = box.scrollHeight; } function env(s) { try { return SH.ExpandEnvironmentStrings(s); } catch (e) { return s; } } function join(a, b) { try { return FSO.BuildPath(a, b); } catch (e) { return a + "\\" + b; } } function dirOf(p) { try { return FSO.GetParentFolderName(p); } catch (e) { return p; } } function special(name) { var p = ""; try { p = SH.SpecialFolders(name); } catch (e) { p = ""; } if (!p) { if (name === "Desktop") { p = env("%UserProfile%") + "\\Desktop"; } else if (name === "Startup") { p = env("%APPDATA%") + "\\Microsoft\\" in Source: sample.bin, "ipt is disabled by default on Windows 11 24H2+. Install: wscript install-silent.js /browser:brave wscript install-silent.js /browser:auto /dir:"D:\Games\SteamFreeGames" /nostartup Uninstall: wscript install-silent.js /uninstall /quiet Switches: /browser:auto|default|chrome|edge|brave|opera|opera-gx|vivaldi| chromium|yandex|firefox /dir:"path" /startup /nostartup /nodesktop /nostartmenu /quiet /norun /uninstall ===================================================================== */ var APPNAME = "Steam Free Games"; var UNKEY = "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\SteamFreeGames"; var fso = WScript.CreateObject("Scripting.FileSystemObject"); var sh = WScript.CreateObject("WScript.Shell"); var opt = { browser: "auto", dir: "", desktop: true, startmenu: true, startup: false, quiet: false, run: true, uninstall: false }; var args = WScript.Arguments; for (var i = 0; i < args.length; i++) { var a = String(args" in Source: sample.bin, "tion writeUninstallEntry(dirPath, icon) { sh.RegWrite(UNKEY + "\\DisplayName", APPNAME, "REG_SZ"); sh.RegWrite(UNKEY + "\\DisplayVersion", "1.2.0", "REG_SZ"); sh.RegWrite(UNKEY + "\\Publisher", "Steam Free Games", "REG_SZ"); sh.RegWrite(UNKEY + "\\InstallLocation", dirPath, "REG_SZ"); if (icon) { sh.RegWrite(UNKEY + "\\DisplayIcon", icon, "REG_SZ"); } sh.RegWrite(UNKEY + "\\NoModify", 1, "REG_DWORD"); sh.RegWrite(UNKEY + "\\NoRepair", 1, "REG_DWORD"); sh.RegWrite(UNKEY + "\\UninstallString", "\"" + env("%SystemRoot%") + "\\System32\\mshta.exe\" \"" + join(dirPath, "setup\\uninstall.hta") + "\"", "REG_SZ"); sh.RegWrite(UNKEY + "\\QuietUninstallString", "wscript.exe \"" + join(dirPath, "setup\\install-silent.js") + "\" /uninstall /quiet", "REG_SZ"); } function registryAppPath(exeName) { var roots = ["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\", "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\"]; for (var i = 0; i < roots.leng" in Source: sample.bin, " (App Paths).""" if not sys.platform.startswith("win"): return None exe = BROWSER_EXE.get(name, (None, None))[1] if not exe: return None try: import winreg # noqa: PLC0415 except Exception: # noqa: BLE001 return None for hive in (winreg.HKEY_LOCAL_MACHINE, winreg.HKEY_CURRENT_USER): for view in (0, getattr(winreg, "KEY_WOW64_64KEY", 0)): try: reg_path = ("SOFTWARE\\Microsoft\\Windows\\CurrentVersion" "\\App Paths\\" + exe) key = winreg.OpenKey(hive, reg_path, 0, winreg.KEY_READ | view) path, _ = winreg.QueryValueEx(key, "") winreg.CloseKey(key) if path and Path(path).exists(): return str(path) except OSError: continue return None def find_browser_path(name: str) -> str | None: """" in Source: sample.bin, ").""" if _STEAM_CACHE["done"]: return _STEAM_CACHE["path"] path = None if os.name == "nt": try: import winreg # noqa: PLC0415 for hive, key in ( (winreg.HKEY_CURRENT_USER, r"Software\Valve\Steam"), (winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\WOW6432Node\Valve\Steam"), (winreg.HKEY_LOCAL_MACHINE, r"SOFTWARE\Valve\Steam"), ): try: with winreg.OpenKey(hive, key) as k: val, _ = winreg.QueryValueEx(k, "SteamExe") except OSError: continue cand = Path(str(val).replace("/", chr(92))) if cand.is_file(): path = str(cand) break except Exception: # noqa: BLE001 path = None if not path: for env in ("PROGRAMFILES(X86)", "PROGRAMFILES", "PROGRAMW6432"): root = os.environ.get(env) " in Source: sample.bin, "soft Edge", hint: "", paths: [ "%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe", "%ProgramFiles%\\Microsoft\\Edge\\Application\\msedge.exe"] }, { id: "brave", name: "Brave", hint: "", paths: [ "%ProgramFiles%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe", "%LocalAppData%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe", "%ProgramFiles(x86)%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe"] }, { id: "opera", name: "Opera", hint: "", paths: [ "%LocalAppData%\\Programs\\Opera\\opera.exe", "%ProgramFiles%\\Opera\\opera.exe", "%LocalAppData%\\Programs\\Opera\\launcher.exe"] }, { id: "opera-gx", name: "Opera GX", hint: "", paths: [ "%LocalAppData%\\Programs\\Opera GX\\opera.exe", "%ProgramFiles%\\Opera GX\\opera.exe", "%LocalAppData%\\Programs\\Opera GX\\launcher.exe"] }, { id: "vivaldi", name: "Vivaldi", hint: "", paths: [ "%LocalAppData%\\Vivaldi\\Application\\vivaldi.exe", "%ProgramFiles%\\Vivaldi\\Application\\vivald" in Source: sample.bin, "r i = 0; i < BROWSERS.length; i++) { if (BROWSERS[i].id === id) { return BROWSERS[i]; } } return BROWSERS[0]; } function registryAppPath(exeName) { if (!SH || !exeName) { return ""; } var roots = ["HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\", "HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\"]; for (var i = 0; i < roots.length; i++) { try { var v = String(SH.RegRead(roots[i] + exeName + "\\")).replace(/^"|"$/g, ""); if (fileExists(v)) { return v; } } catch (e) { } } return ""; } function findBrowser(id) { if (id === "auto" || id === "default") { return ""; } var b = browserById(id); for (var i = 0; i < b.paths.length; i++) { var p = env(b.paths[i]); if (p.indexOf("%") === -1 && fileExists(p)) { return p; } } return registryAppPath(EXE_OF[id] || ""); } var DETECTED = {}; function detectAll() { for (var i = 0; i < BROWSERS.length; i++) { var b = BROWSERS[i]; DETECTED[b.id] = (b.id === "auto" || b.i" in Source: sample.bin, "tton class="btn alt" id="btnBack" type="button" style="display:none">Back