21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample c97aa2240452… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c97aa2240452…. Malware family: Trojan.Generic. Threat score 100/100. 15/25 AV engines flagged this file. 5 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":25},"behavioralIndicators":{"malicious":5,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4d9,Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp")23:T4f8,"" (Indicator: "GetDC"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007268.00000000.67032.03030000.00000004.mdmp")2e:T476,Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00007268.00000000.67032.004E7000.00000004.mdmp")2f:Tad5,"file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241952'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241088'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241968'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241104'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241984'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241120'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5242000'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241136'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5242016'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241152'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5242048'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241184'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5242032'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241168'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5242064'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241392'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241936'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '5241904'}" (UID: 00000000-00002100) "file.exe" called "LoadResource with parameter {'hModule': '1984757760', 'hResInfo': '3474928'}" (UID: 00000000-00002100) "America.pif" called "LoadResource with parameter {'hModule': '2228224', 'hResInfo': '3102104'}" (UID: 00000000-00002588) "America.pif" called "LoadResource with parameter {'hModule': '2228224', 'hResInfo': '3101880'}" (UID: 00000000-00002588) "America.pif" called "LoadResource with parameter {'hModule': '2228224', 'hResInfo': '3102136'}" (UID: 00000000-00002588) "America.pif" called "LoadResource with parameter {'hModule': '2228224', 'hResInfo': '3101944'}" (UID: 00000000-00002588)30:Tf85,Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002100-33033-1755-00437B50 Assembly shows XOR instruction xor esi 00000099h in Stream UID: 00000000-00002100-33033-33-004DA68E Assembly shows XOR instruction xor bl 01h in Stream UID: 00000000-00002100-33033-3085-0042EF8C Assembly shows XOR instruction xor esi 00000099h in Stream UID: 00000000-00002100-33033-34-004DA522 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002100-33033-3215-00439EFC Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002100-33033-1595-0048649C Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002100-33033-3231-0043B7F4 Assembly shows XOR instruction xor esi 00000099h in Stream UID: 00000000-00002100-33033-32-004DB690 Assembly shows XOR instruction xor esi 00000099h in Stream UID: 00000000-00002100-33033-31-004DB85B Assembly shows XOR instruction xor al byte ptr [ebp-01h] in Stream UID: 00000000-00002100-33033-2601-00413210 Assembly shows XOR instruction xor ebx ecx in Stream UID: 00000000-00002100-33033-2538-00412CA8 Assembly shows XOR instruction xor esi 00000099h in Stream UID: 00000000-00002100-33033-36-004D99FC Assembly shows XOR instruction xor eax dword ptr [ecx+08h] in Stream UID: 00000000-00002588-42955-222-00256ABB Assembly shows XOR instruction xor dword ptr [ecx+08h] eax in Stream UID: 00000000-00002588-42955-222-00256ABB Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00002588-42955-222-00256ABB Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00002588-42955-222-00256ABB Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00002588-42955-946-002B3890 Assembly shows XOR instruction xor eax dword ptr [ebp-0Ch] in Stream UID: 