26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample c4a1fa419e1f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c4a1fa419e1f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/27 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281"],"about":{"@type":"SoftwareApplication","name":"Project Details for Purchase Order Specificat.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T473,Calls a syscall: "execve" Calls a syscall: "brk" Calls a syscall: "arch_prctl" Calls a syscall: "access" Calls a syscall: "openat" Calls a syscall: "fstat" Calls a syscall: "mmap" Calls a syscall: "close" Calls a syscall: "read" Calls a syscall: "pread" Calls a syscall: "mprotect" Calls a syscall: "munmap" Calls a syscall: "set_tid_address" Calls a syscall: "set_robust_list" Calls a syscall: "rt_sigaction" Calls a syscall: "rt_sigprocmask" Calls a syscall: "lseek" Calls a syscall: "getpid" Calls a syscall: "readlink" Calls a syscall: "getdents64" Calls a syscall: "statfs" Calls a syscall: "futex" Calls a syscall: "ftruncate" Calls a syscall: "sched_getaffinity" Calls a syscall: "clone" Calls a syscall: "sigaltstack" Calls a syscall: "stat" Calls a syscall: "uname" Calls a syscall: "write" Calls a syscall: "unlink" Calls a syscall: "exit_group" Calls a syscall: "procexit" Calls a syscall: "prctl" Calls a syscall: "sched_getparam" Calls a syscall: "sched_getscheduler" Calls a syscall: "sched_get_priority_min" Calls a syscall: "sched_get_priority_max" Calls a syscall: "sched_setscheduler"28:T12da,"Update HASTA set AD_SOYAD=@p1, KURUM_AD=@p2, HASTA_TURU=@p3, CEP_NO=@p4 Where TC=@p5" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "update hasta set ad_soyad=@p1, kurum_ad=@p2, hasta_turu=@p3, cep_no=@p4 where tc=@p5") "Select * From dbo.KULLANICI where AD_SOYAD=@p1 and SIFRE=@p2" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from dbo.kullanici where ad_soyad=@p1 and sifre=@p2") "Select * From DOKTOR Where AD_SOYAD Like '%" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from doktor where ad_soyad like '%") "insert into dbo.RECETE_URUN (URUN_AD,MIKTAR,FIYAT,KUR_ODENEN,ILAC_FARKI,TUTAR,ECZANE_KARI,MALIYET,BITIM_TARIHI,DOZ) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8,@p9,@p10)" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "insert into dbo.recete_urun (urun_ad,miktar,fiyat,kur_odenen,ilac_farki,tutar,eczane_kari,maliyet,bitim_tarihi,doz) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8,@p9,@p10)"), "Select * From SATIS" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from satis"), "Select * from HASTA_RECETE" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from hasta_recete"), "Select * from RECETE_URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from recete_urun"), "Select * From HASTA_RECETE" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from hasta_recete"), "Select * From RECETE_URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from recete_urun"), "Select * From HASTA_RECETE Where HASTA_AD_SOYAD Like '%" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from hasta_recete where hasta_ad_soyad like '%"), "DELETE from HASTA_RECETE where ID=@ID" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "delete from hasta_recete where id=@id"), "DELETE from RECETE_URUN where ID=@ID" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "delete from recete_urun where id=@id"), "Select * From FATURA_DETAY" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from fatura_detay"), "Select * From FATURA_HASTA" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from fatura_hasta"), "Select * From DEPO_ALIS" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from depo_alis"), "Select * From DEPO_ALIS_URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from depo_alis_urun"), "Select * From TAKAS" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from takas"), "SELECT AD MIKTAR FIYAT MIADI KULLANIM_YASI KAMU_FIYATI FROM dbo.URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select ad miktar fiyat miadi kullanim_yasi kamu_fiyati from dbo.urun"), "Select * From URUN Where AD Like '%" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from urun where ad like '%"), "DELETE from URUN where AD=@AD" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "delete from urun where ad=@ad"), "Select * From dbo.DOKTOR where AD_SOYAD=@p1 and SIFRE=@p2" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from dbo.doktor where ad_soyad=@p1 and sifre=@p2"), "insert into dbo.KULLANICI (AD_SOYAD,MAIL,ECZANE_AD,SEHIR,ILCE,ADRES,TEL,SIFRE) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8)" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "insert into dbo.kullanici (ad_soyad,mail,eczane_ad,sehir,ilce,adres,tel,sifre) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8)"), "insert into dbo.HASTA (TC,AD_SOYAD,KURUM_AD,HASTA_TURU,CEP_NO) values (@p1,@p2,@p3,@p4,@p5)" (Source: 6000015-FrmDoktorHastaEkle~button1_Click, Indicator: "insert into dbo.hasta (tc,ad_soyad,kurum_ad,hasta_turu,cep_no) values (@p1,@p2,@p3,@p4,@p5)"), "insert into dbo.HASTA (AD_SOYAD,KURUM_AD,TC,HASTA_TURU,CEP_NO) values (@p1,@p2,@p3,@p4,@p5)" (Source: 600002e-FrmEczaneHastaEkle~btnKaydet_Click, Indicator: "insert into dbo.hasta (ad_soyad,kurum_ad,tc,hasta_turu,cep_no) values (@p1,@p2,@p3,@p4,@p5)"), "Select * from HASTA" (Source: 6000033-FrmEczaneHastalar~frm10_Load, Indicator: "select * from hasta")29:Te41,Found reference to API "ReadXmlSchema" (Indicator: "read"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "WriteXmlSchema" (Indicator: "write"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "txthastatc" (Indicator: "stat"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "FrmHastaReceteEkle_Load" (Indicator: "tee"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "Synchronized" (Indicator: "sync"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "CreateInstance" (Indicator: "creat"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "XmlReadMode" (Indicator: "read"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "set_SelectionMode" (Indicator: "select"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "DataGridViewSelectionMode" (Indicator: "select"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "ReadXmlSerializable" (Indicator: "read"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "RuntimeTypeHandle" (Indicator: "time"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "FrmHastaReceteEkle" (Indicator: "tee"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "DateTime" (Indicator: "time"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "Clone" (Indicator: "clone"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "Close" (Indicator: "close"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "EditorBrowsableState" (Indicator: "stat"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "DataGridViewTriState" (Indicator: "stat"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "Write" (Indicator: "write"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "STAThreadAttribute" (Indicator: "read"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "STAThreadAttribute" (Indicator: "stat"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "ReadByte" (Indicator: "read"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "System.Threading" (Indicator: "read"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "LateBinding" (Indicator: "bind"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "System.Runtime.Versioning" (Indicator: "time"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe") Found reference to API "AsyncCallback" (Indicator: "sync"; File: "c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe")2a:T12da,"Update HASTA set AD_SOYAD=@p1, KURUM_AD=@p2, HASTA_TURU=@p3, CEP_NO=@p4 Where TC=@p5" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "update hasta set ad_soyad=@p1, kurum_ad=@p2, hasta_turu=@p3, cep_no=@p4 where tc=@p5") "Select * From dbo.KULLANICI where AD_SOYAD=@p1 and SIFRE=@p2" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from dbo.kullanici where ad_soyad=@p1 and sifre=@p2") "Select * From DOKTOR Where AD_SOYAD Like '%" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from doktor where ad_soyad like '%") "insert into dbo.RECETE_URUN (URUN_AD,MIKTAR,FIYAT,KUR_ODENEN,ILAC_FARKI,TUTAR,ECZANE_KARI,MALIYET,BITIM_TARIHI,DOZ) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8,@p9,@p10)" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "insert into dbo.recete_urun (urun_ad,miktar,fiyat,kur_odenen,ilac_farki,tutar,eczane_kari,maliyet,bitim_tarihi,doz) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8,@p9,@p10)"), "Select * From SATIS" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from satis"), "Select * from HASTA_RECETE" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from hasta_recete"), "Select * from RECETE_URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from recete_urun"), "Select * From HASTA_RECETE" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from hasta_recete"), "Select * From RECETE_URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from recete_urun"), "Select * From HASTA_RECETE Where HASTA_AD_SOYAD Like '%" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from hasta_recete where hasta_ad_soyad like '%"), "DELETE from HASTA_RECETE where ID=@ID" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "delete from hasta_recete where id=@id"), "DELETE from RECETE_URUN where ID=@ID" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "delete from recete_urun where id=@id"), "Select * From FATURA_DETAY" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from fatura_detay"), "Select * From FATURA_HASTA" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from fatura_hasta"), "Select * From DEPO_ALIS" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from depo_alis"), "Select * From DEPO_ALIS_URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from depo_alis_urun"), "Select * From TAKAS" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from takas"), "SELECT AD MIKTAR FIYAT MIADI KULLANIM_YASI KAMU_FIYATI FROM dbo.URUN" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select ad