26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ca89ba2aabb1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ca89ba2aabb1…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87"],"about":{"@type":"SoftwareApplication","name":"1273da64dc656db522fcaffb819502f2.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":14,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4c1,"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"28:T44b,Observed class from System.Security.Cryptography:"Aes" which can represents the abstract base class from which all implementations of the advanced encryption standard (aes) must inherit[Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin] Observed class from System.Security.Cryptography:"AesCryptoServiceProvider" which can performs symmetric encryption and decryption using the cryptographic application programming interfaces (capi) implementation of the advanced encryption standard (aes) algorithm[Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin] Observed class from System.Security.Cryptography:"CryptoStream" which can defines a stream that links data streams to cryptographic transformations[Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin] Observed class from System.Security.Cryptography:"SymmetricAlgorithm" which can represents the abstract base class from which all implementations of symmetric algorithms must inherit[Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin]29:T54d,Found - (Indicator: "aes") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "aescryptoserviceprovider") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "des") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "createdecryptor") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "cryptostream") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "base64") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "frombase64string") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "bz2") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "system.security.cryptography") in Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin Found - (Indicator: "des") in Source: 00000000-00002704.00000000.67476.00D02000.00000002.mdmp 00000000-00002704.00000000.67483.00D02000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00002704.00000000.67476.7F6F0000.00000002.mdmp 00000000-00002704.00000000.67483.7F6F0000.00000002.mdmp2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiPd3d3d3d3d3d3d3d3d3d4j4gAAAd/iIiIiH+IiIiIeI+AERF3f4iIiIh/iIiIiHiPhxERGH+IiIiIf4iIiIh4j4mZERF/iIiIiH+IiIiIeI+JmZERf4iIiIh/iIiIiHiPiZeZEX+IiIiIf4iIiIh4j4iZmRh/iIiIiH+IiIiIeI+IiZmIf4iIiIh/iIiIiHiP//////////////////94j3d3d3d/d3d3d393d3d3eI+IAHAIf4gBAIh/iIiIiHiPgFVVUH+AERF4f4iIiIh4j4VVVVV/gRERGH+IiIiIeI+FVVVVf4mRERh/iIiIiHiPjd1VVX95mREYf4iIiIh4j4Xd1VV/iXmRGH+IiIiIeI+I1dVYf4eZkYh/iIiIiHiPiIjYiH+Ih4iIf4iIiIh4j///////////////////eI93d3d3f3d3d3d/d3d3d3iPiHZmeH+IAiCIf4cRF4h4j4hmZmd/giAAKH8BEREIeI+GZmZmf4IiIgh/ERERGHiPhmZmZn8iIiInfxkRERh4j4ZmZmZ/eqIiKH+ZkREYeI+GbmZmf4qqIih/mZkRGHiPiGZmaH+IqiKIf4mZEYh4j4iIiIh/iIiIiH+IiIiIeI////////////////////gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790436585496,"unified_at":"2026-09-26T15:29:45.496Z","metadata":{"hashes":{"sha256":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87","sha1":"16163234aeeddc9cc66abe4a142d83f8710373de","md5":"1273da64dc656db522fcaffb819502f2","sha512":"67f0b03c01d36402e931b812a75ebaccf9c86492f1164908df423324bd45a368c6566b24dbeabf6bea8b4aa0c8827f9a7878d3bbee848157d0ece4ab9bf7b63f","ssdeep":"49152:uLF6XruXkTRNbxhv5azk9Yg7HURNz3YC095D0+bs0VQQynYIYG7GFNSsYCWqO:Q8u0TRN0RhxQst7nsFNSsYCWqO","ssdeep_chunks":["49152:uLF6Xru","49152:LF6XruX","49152:F6XruXk","49152:6XruXkT","49152:XruXkTR","49152:ruXkTRN","49152:uXkTRNb","49152:XkTRNbx","49152:kTRNbxh","49152:TRNbxhv","49152:RNbxhv5","49152:Nbxhv5a","49152:bxhv5az","49152:xhv5azk","49152:hv5azk9","49152:v5azk9Y","49152:5azk9Yg","49152:azk9Yg7","49152:zk9Yg7H","49152:k9Yg7HU","49152:9Yg7HUR","49152:Yg7HURN","49152:g7HURNz","49152:7HURNz3","49152:HURNz3Y","49152:URNz3YC","49152:RNz3YC0","49152:Nz3YC09","49152:z3YC095","49152:3YC095D","49152:YC095D0","49152:C095D0+","49152:095D0+b","49152:95D0+bs","49152:5D0+bs0","49152:D0+bs0V","49152:0+bs0VQ","49152:+bs0VQQ","49152:bs0VQQy","49152:s0VQQyn","49152:0VQQynY","49152:VQQynYI","49152:QQynYIY","49152:QynYIYG","49152:ynYIYG7","49152:nYIYG7G","49152:YIYG7GF","49152:IYG7GFN","49152:YG7GFNS","49152:G7GFNSs","49152:7GFNSsY","49152:GFNSsYC","49152:FNSsYCW","49152:NSsYCWq","49152:SsYCWqO","98304:uLF6Xru","98304:LF6XruX","98304:F6XruXk","98304:6XruXkT","98304:XruXkTR","98304:ruXkTRN","98304:uXkTRNb","98304:XkTRNbx","98304:kTRNbxh","98304:TRNbxhv","98304:RNbxhv5","98304:Nbxhv5a","98304:bxhv5az","98304:xhv5azk","98304:hv5azk9","98304:v5azk9Y","98304:5azk9Yg","98304:azk9Yg7","98304:zk9Yg7H","98304:k9Yg7HU","98304:9Yg7HUR","98304:Yg7HURN","98304:g7HURNz","98304:7HURNz3","98304:HURNz3Y","98304:URNz3YC","98304:RNz3YC0","98304:Nz3YC09","98304:z3YC095","98304:3YC095D","98304:YC095D0","98304:C095D0+","98304:095D0+b","98304:95D0+bs","98304:5D0+bs0","98304:D0+bs0V","98304:0+bs0VQ","98304:+bs0VQQ","98304:bs0VQQy","98304:s0VQQyn","98304:0VQQynY","98304:VQQynYI","98304:QQynYIY","98304:QynYIYG","98304:ynYIYG7","98304:nYIYG7G","98304:YIYG7GF","98304:IYG7GFN","98304:YG7GFNS","98304:G7GFNSs","98304:7GFNSsY","98304:GFNSsYC","98304:FNSsYCW","98304:NSsYCWq","98304:SsYCWqO","49152:Q8u0TRN","49152:8u0TRN0","49152:u0TRN0R","49152:0TRN0Rh","49152:TRN0Rhx","49152:RN0RhxQ","49152:N0RhxQs","49152:0RhxQst","49152:RhxQst7","49152:hxQst7n","49152:xQst7ns","49152:Qst7nsF","49152:st7nsFN","49152:t7nsFNS","49152:7nsFNSs","49152:nsFNSsY","49152:sFNSsYC"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"1273da64dc656db522fcaffb819502f2.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2426368,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678655408000,"last_seen":1678655409000,"last_multi_scan":1678655409000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":14,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":8},"sandbox_signatures":{"informative_count":19,"suspicious_count":7,"malicious_count":3,"total":29},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1249716","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.93922","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Msilheracles-9943143-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.CYU.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDZ.93922 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDropper.Agent.FLU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/MSIL.Agent.eq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSIL.Miner.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PWS-FDLU!1273DA64DC65","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-JPZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.MSIL.Miner","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to start a process"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"suspicious","value":"Contains ability to use cryptographic services (API string)"},{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime"},{"type":"informative","value":"Contains ability to load content into memory"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function \"MemoryStream\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function \"Reverse\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"\n Observed function \"Join\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"\n Observed function \"FromBase64String\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"\n Observed function \"Concat\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"Contains ability to start a process","description":"Observed function \"Process.Start\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 71d70000\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 759a0000\n \".exe\" loaded module \"GDI32.DLL\" at base 75950000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 75840000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"KERNEL32\" at base 76a80000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE.DLL\" at base 696c0000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 69630000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"100011000e03e671@ADVAPI32.dll\"\n \"0d000e002203e671@ADVAPI32.dll\"\n \"0d000e00fe02e671@ADVAPI32.dll\"\n \"0b000c00cc02e671@ADVAPI32.dll\"\n \"10001100da02e671@ADVAPI32.dll\"\n \"150016002c7a7469@ADVAPI32.dll\"\n \"0e000f00a47a7469@ADVAPI32.dll\"\n \"0e000f00d87a7469@ADVAPI32.dll\"\n \"11001200387f7469@ADVAPI32.dll\"\n \"11001200a47f7469@ADVAPI32.dll\"\n \"12001300b87f7469@ADVAPI32.dll\"\n \"12001300e07f7469@ADVAPI32.dll\"\n \"14001500bc937469@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x24ea00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x24e9a4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\CLR.