00000000-00002588-42955-8-00240DDC Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002588-42955-8-00240DDC Assembly shows XOR instruction xor eax dword ptr [ebp-14h] in Stream UID: 00000000-00002588-42955-8-00240DDC Assembly shows XOR instruction xor eax dword ptr [ebp-04h] in Stream UID: 00000000-00002588-42955-8-00240DDC Assembly shows XOR instruction xor eax ecx in Stream UID: 00000000-00002588-42955-8-00240DDC Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002588-42955-39-00253327 Assembly shows XOR instruction xor edi edx in Stream UID: 00000000-00002588-42955-39-00253327 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002588-42955-985-0024F3FF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002588-42955-985-0024F3FF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002588-42955-1564-0025350A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002588-42955-1564-0025350A Assembly shows XOR instruction xor eax 08h in Stream UID: 00000000-00002588-42955-1200-0028C631 Assembly shows XOR instruction xor al byte ptr [ecx+edx+2Dh] in Stream UID: 00000000-00002588-42955-1102-002609AE Assembly shows XOR instruction xor byte ptr [ecx+edx+2Dh] al in Stream UID: 00000000-00002588-42955-1102-002609AE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002588-42955-1527-0025C691 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002588-42955-1527-0025C691 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002588-42955-38-002535B4 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002588-42955-38-002535B4 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002588-42955-92-002450BD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002588-42955-92-002450BD Assembly shows XOR instruction xor ecx eax in Stream UID: 00000000-00002588-42955-933-002B4BD6 Assembly shows XOR instruction xor al 01h in Stream UID: 00000000-00002588-42955-1730-0028756A31:T66b,file/memory contains long string with (Indicator: "set "; File: "Subscribe") Found string "set cd door" (Indicator: "set "; File: "00000000-00002588.00000000.67050.00221000.00000020.mdmp") Found string "Set SNTTPOPTzIKwQaSjgxCvNjRfgQMctUNScClZpmtABfmGlka=l" (Indicator: "set "; File: "Subscribe") Found string "Set KHFKkGxlWAiUCcYLQprsFxyHGjXTRxtNYSwbNzfleWADVj=i" (Indicator: "set "; File: "Subscribe") Found string "Set aqWVpiEyvpblNgTDaQxnpSFeqrhexEIPplsSkxyCGPs=y" (Indicator: "set "; File: "Subscribe") Found string "Set UMfNQznKVmroKAswrhumYKKdkEhvdoIHhwIzDsIWR=c" (Indicator: "set "; File: "Subscribe") Found string "Set EXrRZuKQqMKMFQMFCdLqWeQPhCBlScVsDPieBwkJelbuJXn=q" (Indicator: "set "; File: "Subscribe") Found string "Set yssdZRaCUhfXCdUtCyUwMccqTsXJDbDPgOoqQtfxKENh=p" (Indicator: "set "; File: "Subscribe") Found string "Set sCNVAsuQFpBmpNmLBkvCVoREbDbdopvntvyBYaOXo=e" (Indicator: "set "; File: "Subscribe") Found string "Set PSvUUPyluQGPWDTpJMBWSvgjFQJRMYXZLYBNtRDtv=s" (Indicator: "set "; File: "Subscribe") Found string "Set BZAnavGLOtmFJtVIXiKwxesYcVLlUJQz=a" (Indicator: "set "; File: "Subscribe") Found string "Set cQWUnBCLFHzBmhTiJZVaTIqAbOueGhZYjlufvTtd=d" (Indicator: "set "; File: "Subscribe") Found string "Set QrVsQNwjeboPblpGsVCROUrwhIwEAicUteVBjjWsu=g" (Indicator: "set "; File: "Subscribe") Found string "Set vhgfdtXLhOrOMGLDbUHYwKPtMywmfnQqpBxIqCDNEuG=x" (Indicator: "set "; File: "Subscribe") Found string "Set SpUxJPOLELPYPjPxjKKJitopKLvOdpc=v" (Indicator: "set "; File: "Subscribe") Found string "Set qKIusirDgZGWveajJvNajIZTfQUzQDLxjIqofeWFzzyShmJtx=h" (Indicator: "set "; File: "Subscribe")32:T5ae,GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1617-00281F56 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1602-00281875 OpenProcess@KERNEL32.DLL at 00000000-00002588-42955-2264-002AA869 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1609-00281C53 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1613-00281EE5 OpenProcess@KERNEL32.DLL at 00000000-00002588-42955-2266-002AAB0E GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1614-00281E3F OpenProcess@KERNEL32.DLL at 00000000-00002588-42955-1638-0028BA2B OpenProcess@KERNEL32.DLL at 00000000-00002588-42955-2269-002AB02A OpenProcess@KERNEL32.DLL