21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4cd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample ca8b0ebbb30f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ca8b0ebbb30f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 15/26 AV engines flagged this file. 6 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e"],"about":{"@type":"SoftwareApplication","name":"svchost.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T4e3,Found malicious artifacts related to "93.184.221.240": ...File SHA256: 6b56c1903c2514fc7fa2060bfb9a33e724404d7b3d1287f66b2b611b3620eb7c (AV positives: 35/66 scanned on 05/11/2018 16:38:59) File SHA256: aa7f27f2728fb43aae265fcb6d85cfffa0c16587a22fc69137e12ecfe9ad2d3c (AV positives: 54/63 scanned on 05/11/2018 16:37:25) File SHA256: 3c0a04e4d65ba1e3d6b6b5179f2c856cbb4ba690cae6abad6d545d1753359b0b (AV positives: 58/64 scanned on 05/11/2018 16:37:06) File SHA256: 3db8eefd78ff37956efa8ebc477dddfa4183caeed631097d0b5b76538f4bd0c0 (AV positives: 61/66 scanned on 05/11/2018 16:37:02) File SHA256: 89c249aee69354fd1a4adfc3d39887756c6b0b7817d063530298ea3d303c4cc0 (AV positives: 29/66 scanned on 05/11/2018 16:36:16) File SHA256: 6ae08665f9dc1cb72857c808eff0321eb349152344b1accb8004ef79969ebaf4 (Date: 05/11/2018 17:13:47) File SHA256: eaa1fbd405a881cec3f6a3413a7b375c9812e0bba6cd5bd9bc0e66ad15e65eb3 (Date: 05/11/2018 17:04:29) File SHA256: 7a6e976642f77209345432eae1894cf804f911dfee42229911cf165d89c0397a (Date: 05/11/2018 17:03:24) File SHA256: bbcb5e552cab50c7b5f531bab321f1d21f145f09fbde5956e0d8f4ddef24b61e (Date: 05/11/2018 17:01:19) File SHA256: bbeff37e9b059dc5f22523cea2fb8596ea2fcda0f3d2e51fba7ba9a1d0590072 (Date: 05/11/2018 16:40:04)23:T6b0,Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "ca8b0ebbb30f371219c2ae79cdc0bd1dd3114cdf27821e71cfbcc11f9daca30e.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; Source: "00000000-00001360.00000002.131395.00E82000.00000002.mdmp") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; Source: "00000000-00001360.00000002.131395.00E82000.00000002.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00001360.00000002.131395.00E82000.00000002.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00001360.00000002.131395.00E82000.00000002.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00001360.00000002.131395.00E82000.00000002.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00001360.00000002.131395.00E82000.00000002.mdmp")24:Tb69,Found XOR loop in file "sample.bin" at offset 171777; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 194964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 269118; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 273977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 286237; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 317391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 347264; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 399368; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 409216; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 443517; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 482835; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 554790; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 587911; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 764356; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 836891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 933174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 949461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 978969; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1028186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 155635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 156834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 163616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 164048; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 255926; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 261730; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 318185; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 365482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 375487; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 390017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 410986; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 468851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 588993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 626340; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 704604; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 973664; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 555202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 835513; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 979421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1032860; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1043507; code bytes = 803025:Teec,"" (Indicator: "GetDC"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp")34:T12b0,Found reference to API "81021782146,1276,104,,GetKeyState,user32.dll,"00:33:42.000",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "81021969574,1276,104,,GetKeyState,user32.dll,"00:33:42.000",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80901384482,1276,104,,GetKeyState,user32.dll,"00:33:41.953",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80949647090,1276,104,,GetKeyState,user32.dll,"00:33:41.968",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "81021894018,1276,104,,GetKeyState,user32.dll,"00:33:42.000",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80877235486,1276,104,,GetKeyState,user32.dll,"00:33:41.937",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "81021852540,1276,104,,GetKeyState,user32.dll,"00:33:42.000",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80853154286,1276,104,,GetKeyState,user32.dll,"00:33:41.921",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80973786688,1276,104,,GetKeyState,user32.dll,"00:33:41.984",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80973746770,1276,104,,GetKeyState,user32.dll,"00:33:41.984",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80805009622,1276,104,,GetKeyState,user32.dll,"00:33:41.906",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80877353976,1276,104,,GetKeyState,user32.dll,"00:33:41.937",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "81021931984,1276,104,,GetKeyState,user32.dll,"00:33:42.000",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "80660324950,1276,104,,GetKeyState,user32.dll,"00:33:41.843",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000001.129476.03480000.00000004.mdmp") Found reference to API "151881943730,1276,104,,GetKeyState,user32.dll,"00:34:11.531",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151954583308,1276,104,,GetKeyState,user32.dll,"00:34:11.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151906225690,1276,104,,GetKeyState,user32.dll,"00:34:11.531",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "152002868750,1276,104,,GetKeyState,user32.dll,"00:34:11.578",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151906015726,1276,104,,GetKeyState,user32.dll,"00:34:11.531",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "152002829282,1276,104,,GetKeyState,user32.dll,"00:34:11.578",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151954636618,1276,104,,GetKeyState,user32.dll,"00:34:11.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151954494670,1276,104,,GetKeyState,user32.dll,"00:34:11.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151954542022,1276,104,,GetKeyState,user32.dll,"00:34:11.546",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "152002787004,1276,104,,GetKeyState,user32.dll,"00:34:11.578",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp") Found reference to API "151663704824,1276,104,,GetKeyState,user32.dll,"00:34:11.437",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001360.00000002.131395.03480000.00000004.mdmp")35:T9e4,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69cad2ed340c12be3306c294"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$23","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69cad2ed340c12be3306c294"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001360.00000000.127556.03480000.00000004.mdmp, 00000000-00001360.00000001.129476.03480000.00000004.mdmp, 00000000-00001360.00000002.131395.03480000.00000004.mdmp, 00000000-00001360.00000003.136904.03480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cad2ed340c12be3306c294"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"