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\MSCORWKS.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\CLR.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\MSCORWKS.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in \"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \",$ZD?b.kW\"\n Heuristic match: \",3ZM?b.kW\"\n Heuristic match: \",aZD?b.kW\"\n Heuristic match: \",CZ:>b.kW\"\n Heuristic match: \",gZD?b.kW\"\n Heuristic match: \"1sZ%>b.kW\"\n Heuristic match: \"1sZA?b.kW\"\n Heuristic match: \"1sZI?b.kW\"\n Heuristic match: \"3Z->b.MW\"\n Heuristic match: \"3Z@?b.kW\"\n Heuristic match: \"3ZC?b.kW\"\n Heuristic match: \"3ZH?b.kW\"\n Heuristic match: \"3sZA?b.kW\"\n Heuristic match: \"3sZI?b.kW\"\n Heuristic match: \"sWpT}%.MR\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Unusual Characteristics","name":"Dotnet file resource with suspicious entropy","description":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin has big resource with name: \"\" size: \"217088\" and abnormal entropy:\"7.65704876072\"\n ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin has big resource with name: \"\" size: \"2190336\" and abnormal entropy:\"7.97819736161\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to use cryptographic services (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.97777779641\n 0.0815394123432","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"49/69 Antivirus vendors marked sample as malicious (71% detection rate)\n 3/20 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"\n Potential IP \"1.0.0.0\" found in string \"MyApplication.app,version=\"1.0.0.0\"C:\\ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.exe\"\n \"1.0.0.0\"\n Potential IP \"1.0.0.0\" found in string \"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"db4de27100000000\" to virtual address \"0x00AB2000\" (part of module \"CA89BA2AABB1CBC5E063FC8064974DFA98BDBCCDD97D47B02F2B1718808E7F87.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.bin\" claims program is from Sun Jan 4 16:42:13 2043","origin":"Static Parser","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"49/69 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":21,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"640e40cb58812da990032d91","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.MSIL","submit_name":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.exe","analysis_start_time":"2023-03-12T21:14:51+00:00","indicators_count":{"informative":19,"suspicious":7,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}],"processes":[{"pid":2704,"ppid":0,"name":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.exe","command_line":"","sha256":"ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87","normalized_path":"C:\\ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87.exe","uid":"00000000-00002704","icon":"$2a"}],"all_imported_dlls":["gdi32.dll","kernel32.dll","sechost.dll","ws2_32.dll","fltLib.dll","api-ms-win-core-synch-l1-2-0.dll","mscoreei.dll","ntdll.dll","usp10.dll","ole32.dll","mscoree.dll","advapi32.dll","rpcrt4.dll","lpk.dll","oleaut32.dll","KernelBase.dll","nsi.dll","msvcrt.dll","user32.dll","imm32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"640e40cb58812da990032d91"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["640e40cb58812da990032d91"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ca89ba2aabb1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ca89ba2aabb1…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ca89ba2aabb1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ca89ba2aabb1…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ca89ba2aabb1cbc5e063fc8064974dfa98bdbccdd97d47b02f2b1718808e7f87"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ca89ba2aabb1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ca89ba2aabb1…. Malware family: Trojan.Generic. Threat score 100/100. 14/28 AV engines flagged this file. 3 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]