at 00000000-00002588-42955-2272-002AB1F3 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1600-00281244 OpenProcessToken@ADVAPI32.DLL at 00000000-00002588-42955-1611-00281D0D GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1604-0028146D GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1601-00281841 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-3599-0025D52C OpenProcess@KERNEL32.DLL at 00000000-00002588-42955-1863-0028F161 OpenProcessToken@ADVAPI32.DLL at 00000000-00002588-42955-1616-00281BB0 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1605-00281696 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1606-002816F6 GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1603-002817DB GetProcessHeap@KERNEL32.DLL at 00000000-00002588-42955-1612-002818E333:T429,"file.exe" called "CreateProcessA" with parameter "cmd /k move Subscribe Subscribe.bat & Subscribe.bat & exit" - (UID: 00000000-00002100) "cmd.exe" called "CreateProcessW" with parameter "tasklist" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "findstr /I "wrsa.exe opssvc.exe"" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "cmd /c mkdir 8908" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Logged + Tracking + Workout + Null + Citizen 8908\America.pif" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "cmd /c copy /b Learn + Did + Chorus 8908\c" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "8908\America.pif 8908\c" - (UID: 00000000-00002604) "cmd.exe" called "CreateProcessW" with parameter "ping -n 5 localhost" - (UID: 00000000-00002604)34:T64d,WaitForSingleObject@KERNEL32.DLL at 00000000-00002100-33033-2594-004133D8 WaitForSingleObject@KERNEL32.DLL at 00000000-00002100-33033-3085-0042EF8C Sleep@KERNEL32.DLL at 00000000-00002100-33033-2593-0040AC70 SetTimer at 00000000-00002100-33033-1736-00475C7C WaitForSingleObject@KERNEL32.DLL at 00000000-00002100-33033-1734-00472F90 WaitForSingleObject@KERNEL32.DLL at 00000000-00002100-33033-3273-0043DB78 WaitForSingleObject@KERNEL32.DLL at 00000000-00002100-33033-3077-0042E988 MsgWaitForMultipleObjectsEx at 00000000-00002100-33033-3258-0043D570 SetTimer at 00000000-00002100-33033-3315-004436A4 Sleep@KERNEL32.DLL at 00000000-00002100-33033-2665-004027A8 Sleep@KERNEL32.DLL at 00000000-00002588-42955-530-0028C553 Sleep@KERNEL32.DLL at 00000000-00002588-42955-1200-0028C631 WaitForSingleObject@KERNEL32.DLL at 00000000-00002588-42955-1617-00281F56 WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00002588-42955-348-00240626 SetTimer at 00000000-00002588-42955-1706-00286114 Sleep@KERNEL32.DLL at 00000000-00002588-42955-1905-0029A29A Sleep@KERNEL32.DLL at 00000000-00002588-42955-508-0022DD00 Sleep@KERNEL32.DLL at 00000000-00002588-42955-1915-002957AE Sleep@KERNEL32.DLL at 00000000-00002588-42955-523-002B8076 Sleep@KERNEL32.DLL at 00000000-00002588-42955-1646-00282C84 Sleep@KERNEL32.DLL at 00000000-00002588-42955-1394-0023FA42 Sleep@KERNEL32.DLL at 00000000-00002588-42955-626-0028EFBC SetTimer at 00000000-00002588-42955-1007-00221456 WaitForSingleObject@KERNEL32.DLL at 00000000-00002588-42955-634-0029DA56 WaitForSingleObject@KERNEL32.DLL at 00000000-00002588-42955-631-0029103C35:T50c,LoadLibraryW@KERNEL32.DLL at 00000000-00002100-33033-3279-0043E2C0 LoadLibraryA@KERNEL32.DLL at 00000000-00002100-33033-808-0048E9DD LoadLibraryExW@KERNEL32.DLL at 00000000-00002100-33033-99-0040769C LoadLibraryW@KERNEL32.DLL at 00000000-00002100-33033-2730-004136EC LoadLibraryW@KERNEL32.DLL at 00000000-00002100-33033-1922-0043EED4 LoadLibraryExW@KERNEL32.DLL at 00000000-00002588-42955-1143-002254DE LoadLibraryW@KERNEL32.DLL at 00000000-00002588-42955-924-002B36D5 LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-716-0023E2F2 LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-1232-00224E68 LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-2287-002AD3B2 LoadLibraryW@KERNEL32.DLL at 00000000-00002588-42955-2244-002A966B LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-2238-002A4770 LoadLibraryExW@KERNEL32.DLL at 00000000-00002588-42955-41-002533C3 LoadLibraryExW@KERNEL32.DLL at 00000000-00002588-42955-922-002B8A28 LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-2286-002ABD95 LoadLibraryExW@KERNEL32.DLL at 00000000-00002588-42955-1415-0024381D LoadLibraryW@KERNEL32.DLL at 00000000-00002588-42955-2257-002AA242 LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-1144-0022546C LoadLibraryA@KERNEL32.DLL at 00000000-00002588-42955-1145-002254A336:T5e0,"file.