miktar fiyat miadi kullanim_yasi kamu_fiyati from dbo.urun"), "Select * From URUN Where AD Like '%" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from urun where ad like '%"), "DELETE from URUN where AD=@AD" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "delete from urun where ad=@ad"), "Select * From dbo.DOKTOR where AD_SOYAD=@p1 and SIFRE=@p2" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "select * from dbo.doktor where ad_soyad=@p1 and sifre=@p2"), "insert into dbo.KULLANICI (AD_SOYAD,MAIL,ECZANE_AD,SEHIR,ILCE,ADRES,TEL,SIFRE) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8)" (Source: c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe, Indicator: "insert into dbo.kullanici (ad_soyad,mail,eczane_ad,sehir,ilce,adres,tel,sifre) values (@p1,@p2,@p3,@p4,@p5,@p6,@p7,@p8)"), "insert into dbo.HASTA (TC,AD_SOYAD,KURUM_AD,HASTA_TURU,CEP_NO) values (@p1,@p2,@p3,@p4,@p5)" (Source: 6000015-FrmDoktorHastaEkle~button1_Click, Indicator: "insert into dbo.hasta (tc,ad_soyad,kurum_ad,hasta_turu,cep_no) values (@p1,@p2,@p3,@p4,@p5)"), "insert into dbo.HASTA (AD_SOYAD,KURUM_AD,TC,HASTA_TURU,CEP_NO) values (@p1,@p2,@p3,@p4,@p5)" (Source: 600002e-FrmEczaneHastaEkle~btnKaydet_Click, Indicator: "insert into dbo.hasta (ad_soyad,kurum_ad,tc,hasta_turu,cep_no) values (@p1,@p2,@p3,@p4,@p5)"), "Select * from HASTA" (Source: 6000033-FrmEczaneHastalar~frm10_Load, Indicator: "select * from hasta")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790908528040,"unified_at":"2026-10-02T02:35:28.040Z","metadata":{"hashes":{"sha256":"c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281","sha1":"b7051a0d8c5be7366881ae78fd2d90691facc323","md5":"2f81948e8e29e04e66d7b5b93981ef2f","sha512":"2ff0ea274e30865f8b2222c75b58047c975d5c7e3940eb3d800d2768a018cfd6f60a2dad8db2cc5520b30e1fb134e0499d0ba248411ebe10d7501241daf6c04f","ssdeep":"24576:KOWkWLgT0Hp7y4P84r07/W90krUgkQCtKQ:jWkWLgT6ty4P8q07/F8HkQCtx","ssdeep_chunks":["24576:KOWkWLg","24576:OWkWLgT","24576:WkWLgT0","24576:kWLgT0H","24576:WLgT0Hp","24576:LgT0Hp7","24576:gT0Hp7y","24576:T0Hp7y4","24576:0Hp7y4P","24576:Hp7y4P8","24576:p7y4P84","24576:7y4P84r","24576:y4P84r0","24576:4P84r07","24576:P84r07/","24576:84r07/W","24576:4r07/W9","24576:r07/W90","24576:07/W90k","24576:7/W90kr","24576:/W90krU","24576:W90krUg","24576:90krUgk","24576:0krUgkQ","24576:krUgkQC","24576:rUgkQCt","24576:UgkQCtK","24576:gkQCtKQ","49152:KOWkWLg","49152:OWkWLgT","49152:WkWLgT0","49152:kWLgT0H","49152:WLgT0Hp","49152:LgT0Hp7","49152:gT0Hp7y","49152:T0Hp7y4","49152:0Hp7y4P","49152:Hp7y4P8","49152:p7y4P84","49152:7y4P84r","49152:y4P84r0","49152:4P84r07","49152:P84r07/","49152:84r07/W","49152:4r07/W9","49152:r07/W90","49152:07/W90k","49152:7/W90kr","49152:/W90krU","49152:W90krUg","49152:90krUgk","49152:0krUgkQ","49152:krUgkQC","49152:rUgkQCt","49152:UgkQCtK","49152:gkQCtKQ","24576:jWkWLgT","24576:WkWLgT6","24576:kWLgT6t","24576:WLgT6ty","24576:LgT6ty4","24576:gT6ty4P","24576:T6ty4P8","24576:6ty4P8q","24576:ty4P8q0","24576:y4P8q07","24576:4P8q07/","24576:P8q07/F","24576:8q07/F8","24576:q07/F8H","24576:07/F8Hk","24576:7/F8HkQ","24576:/F8HkQC","24576:F8HkQCt","24576:8HkQCtx"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Project Details for Purchase Order Specificat.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1040896,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1752067848000,"last_seen":1752072127000,"last_multi_scan":1752072127000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["nanocore"]},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":17,"suspicious_count":1,"malicious_count":1,"total":19},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Agensla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.ANYO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.bc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Krypt-AQM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Troj.CGJ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanLoader.MSIL.DaVinci.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_47.8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Contains ability to interact with X server"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Calls native functions (syscalls)"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Removes a file or a directory (syscall)"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Performs cross platform execution"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"The process modifies itself (often used to modify name for evasion)"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls a system call typically used to get directory entries"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries system general information (syscall)"},{"type":"informative","value":"Calls a system call typically used to retrieve information about a mounted filesystem"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"The process modifies itself (often used to modify name for evasion)","description":"/usr/bin/mono modifies itself during the runtime with PRCTL","origin":"API Call","mitre_attack_id":"T1036","relevance":3,"id":"api-1001","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.50606957911169","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Environment Awareness","name":"Queries system general information (syscall)","description":"/usr/bin/mono used: uname","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1006","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"General","name":"Calls native functions (syscalls)","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-1150","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"PNoF.