23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Razy.Generic Sample d09160086c23… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d09160086c23…. Malware family: Razy.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb","keywords":["Malicious","Razy.Generic","malware analysis","sandbox report","threat intelligence","d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb"],"about":{"@type":"SoftwareApplication","name":"bla.exe","applicationCategory":["peexe","executable"],"identifier":"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Razy.Generic","antivirusDetections":{"malicious":17,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T830,"GET /?q=V1wgPuroa1STokg89%2Fxc3Bvr1x0x2ng%2FEyZu5e2x%2BXqKhtwEr6x7jdDCZBwoSLaAq264LGCsi2yVxALDCgSYyJNFIN91rZofqKJ3YWRzju5%2F%2FfLmtXJ2Dgh1rVOXB%2FfZr1pwSS%2BfddPZSKfQX6yN%2FY%2BqrCW%2B96gXenOCYMyCK%2FMmFdWYc0QYe37gXV3WOqS2%2FqY5rossgfoZh91ltQpkSKngmgDgZ7yEC3cqJZxGnhBez2C7nY4iQ3b1s92nAFI%2Fi0yTPeciS0higXcB4UYsEBKz%2FQHGoBSJx3VPqfiZr%2B7tS2EDmIiw6%2BwgVPO3PswrgQPzPcN13BM%2Fa%2BqKzqzBY21PFaEp7nAmAX0Rc7LtVr9bJ10XtFC3IH5%2BnYIVeODwUw8SE HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Host: first-usapro.info" "GET /get/?q=T6deAExv/6W7qolOQIBSAS09qfOFMQ4lEJHoJqm51kDHM5zIN/Ya4rITQfS%2BqBdv4K8hDdCeNnNcgdhuzk3QavEP0945xHAwZd7cgEceOr64EkPLtl%2BqHI%2BP6xPSqBwf2ansK%2BSRzXIbLoSCa9xuoqz%2BkOFI2VcYHYGwW1RBH21OiNhYVJDXRkZrebWBpfneroeSzXaSTegvqyBQL/6xYta5220nzfibmIc7M6yYYG2L7tv2AipeY4jSJFFNxnOdIUkkVyqNm2eMnQUWPShc6BKwDNEbypj81cJ9igEpELjE04QuKvxK4T6qcphJxEwaLwFBDqe5sTAAHGrP/VQbF/KWEpuY60OzM2JRZRhoFHlmhUcHSd3Az/UX9vjoWQ6OV/aOKrLtPtdkAmF78Pu3e5QiaIvZGcdzda/eB5vQl4Mg8Rq4AeeKP9YDDLwHAEcsSEIZZlAH23rxHhnJqMBML7V64KwrtSGKH1i2o73rMZs2UqAAUxPNdBQU0Qdd1gEsXTsD/w1DBPQW7PM89Q8ux%2BQgfvQzqlQI HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Host: allmodel-pro.com" "GET /get/?q=7x78/cK%2Bh9/mss/pniLqiLLI3yLgqQd3pYUifzI%2B4e1ERzK7D1a5lbMa7BNsT2kFRzb%2B5KJ/bbjCKGQEZqcvJMThM94eHO5P0IBoeqQsbMcFnrBsAt1e%2BPHcPFQCx0p9NR8BbI4a1autQDQQkxWuon30AwwO0URpsJpV6gy1dB2w9iDLXNw4oD0r6msgGSWp43lq0z7T6YSEC24XskVltp8w8QNXqXbEAI3B7/O4m9xSa2IZj2raf9GMJncYttHh7ajzUKjwjbQvcu4T4xT6HQ2qdrZ7OhPPQjafgGpqn4ukIA6FuSaWx0%2BCp5s2QiVQbomEOZNxap1Maha/0Ds5CempWxJ%2BVZQ7XrSxG1D3U8ZzyHGDvbez9oFWM/rkxoxid698Erw7C%2BHe3Vs2j0hQl8baRCC%2BFSzQty09f%2BrjtM4W%2BtLdLIwscPDFfr72wj%2BMGGRhrqFTuMaOnyp8dLGMjclu1k5dCtZxIPjIz05w9x0LU2boj/JJYjT%2B131X/MKubLEUR5hqV2X8/HcETFdwAmV%2B96o0c5Wkys HTTP/1.1 Accept: */* User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36 Host: allmodel-pro.com"25:T160a,Found malicious artifacts related to "52.27.128.59" (ASN: , Owner: ): ... URL: http://b.reload-waterfall.xyz/hp (AV positives: 3/63 scanned on 07/14/2015 12:32:14) URL: http://cameljobfinal.com/v24437?product_name=Adobephotoshopcc2014update&filesize=2.4Mb&product_title=Adobephotoshopcc2014update&affiliate_id=1505-4118313&installer_file_name=setup&product_file_name=sevensetup.exe&product_download_url=http (AV positives: 7/63 scanned on 07/14/2015 12:30:32) URL: http://groupmodel.biz/?q=TzS+AOa51L5A987surQ4bANkVc6rh4x5Fl3DueSPsUKBg2+Yebub7V54QJI+AbrgBzYH9UE+pPLfmNoazVJ27vmQMB7FR7fqWGWV+PH9NGK84HdcMfMbudrvghey2zFxOvwc8lYRDPCD/iKRdYgKzltu3VPfLdm4JKAa5Vt1Ei16jfXsAj/ypwXIMKf67Fs+jlf7piFygcU72rURhtpPtEGNT8axpqNO8+Hdli (AV positives: 4/63 scanned on 07/14/2015 12:29:48) URL: http://parentmodel.biz/?q=SYJpn5wq08HWyYn5wyW3f2ptDng9S0Aeu%2FU5K8COhC9ZrPEc01J428Kk0crJuAlTdx3%2Bh%2B5B9G4xfsm0aZfcLbCa%2FBsVfoHC3G3%2BFn5aKKe9RciRNk%2BPMDLdXpFzuQN9pk0jXQZpG4tyMp2AgNNq92R7GQwhXNX0ee%2B9hcFScg3Q%2FeJnnrb%2FGXM%2BfxcbqSvWb5aLs1MJxORUxYMuq (AV positives: 7/63 scanned on 07/14/2015 12:26:49) URL: http://groupmodel.biz/?q=pMp4Hkg7l8ZU52XF56tj8nRkALfRbYa0lXCJ8tIlKU8rlyClu28IrarLmIHbUV06y7k5bgdIPuC8glNuxWhtjsCCgIHuqFpO%2BPVd%2FcTGcWGZNwBo4icp%2FNeB2WvUgRIcq0FoLnQa1o%2BSe4Soe8bGtvQWha84n5EHW29xQeDk3xsTlcf5zir99nKwseudg7Ev1koBdZqcvpnl40ytlFW4NThEkvsNtL (AV positives: 4/63 scanned on 07/14/2015 12:25:54) File SHA256: 5ce171f5e9d0e0fe9b3d7b8308b0ba57e3b0ecb2aecdf59523c2bd52ae611f99 (AV positives: 37/55 scanned on 07/14/2015 12:32:18) Found malicious artifacts related to "165.254.207.74" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://www.icicibank.com/campaigns/mailers/2015-may/irctc-29-05-2015/gb/Disclaimer_trendin.html (AV positives: 1/63 scanned on 06/06/2015 01:04:22) URL: http://www.icicibank.com/campaigns/mailers/2015-may/irctc-29-05-2015/pb/Disclaimer-imobile-banking.html (AV positives: 1/63 scanned on 06/06/2015 01:01:22) URL: http://i0.tagstat.com/p1/m/ibqBZmk1JdIoMVTA0j425Knieg1jcE8eo-25td4_14BBCUF5DMWjeg==.jpg (AV positives: 1/63 scanned on 04/27/2015 10:29:40) URL: http://install-cdn.stormvade.net/ (AV positives: 3/62 scanned on 03/18/2015 19:45:38) URL: http://download.cdn.bearshare.com/cdn/r/1586/bearsharesetup-r1586-n-bo.exe (AV positives: 6/62 scanned on 03/18/2015 13:37:12) File SHA256: cdd72302eaacf36186a29c524e4a8dd8535007c009f23b5563037e224a27cad2 (AV positives: 1/57 scanned on 03/18/2015 14:27:15) File SHA256: f1ca24da6e42ffe5e7453e0fa7fc59a4f40c88808a9226746ab38fe60569e570 (AV positives: 2/56 scanned on 03/16/2015 05:25:01) File SHA256: 2adceaf7d5a9737b34874603b500f5c64493568b7af8157f3a57b0de34e94644 (AV positives: 1/57 scanned on 03/10/2015 13:21:40) File SHA256: d4f1e974af975f382359108ee45dd997b59193f52167afbe809082726197f0bf (AV positives: 1/57 scanned on 03/09/2015 08:28:37) File SHA256: 3fc75ce830ffad51c5d153b311a79d179608de4bae98d8e589c35998c08ca51c (AV positives: 11/57 scanned on 03/09/2015 04:56:32) Found malicious artifacts related to "165.254.207.89" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://download.windowsupdate.com/v9/windowsupdate/redir/muv4wuredir.cab?1506052016 (AV positives: 1/63 scanned on 06/05/2015 20:18:06) URL: http://p.udn.com.tw/ (AV positives: 1/62 scanned on 04/20/2015 10:01:03) URL: http://a.ligatus.com/timeout.php?ids=20354 (AV positives: 1/62 scanned on 04/11/2015 03:25:27) URL: http://i.ligatus.com/dmu/is/1/9/7/8/7/9/180_burgo-viejo_180x60.gif (AV positives: 1/62 scanned on 03/29/2015 01:35:29) URL: http://install-cdn.browseden.biz/ (AV positives: 3/62 scanned on 03/18/2015 14:43:21) File SHA256: 5b62b1c385a324acb6fff909b059a783b314f0287beee4522355378f5a33209e (AV positives: 1/57 scanned on 03/28/2015 20:03:37) File SHA256: fa4315a60d2c2922262564cec26cab6c065157696bbfde0c0561bbae899fcc4c (AV positives: 1/57 scanned on 03/11/2015 05:37:18) File SHA256: 07e8c016ed102712126c685c20012d581118854535395935ea8f621b2f8ef999 (AV positives: 4/57 scanned on 03/10/2015 12:47:57) File SHA256: 0fc84fcf80edd3ed59ab6336eaa968958324d5bb1d4ec8ffd8697219054daeb2 (AV positives: 1/51 scanned on 03/10/2015 07:22:08) File SHA256: 8a657271557e9e7af8e55bfac85ea70f83fe8fb8154979ff0d3a869b80b7c8e5 (AV positives: 1/57 scanned on 03/10/2015 04:49:21) Found malicious artifacts related to "165.254.207.88" (ASN: 2914, Owner: NTT America, Inc.): ... URL: http://p.udn.com.tw/upf/2014_sales/travel/cheesead.html (AV positives: 1/62 scanned on 04/24/2015 21:55:46) URL: http://i.ligatus.com/dmu/is/1/1/0/6/3/4/2/90_90x75.jpg (AV positives: 1/62 scanned on 03/29/2015 01:35:31) URL: http://i.ligatus.com/dmu/is/1/1/0/2/4/8/7/90_mc_UCL_2015_LigatusSpecs_90x75_V2.jpg (AV positives: 1/62 scanned on 03/29/2015 01:35:31) URL: http://i.ligatus.com/dmu/is/1/9/8/7/1/1/180_L_180x60.jpg (AV positives: 1/62 scanned on 03/29/2015 01:35:29) URL: http://b.monetate.net/js/1/a-986a6ec9/p/v2.qvc.com/396303/g (AV positives: 1/62 scanned on 03/18/2015 15:37:57) File SHA256: acc3d74894678db46bde1ad8576f5ff4428937aa4bc2e864c1a5fa749f9ab947 (AV positives: 1/57 scanned on 03/18/2015 15:26:23) File SHA256: f7e23bbb64057f72d70fe3fa92b2c331249f74d9eefa31239dc4b4adf407e02d (AV positives: 1/57 scanned on 03/18/2015 15:26:11) File SHA256: 62c6f2122419aafa1fa984f6fd00d0c55a19888b29c80f7b4d7782db5fb42b0f (AV positives: 1/57 scanned on 03/18/2015 14:50:15) File SHA256: 81e334dc648f02754022cf930c9a4d775830ca7ee73f684fd685c349260a6e8f (AV positives: 1/57 scanned on 03/18/2015 12:29:35) File SHA256: 1d0afec3f6b7df2e976fb7b1deef00abb9dc6191f2b59016d483c3e8b34a1e93 (AV positives: 1/57 scanned on 03/17/2015 