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "file.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "tasklist.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "tasklist.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "findstr.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "findstr.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "cmd.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "America.pif" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "America.pif" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "America.pif" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "America.pif" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "PING.EXE" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135]37:T559,"America.pif" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\23318\8908\America.pif]- [targetUID: 00000000-00002588] "c" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\23318\8908\c]- [targetUID: 00000000-00002588] "Learn" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\23318\Learn]- [targetUID: 00000000-00002100] "Did" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\23318\Did]- [targetUID: 00000000-00002100] "Tracking" has type "data"- Location: [%TEMP%\23318\Tracking]- [targetUID: 00000000-00003104] "Null" has type "data"- Location: [%TEMP%\23318\Null]- [targetUID: 00000000-00003104] "Chorus" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\23318\Chorus]- [targetUID: 00000000-00002100] "Workout" has type "data"- Location: [%TEMP%\23318\Workout]- [targetUID: 00000000-00003104] "Logged" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%TEMP%\23318\Logged]- [targetUID: 00000000-00003104] "Citizen" has type "data"- Location: [%TEMP%\23318\Citizen]- [targetUID: 00000000-00003104] "Subscribe" has type "ASCII text with very long lines with CRLF line terminators"- Location: [%TEMP%\23318\Subscribe]- [targetUID: 00000000-00002604]38:T92e,"cmd.exe" called "FindFirstFileW" with parameter C:\Users (UID: 00000000-00002604) "cmd.exe" called "FindFirstFileW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002604) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData (UID: 00000000-00002604) "cmd.exe" called "FindFirstFileW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002604) "cmd.exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00002604) "cmd.exe" called "FindFirstFileW" with parameter %TEMP%\23318 (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter Subscribe (UID: 00000000-00002604) "cmd.exe" called "FindFirstFileW" with parameter %WINDIR%\system32\*.* (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter 0409 (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter 12520437.cpx (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter 12520850.cpx (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter 7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter aaclient.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter accessibilitycpl.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter ACCTRES.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter acledit.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter aclui.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter acmigration.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter acppage.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter acproxy.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter ActionCenter.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter ActionCenterCPL.dll (UID: 00000000-00002604) "cmd.exe" called "FindNextFileW" with parameter ActionQueue.dll (UID: 00000000-00002604)39:T493,Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; File: "00000000-00002588.00000000.67050.00221000.00000020.