26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample cf4652172e2b… — Score 79/100 — Hybrid Analysis","description":"Malicious verdict for sample cf4652172e2b…. Malware family: Win/malicious_confidence_100%. Threat score 79/100. 8/27 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf4652172e2bab694d5bd9e93cac3995205ea109e09c8799c25b3f7917638b5e","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","cf4652172e2bab694d5bd9e93cac3995205ea109e09c8799c25b3f7917638b5e"],"about":{"@type":"SoftwareApplication","name":"Setup.exe","applicationCategory":["peexe","executable"],"identifier":"cf4652172e2bab694d5bd9e93cac3995205ea109e09c8799c25b3f7917638b5e","additionalType":"Malicious sample"},"threatScore":79,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":8,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T48b,Assembly shows XOR instruction xor al D8h in Stream UID: 26174-790-004066A8 Assembly shows XOR instruction xor eax dword ptr [eax+00h] in Stream UID: 26174-1054-00428BB8 Assembly shows XOR instruction xor byte ptr [eax+00h] al in Stream UID: 26174-1054-00428BB8 Assembly shows XOR instruction xor ch byte ptr [esi] in Stream UID: 26174-1054-00428BB8 Assembly shows XOR instruction xor eax edx in Stream UID: 26174-2102-00423650 Assembly shows XOR instruction xor al 01h in Stream UID: 26174-2275-0042D888 Assembly shows XOR instruction xor al 01h in Stream UID: 26174-2278-0042D8E4 Assembly shows XOR instruction xor ah al in Stream UID: 26174-2302-00425134 Assembly shows XOR instruction xor bl bh in Stream UID: 26174-2316-004251A0 Assembly shows XOR instruction xor bl dl in Stream UID: 26174-2343-004065B0 Assembly shows XOR instruction xor al D9h in Stream UID: 26174-2793-00406620 Assembly shows XOR instruction xor dl ch in Stream UID: 26174-2904-00406830 Assembly shows XOR instruction xor dword ptr [ebx] edi in Stream UID: 26174-3107-0045860C Assembly shows XOR instruction xor eax C37BCAAEh in Stream UID: 26174-3122-00402E0B28:Tc8a,Found XOR loop in file "sample.bin" at offset 376859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 380247; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 391067; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 391539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 392239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 395671; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 397419; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 398151; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 400629; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 403143; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 380469; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 388171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 399591; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 502008; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 502060; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 507086; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 507542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 514928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 168711; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 170980; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 307800; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 307833; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 380208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 380938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 381498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 383620; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389776; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 390570; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 391056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 395524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 397380; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 399536; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 400590; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 401492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 403104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 438662; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 443134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 620264; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 621581; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 625795; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 629490; code bytes = 803029:T4f8," BoB / BobSoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a4919fb209fedee5a0f7f2f"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"