17:41:28)26:Tef0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAArISURBVFhHRVdpbFzVGR0gOCmltIkDAZI4EFoJWgiL1LKUIlCRIBINUqtW/CoSqlT1V6Wq6h8kGsrSipBKpCE4CY4hILLYjpfYTrwktmM7cbyMxxmPPfZ4xkvs8XgWz2J73nvzltPz3TeGN36+7917373n2873XY9tAoYFmCYfilehYEE3NcCxAduGXuzX1BT2G9Jv8JmtunRonMc/mJxsyDtkYYf/dRQ4w11dV60tE4uXR3Nkc+5lup1cnh3FCbKzfMFOS6Gw4Vgygy86P+Q0ebPXTsOMfcqnPOcXVJ/AU99+JxdMQyMYGVGj6tnjqIWlgw/82B0S6bkwBy3bRa05JiwilT7CUWDUIroGfeK3QPJ5IC33+/x2iTNkjlwWqFB3Vc1Q2tC4uAguQD3uHBGlwCXdzRz+1PJErCtgXEHMpGAayjLSoVHFWPwcmN+HQvxFbv4csPYgnHgZN/o75+SK5hNDcF3Z3ZVQmcxghwuAl6wp1lITi30CXFSvVEqfkB9sTclm8YtCIQVj7g8wwq8RwEvQE4/Die0hkG1A5n44uTI4K2/CWp1Tq0OX1YnAYCtSmDRB4Vt/4LaC7juPKaqRqmefJijYyrCTDQCz3wCBvwHhN+BEX6EmXuD9C+irj9AcO4CVOwnih7BzmwnkQW7+CcGn+L0JTXxMmV5f1wBVRBdXtqadqWQ+md9qQplB5J85DXv4LeSvP4fJuruRPbMJZu8dwBClvvkM9OVHgcRDtOZWgv4e/eVHBLEN9hIBJX4GPfYKtOXDsM1VCiQRQhOo0BKfowOKH4gxbLU/7U9dK8Fz/dDm3kWm6yWEL27DQMMWjFXdi9XqEjidtwF9Hli9W4CR3bCSP6EwpTBX7+KXm6BlN0PPUyvZPdAWfwVM7QMW3qC2+5TA/FLcXZzQdkNwPbYUGFE5AYnVb/4Vlv8ZzLdvwXDdPQicKUXuLF3oqgd2J9thLuVjO1ACjP2AX94KY20TNVBK/9hNsz0BXcwU+w0Q/SMlTii/4hduoBYxuEZWTlaMHRnOr9C+vwPmXqaHP4387MOY7tiOTC3V33cL0O2B0X0LrCFqg0DgLYHuZxveyOWpmdQu3nu4JyNl8jWCOO7uQ4k9inT4ZzFGGXVwFM+4z66b0P6xKhiLr0OL7EVh4UnoqYeA+AO8S4HBEmg0gYDAldthej1wfLfBpDYKBONcvx32BJ0w9jQw8ywF2UuWXVIiGrYFj652XA9QbmxRZAKSbtGBaaSJ+i3Yi78HIr+mFh6js/2UXr4Lms5wW6WE0U0o3KD0PRtgdVGmHg90MckoQQVugR1k67sLpv9Jhu2/i1K663OkyAzyVlS/yeQgrwnG6mQmhWtz07gyF0ZPxofehUGEyHZW+lFo+S2081Zoa/eRgB6GPk3N+G8HOm6Fdk20Qk2MEFhvCaNlI+a7d2Jt+E3YFJLyK+t7xMQFEkShSAgSAMv8t8C+9pyOliTQsmiiIQY0xQy0cbCRfY0LBkLxT5B37oSVpcev7Ia2RAmj1NLMz2EPbKVf0Dcul2D2wk7Erj6Bhe4XkOh9kabnAiQhQeBZz3SieVH90gopkgywwNdrHGyOOriQtNGWAFrTGhoWCSSSx0WasekmcD0yhEz6KTiru0nJT5GEXoA+9Tol2AdjoAzhrscQ638M8a5nkR58CSnvqxxj8nJdDB6bj5bwLXWeY+AnCGKNEBaohUSWG2SgNm8movPJPGqpiZaIjYtsz0eBcxM0/bSXzkUSYqiZKXq6+MrUa/A33IFo16NYHn4R2YGnkbzxMvLBPyvJ5XJ5QDydzJPN25iiDywQyDzbNWbW1JoNLwG0cqNLlLw5BTTMEkCI7YKOVlJ8PT+om9MxfvMM9CQ9PfY87NBeBNufhP+UB+ELP6bUv8RE2+MYPbYd2ZEPqV9mkmLC8Sj24T3NtBpkb5jun+AgIx8RsmOBY744N6XEDdM2Lk1T9ZS6jaDqQxpqpoDaIJ8nHKRnJC0/B31uHxqO3AFvza0Y/aIM/hMPYqJiF0bLt0EbO6BkN6SoWdeAVC91kQKaM2vo5EaBjIbpZQs5aiGRttBPE5yneuqohYaQhSbeLWEHddRGc5gOOQl8NbAKr+8jOOGdSPTtQdNRDyarPRiv3IGxijKMntyO8SP3M4/sp4EpFbXsMMspJowYBo6NLOLERA5nRhOomTfRO2NijuQ0T4dt8C/iSGcEx3rH8M2khnNTDlomHXwdyuNEzypO9MVwuCuN023dAHnA6CYdX70Nq00bEDy6C/2VZRgv34XgkXuQ739fVUKOKkhIxeIIgVgGlcNpnPQncSq4iOODBOPN4exUHl+PLeOznllEfd8g0PYPHGgN4CzD48uuJVR6U/i8M4ejfUkcb8vhZNsUzA7JDRvovZSt3YORr7bhRmUpJg7txHD5ZmSvfyBEqzKtBCLhGphYWEHFwE0cH83i5FAWR8fn8dlYAhW+DA53zKIqEIY2XgFUb8Dh81P4ciCNyitxfH5lBZWt8zjcexPlPcs41M7YbCETMkEZ/S6AwS82Y+D4VgwffACD/7sP8eF3igEoDalYFDGV0NTGxweXcLJ/CRX9KZzyraJ+MovaMQuHOm6gZagf9V1XUXEtina/CW+sgPLOKD7rXCSABA4xTI5d9SsToIsm6CnBSrMHvkNU/6G7ESzfDt+BHUh1f1wsJ1l9FRx4hHKjGRvlQ1EcG1/E6fEk6iOraKWn19LG7dPi6RmU90bRMBpDNG9giaGZzmpom6cveE2cup7k5hk0X66F3ihJaQPMixugiRN+XIaxg1vgP8wa4sOdiPftL9Z4rDxpB48iRKLojqzh0gwZLsK4pxM2kO1q6OHVZLsmhl4HY38synKqwMJ1lQBYo60wSiYYopfJCQ2jNgKXmbQuMDtepB/QFIUqDwKfMgz/uwPeAzsx8q8HkGn/WOpk/tx0z5nSOIiR9Zq5Ud20QYKx0TirM9z4zDivu2HhUkiHd555Im8iLdbTLGRZvsUJJsWoCoYZLmdZiFRvhN1cAqNxI5wv6IQflmL04P0Yea8U/QfvZS6gD0g1rS6aQKhYCneNSK6SaFpIMHUhE62M8dpxuU1UhRzQ9KCVECcb2msa4ozjDPmh4FiYJojZDjJcDdV/jvdZZkDaP39yEwY/uhvD727H4AdbMbafPND5T7W1ewJhMirQEeSSUwvNi8sTJmq4cf2ohvNkuMYxA+d8Gi6HTfhoHl/cwGRSSMrBMrU2SxOFo3lYgf2wLnxfAXDqGIanWA0dK4H3nW0I7i+F9+3tGH67DMlrjCYR2hIT2DQBJeF5R8Wlw3o9vWaii9xeP67jwqSBajrjGTp3DdnuSkRHT1BDB1kwSE1EaP/5ZLF0ktpyJUdb/IeTN5MaaQKyYf8798D7XhlC9X9BLkqnksSnzK4OkRKGRCLPbHhgUtrQmZhGVwz6g4YmauEcHbBqyEJjwERzv4Fafx7eGQ1rK9y0aE7HJVj3yMiCE0P7Uah+BJNVf+K58UbxyKNzb85iSb7uBSobylnNXYmWUZmSdbBCqTHcmCXpXyFGSGihgFBOQ45HKjnGuUr87vRZLGMZXqRaEpyIKLUV8xxLT67vLq5AqGMdr29LMhmScFw/t8q6cnCw+aGkT7dao5xcTc1RHe4Rxj1P8OApBa4Uk4pni6WeLKQXb9G9qoBkghzhC/g/UK4Dbuw1R4MAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790275550328,"unified_at":"2026-09-24T18:45:50.328Z","metadata":{"hashes":{"sha256":"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb","sha1":"d6220cfe12a3803f1f4d94c2d0faed3b1bbbfbe6","md5":"d44812383eac007af8530fd34578eaba","sha512":"d6c16d00eb506c39e4233f6530a9b983ab379d70e3ce0784be622bbdd6e961aef939a1081062a1b5b1525835db301a0594db3b183d13072d463b3f6544d843f2","ssdeep":"6144:QLFAVRW4ZdyKdpGfHTzWTPY1+f3P/dY8y5qNVtk8d:QL8RfdpQHvWTPYgfXA5UC8d","ssdeep_chunks":["6144:QLFAVRW","6144:LFAVRW4","6144:FAVRW4Z","6144:AVRW4Zd","6144:VRW4Zdy","6144:RW4ZdyK","6144:W4ZdyKd","6144:4ZdyKdp","6144:ZdyKdpG","6144:dyKdpGf","6144:yKdpGfH","6144:KdpGfHT","6144:dpGfHTz","6144:pGfHTzW","6144:GfHTzWT","6144:fHTzWTP","6144:HTzWTPY","6144:TzWTPY1","6144:zWTPY1+","6144:WTPY1+f","6144:TPY1+f3","6144:PY1+f3P","6144:Y1+f3P/","6144:1+f3P/d","6144:+f3P/dY","6144:f3P/dY8","6144:3P/dY8y","6144:P/dY8y5","6144:/dY8y5q","6144:dY8y5qN","6144:Y8y5qNV","6144:8y5qNVt","6144:y5qNVtk","6144:5qNVtk8","6144:qNVtk8d","12288:QLFAVRW","12288:LFAVRW4","12288:FAVRW4Z","12288:AVRW4Zd","12288:VRW4Zdy","12288:RW4ZdyK","12288:W4ZdyKd","12288:4ZdyKdp","12288:ZdyKdpG","12288:dyKdpGf","12288:yKdpGfH","12288:KdpGfHT","12288:dpGfHTz","12288:pGfHTzW","12288:GfHTzWT","12288:fHTzWTP","12288:HTzWTPY","12288:TzWTPY1","12288:zWTPY1+","12288:WTPY1+f","12288:TPY1+f3","12288:PY1+f3P","12288:Y1+f3P/","12288:1+f3P/d","12288:+f3P/dY","12288:f3P/dY8","12288:3P/dY8y","12288:P/dY8y5","12288:/dY8y5q","12288:dY8y5qN","12288:Y8y5qNV","12288:8y5qNVt","12288:y5qNVtk","12288:5qNVtk8","12288:qNVtk8d","6144:QL8Rfdp","6144:L8RfdpQ","6144:8RfdpQH","6144:RfdpQHv","6144:fdpQHvW","6144:dpQHvWT","6144:pQHvWTP","6144:QHvWTPY","6144:HvWTPYg","6144:vWTPYgf","6144:WTPYgfX","6144:TPYgfXA","6144:PYgfXA5","6144:YgfXA5U","6144:gfXA5UC","6144:fXA5UC8","6144:XA5UC8d"],"imphash":"6fb3223b77f6b8ecdb22a326e094cc89"},"file_info":{"file_name":"bla.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":273920,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1529078563000,"last_seen":1580578800000,"last_multi_scan":1580578800000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":20,"malicious_count":6,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/Win32.Agent.hfxr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"ADWARE/MultiPlug.Gen7","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.26618","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Adware.Mplug-2410","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/S-8fec2e29!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Razy.26618 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Adware.MultiPlug.MZ application","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Unwanted-Program ( 004c84181 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"not-a-virus:HEUR:AdWare.Win32.MultiPlug.heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.dwesac","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Adware.Installerex.A8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"App/MultPlg-Z","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper/W32.Agent.273920.J","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"totaldefense":{"name":"Total Defense","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Adware.Generic6.BGFW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Crossrider","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Razy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API MessageBoxW@USER32.DLL at 01943046-00002512-52979-56-010D99BA","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 01943046-00002512-77E701AA-1952237\n GetSystemTime@KERNEL32.DLL at 01943046-00002512-77E701AA-1952254\n GetLocalTime@KERNEL32.DLL at 01943046-00002512-77E701AA-1952630\n GetLocalTime@KERNEL32.DLL at 01943046-00002512-77E701AA-1953190\n GetSystemTimeAsFileTime@KERNEL32.DLL at 01943046-00002512-52979-147-010D7BA4","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceExW@KERNEL32.DLL at 01943046-00002512-77E701AA-1952281","origin":"Hybrid Analysis Technology","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"first-usapro.info\"\n \"allmodel-pro.