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "00000000-00002588.00000000.67050.00221000.00000020.mdmp") Found reference to API "SeBackupPrivilege" (Indicator: "SeBackupPrivilege"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp")3a:T969,Found reference to API "GetFileSecurityW" (Indicator: "GetFileSecurityW"; Source: "00000000-00002100.00000000.66334.690D1000.00000020.mdmp") Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; Source: "00000000-00002100.00000000.66334.690D1000.00000020.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateToken"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "DuplicateTokenEx" (Indicator: "DuplicateTokenEx"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "GetSecurityDescriptorDacl" (Indicator: "GetSecurityDescriptorDacl"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "GetAclInformation" (Indicator: "GetAclInformation"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "GetAce" (Indicator: "GetAce"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "AddAce" (Indicator: "AddAce"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00002588.00000000.67042.002BD000.00000002.mdmp")3b:T8d6,Observed import api "AddAce" which can "Adds one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: America.pif] Observed import api "AllocateAndInitializeSid" which can "Allocates and initializes a security identifier (SID) with up to eight subauthorities" [Source: America.pif] Observed import api "CheckTokenMembership" which can "Determines whether a specified security identifier (SID) is enabled in an access token" [Source: America.pif] Observed import api "CopySid" which can "Copies a security identifier (SID) to a buffer" [Source: America.pif] Observed import api "DuplicateToken" which can "Creates a new access token that duplicates one already in existence" [Source: America.pif] Observed import api "DuplicateTokenEx" which can "Creates a new access token that duplicates an existing token" [Source: America.pif] Observed import api "FreeSid" which can "Frees a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: America.pif] Observed import api "GetAce" which can "Obtains a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: America.pif] Observed import api "GetAclInformation" which can "Retrieves information about an access control list (ACL)" [Source: America.pif] Observed import api "GetLengthSid" which can "Returns the length in bytes of a valid security identifier (SID)" [Source: America.pif] Observed import api "GetSecurityDescriptorDacl" which can "Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: America.pif] Observed import api "GetTokenInformation" which can "Retrieves a specified type of information about an access token" [Source: America.pif] Observed import api "InitializeAcl" which can "Initializes a new ACL structure" [Source: America.pif] Observed import api "InitializeSecurityDescriptor" which can "Initializes a new security descriptor" [Source: America.pif] Observed import api "InitializeSid" which can "Initializes a security identifier (SID)" [Source: America.pif] Observed import api "SetSecurityDescriptorDacl" which can "Sets information in a discretionary access control list (DACL)" [Source: America.pif]3c:T448,Spawned process "file.exe" (UID: 00000000-00002100) Spawned process "cmd.exe" with commandline "cmd /k move Subscribe Subscribe.bat & Subscribe.bat & exit" (UID: 00000000-00002604) Spawned process "tasklist.exe" (UID: 00000000-00000372) Spawned process "findstr.exe" with commandline "findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"" (UID: 00000000-00003800) Spawned process "tasklist.exe" (UID: 00000000-00000336) Spawned process "findstr.exe" with commandline "findstr /I "wrsa.exe opssvc.exe"" (UID: 00000000-00003268) Spawned process "cmd.exe" with commandline "cmd /c mkdir 8908" (UID: 00000000-00000588) Spawned process "cmd.exe" with commandline "cmd /c copy /b Logged + Tracking + Workout + Null + Citizen 8908\\America.pif" (UID: 00000000-00003104) Spawned process "cmd.exe" with commandline "cmd /c copy /b Learn + Did + Chorus 8908\\c" (UID: 