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$28","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"General","name":"Contains ability to interact with X server","description":"\"/usr/bin/mono\" reads \"/usr/lib/x86_64-linux-gnu/libx11.so.6\"","origin":"API Call","mitre_attack_id":"T1129","relevance":3,"id":"api-1158","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-5000","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"/usr/bin/mono reads file /lib/x86_64-linux-gnu/libm.so.6\n /usr/bin/mono reads file /lib/x86_64-linux-gnu/librt.so.1\n /usr/bin/mono reads file /lib/x86_64-linux-gnu/libdl.so.2\n /usr/bin/mono reads file /lib/x86_64-linux-gnu/libpthread.so.0\n /usr/bin/mono reads file /lib/x86_64-linux-gnu/libgcc_s.so.1\n /usr/bin/mono reads file /lib/x86_64-linux-gnu/libc.so.6\n /usr/bin/mono reads file /usr/bin/mono\n /usr/bin/mono reads file /etc/mono/config\n /usr/bin/mono reads file /proc/self/maps\n /usr/bin/mono reads file /usr/share/locale/locale.alias\n /usr/bin/mono reads file /usr/lib/mono/aot-cache/amd64/mscorlib.dll.so\n /usr/bin/mono reads file /usr/lib/mono/gac/System.Windows.Forms/4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll.config\n /usr/bin/mono reads file /usr/lib/mono/gac/System.Drawing/4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll.config","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1156","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"16.0.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"%}/.tc\"\n Heuristic match: \")q.wf\"\n Pattern match: \"http://tempuri.org/dataset1.xsd\"\n Pattern match: \"http://www.w3.org/2001/xmlschema\"\n Pattern match: \"https://medeczane.sgk.gov.tr/eczane/login.jsp\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://medeczane.sgk.gov.tr\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to get directory entries","description":"/usr/bin/mono executed: getdents64","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-1153","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls a system call typically used to retrieve information about a mounted filesystem","description":"/usr/bin/mono executed: statfs","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-1151","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Performs cross platform execution","description":"Executes binary with \"mono\"","origin":"API Call","mitre_attack_id":"T1027.004","relevance":3,"id":"api-1168","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"suspicious","category":"System Destruction","name":"Removes a file or a directory (syscall)","description":"/usr/bin/mono removed a file/directory: /dev/shm/mono.1620","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-1014","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["nanocore"],"sample_flags":["Multi-Process"],"sandbox_reports":[{"id":"686e7fbe4f7977380202545f","environment_id":310,"environment_description":"Linux (Ubuntu 20.04, 64 bit)","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281.exe","analysis_start_time":"2025-07-09T14:44:37+00:00","indicators_count":{"informative":17,"suspicious":1,"malicious":1},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"686e7fbe4f7977380202545f"}],"processes":[{"pid":1620,"ppid":0,"name":"mono","command_line":"mono /home/ubuntu/c4a1fa419e1fexe","normalized_path":"/usr/bin/mono","uid":"58156461-1620"},{"pid":1622,"ppid":0,"name":"mono","command_line":"mono /home/ubuntu/c4a1fa419e1fexe","normalized_path":"/usr/bin/mono","uid":"63146560-1622"},{"pid":1624,"ppid":0,"name":"mono","command_line":"mono /home/ubuntu/c4a1fa419e1fexe","normalized_path":"/usr/bin/mono","uid":"69036614-1624"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["686e7fbe4f7977380202545f"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample c4a1fa419e1f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample c4a1fa419e1f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/27 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample c4a1fa419e1f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample c4a1fa419e1f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/27 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/c4a1fa419e1fb2cb82a669adbf1e4c1236101a9733d405b762324aa4a4ea8281"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample c4a1fa419e1f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample c4a1fa419e1f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 10/27 AV engines flagged this file. 1 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]