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"52.27.128.59:80\"\n \"52.26.16.139:80\"\n \"165.254.207.74:80\"\n \"165.254.207.89:80\"\n \"165.254.207.88:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"IESQMMUTEX_0_208\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$24","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"URLMON.DLL\" at base 767E0000\n \".exe\" loaded module \"NTMARTA.DLL\" at base 746C0000\n \".exe\" loaded module \"VERSION.DLL\" at base 75860000\n \".exe\" loaded module \"C:\\WINDOWS\\SYSTEM32\\FWPUCLNT.DLL\" at base 70BA0000\n \".exe\" loaded module \"KERNEL32.DLL\" at base 77850000\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 75A70000\n \".exe\" loaded module \"SHELL32.DLL\" at base 76BB0000\n \".exe\" loaded module \"PSAPI.DLL\" at base 75DF0000\n \".exe\" loaded module \"IPHLPAPI.DLL\" at base 75640000\n \".exe\" loaded module \"WININET.DLL\" at base 769B0000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"CoInternetCreateSecurityManager@urlmon.dll\"\n \"CoInternetCreateZoneManager@urlmon.dll\"\n \"CoInternetIsFeatureEnabledForUrl@urlmon.dll\"\n \"AddMandatoryAce@ADVAPI32.dll\"\n \"GetMartaExtensionInterface@ntmarta.dll\"\n \"DnsFree@dnsapi.DLL\"\n \"NamespaceCallout@fwpuclnt.dll\"\n \"RegDeleteKeyW@ADVAPI32.dll\"\n \"RegCreateKeyExW@ADVAPI32.dll\"\n \"RegCloseKey@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 01943046-00002512-77E701AA-1952760\n GetUserNameW@ADVAPI32.DLL at 01943046-00002512-77E701AA-1952803\n GetUserNameA@ADVAPI32.DLL at 01943046-00002512-77E701AA-1953397\n GetUserNameW@ADVAPI32.DLL at 01943046-00002512-77E701AA-1953440","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.exe\" has type \"data\"\n \"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.dat\" has type \"Little-endian UTF-16 Unicode text, with very long lines, with no line terminators\"\n \"ConsoleEmu.job\" has type \"VAX-order 68k Blit mpx/mux executable\"\n \"progressbar.gif\" has type \"GIF image data, version 89a, 360 x 11\"\n \"loader.gif\" has type \"GIF image data, version 89a, 16 x 16\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service","description":"OpenServiceW@ADVAPI32.DLL at 01943046-00002512-77E701AA-1952422\n OpenServiceW@ADVAPI32.DLL at 01943046-00002512-77E701AA-1952807\n OpenServiceA@ADVAPI32.DLL at 01943046-00002512-77E701AA-1952826\n OpenServiceW@ADVAPI32.DLL at 01943046-00002512-77E701AA-1953444\n OpenServiceA@ADVAPI32.DLL at 01943046-00002512-77E701AA-1953463","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 01943046-00002512-77E5FDA0-1953798","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\".exe\" set its error mode to SEM_NOGPFAULTERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 01943046-00002512-77E701AA-1952700\n SetUnhandledExceptionFilter@KERNEL32.DLL at 01943046-00002512-77E701AA-1953260\n SetUnhandledExceptionFilter@KERNEL32.DLL at 01943046-00002512-52979-22-010D804A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 01943046-00002512-52979-152-010D8027","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data2 with unusual entropies 7.99678708539","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 01943046-00002512-77E701AA-1952270\n GetVersionExA@KERNEL32.DLL at 01943046-00002512-77E701AA-1952648\n GetVersionExW@KERNEL32.DLL at 01943046-00002512-77E701AA-1952654\n GetVersionExA@KERNEL32.DLL at 01943046-00002512-77E701AA-1953208\n GetVersionExW@KERNEL32.DLL at 01943046-00002512-77E701AA-1953214","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 01943046-00002512-77E701AA-1952321\n GetProcessHeap@KERNEL32.DLL at 01943046-00002512-77E701AA-1952661\n GetProcessHeap@KERNEL32.DLL at 01943046-00002512-77E701AA-1953221\n GetProcessHeap@KERNEL32.DLL at 01943046-00002512-52979-251-010D7586","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 01943046-00002512-77E701AA-1952284\n LoadResource@KERNEL32.DLL at 01943046-00002512-77E701AA-1952285\n FindResourceW@KERNEL32.DLL at 01943046-00002512-77E701AA-1952331\n SizeofResource@KERNEL32.DLL at 01943046-00002512-77E701AA-1952543\n FindResourceA@KERNEL32.DLL at 01943046-00002512-77E701AA-1952569\n LockResource@KERNEL32.DLL at 01943046-00002512-77E701AA-1952577\n FreeResource@KERNEL32.DLL at 01943046-00002512-77E701AA-1952584\n FindResourceExA@KERNEL32.DLL at 01943046-00002512-77E701AA-1952588\n LoadResource@KERNEL32.DLL at 01943046-00002512-77E701AA-1952606\n FindResourceW@KERNEL32.DLL at 01943046-00002512-77E701AA-1952705","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"ConsoleEmu.job\" has type \"VAX-order 68k Blit mpx/mux executable\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting a value in the registry","description":"\".exe\" (Access type: \"CREATE\", Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"a 3$Taq@FY%FeadqGFlFuX'%T[3$Pw3$Tg]lglTO$'FPwSf!xW{WN&Du!Zb@d/t\\'&NbPU%_^#3$TxO_@sYRaCa.ES\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.143 Safari/537.36","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"Module32First@KERNEL32.DLL at 01943046-00002512-77E701AA-1952544\n CreateToolhelp32Snapshot@KERNEL32.DLL at 01943046-00002512-77E701AA-1952605\n Module32FirstW@KERNEL32.DLL at 01943046-00002512-77E701AA-1952635\n Module32First@KERNEL32.DLL at 01943046-00002512-77E701AA-1953096\n CreateToolhelp32Snapshot@KERNEL32.DLL at 01943046-00002512-77E701AA-1953165\n Module32FirstW@KERNEL32.DLL at 01943046-00002512-77E701AA-1953195","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetAsyncKeyState@USER32.DLL at 01943046-00002512-77E701AA-1952391","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"Z:\\d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.exe:Zone.Identifier\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 285918 does not match actual CRC 286430","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetCommandLineA\n GetModuleHandleExW\n GetProcAddress\n WriteFile\n GetModuleFileNameW\n GetStartupInfoW\n GetModuleFileNameA\n UnhandledExceptionFilter\n TerminateProcess\n GetModuleHandleW\n Sleep\n IsDebuggerPresent\n LoadLibraryExW\n OutputDebugStringW\n LoadLibraryW\n CreateFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \".exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"malicious","category":"General","name":"Sample was identified as malicious by at least one Antivirus engine","description":"28/55 Antivirus vendors marked sample as malicious (50% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"malicious","category":"Installation/Persistance","name":"Drops executable files to the Windows system directory","description":"File type \"VAX-order 68k Blit mpx/mux executable\" was dropped at \"C:\\Windows\\Tasks\\ConsoleEmu.job\"","origin":"Binary File","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$25","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop","description":"CreateDesktopA@USER32.DLL at 01943046-00002512-77E701AA-1953363\n CreateDesktopW@USER32.DLL at 01943046-00002512-77E701AA-1953389","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-8","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Accesses potentially sensitive information from local browsers","description":"\".exe\" had access to \"\\Device\\HarddiskVolume2\\Users\\PSPUBWS\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\" (Type: \"FileHandle\", Context: \"NtSetInformationFile\")","origin":"Touched Handle","relevance":5,"id":"handle-0","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"level":"malicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYENABLE\", Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\", Key: \"PROXYOVERRIDE\")\n \".exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-1663702577-2139711211-3687027567-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":8,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":33,"files_deleted_count":0,"registry_keys_created_count":22,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":27,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":2,"contacted_urls_count":3,"http_requests_count":3},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"55a500180e316dc237eb7cef","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Adware.Mikey","contacted_countries":["USA"],"submit_name":"bla.exe","analysis_start_time":"2015-07-14T07:27:47+00:00","indicators_count":{"informative":11,"suspicious":27,"malicious":9},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"52.27.128.59","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"address":"52.26.16.139","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"address":"165.254.207.74","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"address":"165.254.207.89","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"address":"165.254.207.88","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}],"dns_resolutions":[{"domain":"allmodel-pro.com","address":"52.26.16.139","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"domain":"first-usapro.info","address":"52.27.128.59","country":"United