00000000-00001144) Spawned process "America.pif" with commandline "8908\\America.pif 8908\\c" (UID: 00000000-00002588) Spawned process "PING.EXE" with commandline "ping -n 5 localhost" (UID: 00000000-00001312)3d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEREREQAAAAAAAAAAAAAAABEREREAAAAAAAAAAAAAAAARERERAAAAAAAAAAAAAAAAEREREQAAAAAAAAAAAAAAABEREREAAAAAAAAAAAAAAAARERERAAAAAAAAAAAAAAAAEREREQAAAAAAAAAAAAABEREREREBEAAAAAAAAAABEREREREREREQAAAAAAAAAREREREREREREAAAAAAAAREREREREREREREAAAAAAAEREREREREREREREAAAAAABERERERERERERERAAAAAAERERERERERERERERAAAAARERERERVVVVUVERERAAAAFV3dzdVd3d1VTN3d3cAAACZmZm7V3d3d1W7u7u7AAAAmZmZu3d3d3dVu7u7uwAAAJmZu7u7u43dVbu7u7sAAACZmbu7u7u33de7u7u7AAAAGZmTu7u33d27u7u7swAAABmZM7u73d3ddbu7u7MAAAABk7u7Nd3d3Xu7u7cwAAAABDOzu3RV3Xe7u7s3cAAAAEQ7sRt0RDu7u7u7d0QAAABEA7EBNER7u7u7szBEAAAARAAQAAAEQ7u7uwAARAAAAEQAAAAAAAC7u7sAAEQAAAAARERERVVVi7t0REQAAAAABEREREVVVVi7REREQAAAAAAAAAAAAAAAMwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790367661081,"unified_at":"2026-09-25T20:21:01.081Z","metadata":{"hashes":{"sha256":"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a","sha1":"6f7e99a0d8fff2b7191468dfac2c51c2fba5cd52","md5":"ffd6c86af20c38cccffcd9b0e15ece4c","sha512":"eae55c69e951a9cd4a4f2dabf6aba2e0a61a9251733156bbb25bc2b47fcea27e9d7ea92c349345b2ab06407cd64dd828d147fd06bdd053bd5938cf85120f7bb4","ssdeep":"24576:usP9hehe+N0gOaDSKvzL3+gTFDrZ7FB1gGU47aU7hR9g4Fw1aAanY9517v7Wy4dv:14hGKfp9gWJR3cP517zWn6n3B9jYxLrp","ssdeep_chunks":["24576:usP9heh","24576:sP9hehe","24576:P9hehe+","24576:9hehe+N","24576:hehe+N0","24576:ehe+N0g","24576:he+N0gO","24576:e+N0gOa","24576:+N0gOaD","24576:N0gOaDS","24576:0gOaDSK","24576:gOaDSKv","24576:OaDSKvz","24576:aDSKvzL","24576:DSKvzL3","24576:SKvzL3+","24576:KvzL3+g","24576:vzL3+gT","24576:zL3+gTF","24576:L3+gTFD","24576:3+gTFDr","24576:+gTFDrZ","24576:gTFDrZ7","24576:TFDrZ7F","24576:FDrZ7FB","24576:DrZ7FB1","24576:rZ7FB1g","24576:Z7FB1gG","24576:7FB1gGU","24576:FB1gGU4","24576:B1gGU47","24576:1gGU47a","24576:gGU47aU","24576:GU47aU7","24576:U47aU7h","24576:47aU7hR","24576:7aU7hR9","24576:aU7hR9g","24576:U7hR9g4","24576:7hR9g4F","24576:hR9g4Fw","24576:R9g4Fw1","24576:9g4Fw1a","24576:g4Fw1aA","24576:4Fw1aAa","24576:Fw1aAan","24576:w1aAanY","24576:1aAanY9","24576:aAanY95","24576:AanY951","24576:anY9517","24576:nY9517v","24576:Y9517v7","24576:9517v7W","24576:517v7Wy","24576:17v7Wy4","24576:7v7Wy4d","24576:v7Wy4dv","49152:usP9heh","49152:sP9hehe","49152:P9hehe+","49152:9hehe+N","49152:hehe+N0","49152:ehe+N0g","49152:he+N0gO","49152:e+N0gOa","49152:+N0gOaD","49152:N0gOaDS","49152:0gOaDSK","49152:gOaDSKv","49152:OaDSKvz","49152:aDSKvzL","49152:DSKvzL3","49152:SKvzL3+","49152:KvzL3+g","49152:vzL3+gT","49152:zL3+gTF","49152:L3+gTFD","49152:3+gTFDr","49152:+gTFDrZ","49152:gTFDrZ7","49152:TFDrZ7F","49152:FDrZ7FB","49152:DrZ7FB1","49152:rZ7FB1g","49152:Z7FB1gG","49152:7FB1gGU","49152:FB1gGU4","49152:B1gGU47","49152:1gGU47a","49152:gGU47aU","49152:GU47aU7","49152:U47aU7h","49152:47aU7hR","49152:7aU7hR9","49152:aU7hR9g","49152:U7hR9g4","49152:7hR9g4F","49152:hR9g4Fw","49152:R9g4Fw1","49152:9g4Fw1a","49152:g4Fw1aA","49152:4Fw1aAa","49152:Fw1aAan","49152:w1aAanY","49152:1aAanY9","49152:aAanY95","49152:AanY951","49152:anY9517","49152:nY9517v","49152:Y9517v7","49152:9517v7W","49152:517v7Wy","49152:17v7Wy4","49152:7v7Wy4d","49152:v7Wy4dv","24576:14hGKfp","24576:4hGKfp9","24576:hGKfp9g","24576:GKfp9gW","24576:Kfp9gWJ","24576:fp9gWJR","24576:p9gWJR3","24576:9gWJR3c","24576:gWJR3cP","24576:WJR3cP5","24576:JR3cP51","24576:R3cP517","24576:3cP517z","24576:cP517zW","24576:P517zWn","24576:517zWn6","24576:17zWn6n","24576:7zWn6n3","24576:zWn6n3B","24576:Wn6n3B9","24576:n6n3B9j","24576:6n3B9jY","24576:n3B9jYx","24576:3B9jYxL","24576:B9jYxLr","24576:9jYxLrp"],"imphash":"18935e5fc4b0485099e60eb3281bc48d"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2363752,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706810868000,"last_seen":1707288213000,"last_multi_scan":1707288213000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":82},"sandbox_signatures":{"informative_count":209,"suspicious_count":14,"malicious_count":5,"total":228},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.AntiAnalysis","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Dropper]/Win32.Delf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"BDS/Agent.xhato","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71461503","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.71461503 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/TrojanDropper.Delf.ADF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.bo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.Win32.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Delf.kiheag","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.UWDG-4825","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VBK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.TrojanDownloader.Banload","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Creates new processes"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"},{"type":"suspicious","value":"Contains ability to update the user profile"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Contains ability to modify process memory (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"suspicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugPort"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"},{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Makes a code branch decision directly after an API that is environment aware"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Searches for patterns in files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to copy files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Impact","technique":"Disk Content Wipe","attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Services File Permissions Weakness","attack_id":"T1574.010","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/010","sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys"},{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Adjusts debug privileges"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Contains ability to remove directories"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Contains ability to empty the Recycle Bin on the specified drive"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"suspicious","value":"Contains ability to block user input"},{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Credential Access","technique":"Unsecured Credentials","attack_id":"T1552","attack_id_wiki":"https://attack.mitre.org/techniques/T1552","identifiers":[{"type":"informative","value":"Contains ability to search for patterns of text (possibly credentials) in files"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Imports windows networking related APIs"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","identifiers":[{"type":"informative","value":"Checks internet connectivity using tracert/ping"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Tries to move files"},{"type":"informative","value":"Tries to copy files"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates a writable file in a temporary directory"},{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$22","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00007268.00000000.67032.004E7000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00007268.00000000.67032.004E7000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007268.00000000.67032.004E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007268.00000000.67032.004E7000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00007268.00000000.67032.004E7000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007268.00000000.67032.004E7000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007268.00000000.67032.03030000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"c97aa2240452b4c1db4ccfbfc783c95d6b47309d5bd389675864d0fc3541b93a.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.09458484166376","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"65c326955f8b7dca40045812"},{"report_type":"sandbox","report_id":"65bbddf3130d6b11de00077f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"