States","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}],"http_requests":[{"host":"first-usapro.info","host_ip":"52.27.128.59:80","url":"/?q=V1wgPuroa1STokg89%2Fxc3Bvr1x0x2ng%2FEyZu5e2x%2BXqKhtwEr6x7jdDCZBwoSLaAq264LGCsi2yVxALDCgSYyJNFIN91rZofqKJ3YWRzju5%2F%2FfLmtXJ2Dgh1rVOXB%2FfZr1pwSS%2BfddPZSKfQX6yN%2FY%2BqrCW%2B96gXenOCYMyCK%2FMmFdWYc0QYe37gXV3WOqS2%2FqY5rossgfoZh91ltQpkSKngmgDgZ7yEC3cqJZxGnhBez2C7nY4iQ3b1s92nAFI%2Fi0yTPeciS0higXcB4UYsEBKz%2FQHGoBSJx3VPqfiZr%2B7tS2EDmIiw6%2BwgVPO3PswrgQPzPcN13BM%2Fa%2BqKzqzBY21PFaEp7nAmAX0Rc7LtVr9bJ10XtFC3IH5%2BnYIVeODwUw8SE","method":"GET","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"host":"allmodel-pro.com","host_ip":"52.26.16.139:80","url":"/get/?q=T6deAExv/6W7qolOQIBSAS09qfOFMQ4lEJHoJqm51kDHM5zIN/Ya4rITQfS%2BqBdv4K8hDdCeNnNcgdhuzk3QavEP0945xHAwZd7cgEceOr64EkPLtl%2BqHI%2BP6xPSqBwf2ansK%2BSRzXIbLoSCa9xuoqz%2BkOFI2VcYHYGwW1RBH21OiNhYVJDXRkZrebWBpfneroeSzXaSTegvqyBQL/6xYta5220nzfibmIc7M6yYYG2L7tv2AipeY4jSJFFNxnOdIUkkVyqNm2eMnQUWPShc6BKwDNEbypj81cJ9igEpELjE04QuKvxK4T6qcphJxEwaLwFBDqe5sTAAHGrP/VQbF/KWEpuY60OzM2JRZRhoFHlmhUcHSd3Az/UX9vjoWQ6OV/aOKrLtPtdkAmF78Pu3e5QiaIvZGcdzda/eB5vQl4Mg8Rq4AeeKP9YDDLwHAEcsSEIZZlAH23rxHhnJqMBML7V64KwrtSGKH1i2o73rMZs2UqAAUxPNdBQU0Qdd1gEsXTsD/w1DBPQW7PM89Q8ux%2BQgfvQzqlQI","method":"GET","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"host":"allmodel-pro.com","host_ip":"52.26.16.139:80","url":"/get/?q=7x78/cK%2Bh9/mss/pniLqiLLI3yLgqQd3pYUifzI%2B4e1ERzK7D1a5lbMa7BNsT2kFRzb%2B5KJ/bbjCKGQEZqcvJMThM94eHO5P0IBoeqQsbMcFnrBsAt1e%2BPHcPFQCx0p9NR8BbI4a1autQDQQkxWuon30AwwO0URpsJpV6gy1dB2w9iDLXNw4oD0r6msgGSWp43lq0z7T6YSEC24XskVltp8w8QNXqXbEAI3B7/O4m9xSa2IZj2raf9GMJncYttHh7ajzUKjwjbQvcu4T4xT6HQ2qdrZ7OhPPQjafgGpqn4ukIA6FuSaWx0%2BCp5s2QiVQbomEOZNxap1Maha/0Ds5CempWxJ%2BVZQ7XrSxG1D3U8ZzyHGDvbez9oFWM/rkxoxid698Erw7C%2BHe3Vs2j0hQl8baRCC%2BFSzQty09f%2BrjtM4W%2BtLdLIwscPDFfr72wj%2BMGGRhrqFTuMaOnyp8dLGMjclu1k5dCtZxIPjIz05w9x0LU2boj/JJYjT%2B131X/MKubLEUR5hqV2X8/HcETFdwAmV%2B96o0c5Wkys","method":"GET","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}],"processes":[{"pid":2512,"ppid":0,"name":"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.exe","command_line":"","normalized_path":"","uid":"01943046-00002512","icon":"$26"}],"all_imported_dlls":["rasadhlp.dll","pnrpnsp.dll","mswsock.dll","VERSION.dll","netapi32.dll","kernel32.dll","msvcrt.dll","CFGMGR32.dll","wship6.dll","dnsapi.DLL","IPHLPAPI.DLL","CLBCatQ.DLL","NLAapi.dll","sechost.dll","CRYPTSP.dll","USP10.dll","imagehlp.dll","uxtheme.dll","napinsp.dll","wshtcpip.dll","PSAPI.DLL","CRYPTBASE.dll","LPK.dll","ntdll.dll","MSCTF.dll","DEVOBJ.dll","urlmon.dll","ole32.dll","comctl32.dll","ntmarta.dll","SETUPAPI.dll","WS2_32.dll","RASAPI32.dll","rtutils.dll","SHELL32.dll","KERNELBASE.dll","GDI32.dll","rasman.dll","wtsapi32.dll","IMM32.DLL","mstask.dll","ADVAPI32.dll","dhcpcsvc.DLL","profapi.dll","SHLWAPI.dll","rsaenh.dll","RpcRtRemote.dll","MPR.DLL","sensapi.dll","OLEAUT32.dll","SspiCli.dll","winrnr.dll","fwpuclnt.dll","WININET.dll","userenv.dll","USER32.dll","RPCRT4.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.dat","sha256":"db9bb7c92420a95bc8faf4c7d30f9d76d82ea3bb086fe967059aff50486f7b7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"name":"d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.exe","sha256":"4b0741b9bf1cb3f4118f5b2635242e81567d89fe65002a7565307e7d419b830a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"name":"ConsoleEmu.job","sha256":"fc8a7419e015019a6f3ba46a85fe2af8c4ba44c1a110af2a62b8514dff8a3d05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%SAMPLEDIR%\\d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.dat","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%SAMPLEDIR%\\d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.exe","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%ALLUSERSPROFILE%\\{8ea909ea-436f-4a89-8ea9-909ea43627a9}\\d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.exe","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%ALLUSERSPROFILE%\\{8ea909ea-436f-4a89-8ea9-909ea43627a9}\\d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb.dat","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%WINDIR%\\Tasks\\ConsoleEmu.job","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%ALLUSERSPROFILE%\\{8ea909ea-436f-4a89-8ea9-909ea43627a9}\\7b402375bb947247","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%ALLUSERSPROFILE%\\{8ea909ea-436f-4a89-8ea9-909ea43627a9}\\b6bd85209c409593","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%WINDIR%\\syswow64\\de-DE\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\NetBT_Tcpip6_{85C6619C-A5E8-4995-B351-1F8B696A9C13}","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\NetBT_Tcpip6_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\NetBT_Tcpip6_{C23E0E89-6218-47AD-AAA6-4A30095E2323}","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"\\Device\\NetBT_Tcpip_{99EEFFB2-AB17-4BFC-9BBC-D2001E0C4FC5}","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%TEMP%\\3EC0\\images\\progressbar.gif","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"images\\progressbar.gif","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%TEMP%\\3EC0\\images\\loader.gif","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"images\\loader.gif","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%TEMP%\\3EC0\\installer","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\PROGRAMMABLE\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\LOCALSERVER32\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\VERSION\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\{157B1AA6-3E5C-404A-9118-C1D91F537040}\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\{157B1AA6-3E5C-404A-9118-C1D91F537040}\\1.0\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\{157B1AA6-3E5C-404A-9118-C1D91F537040}\\1.0\\FLAGS\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\{157B1AA6-3E5C-404A-9118-C1D91F537040}\\1.0\\0\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\{157B1AA6-3E5C-404A-9118-C1D91F537040}\\1.0\\0\\WIN32\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\TYPELIB\\{157B1AA6-3E5C-404A-9118-C1D91F537040}\\1.0\\HELPDIR\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\INTERFACE\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\INTERFACE\\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\INTERFACE\\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\INTERFACE\\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\INTERFACE\\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\INTERFACE\\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\\PROXYSTUBCLSID32\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\INTERFACE\\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\E6B0C177F744DF8D\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\LOCALSERVER32\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\PROGRAMMABLE\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\TYPELIB\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\VERSION\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"key":"HKUHKCU_CLASSES\\WOW6432NODE\\CLSID\\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\\","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"55a500180e316dc237eb7cef"}]}]}},"report_ids":{"sandbox_job_ids":["55a500180e316dc237eb7cef"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Razy.Generic Sample d09160086c23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d09160086c23…. Malware family: Razy.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb"}],["$","meta","4",{"property":"og:title","content":"Malicious Razy.Generic Sample d09160086c23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d09160086c23…. Malware family: Razy.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d09160086c2328355a1580111def1e810cf10fa4e170b82c3af1e979880fcceb"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Razy.Generic Sample d09160086c23… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d09160086c23…. Malware family: Razy.Generic. Threat score 100/100. 17/26 AV engines flagged this file. 6 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]