26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample d7573c48df12… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d7573c48df12…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404"],"about":{"@type":"SoftwareApplication","name":"Proforma Inv..exe","applicationCategory":["peexe","assembly","executable"],"identifier":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":3,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T452,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL"28:T800,Found - (Indicator: "des") in Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin Found - (Indicator: "rsa") in Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin Found - (Indicator: "base64") in Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin Found - (Indicator: "frombase64string") in Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin Found - (Indicator: "gzip") in Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin Found - (Indicator: "rc6") in Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin Found - (Indicator: "des") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "bz2") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "base64") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "frombase64string") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "gzip") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "rc6") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "rsa") in Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp 00000000-00003548.00000000.67287.010E2000.00000020.mdmp Found - (Indicator: "des") in Source: 00000000-00003548.00000000.67280.011AA000.00000002.mdmp 00000000-00003548.00000000.67287.011AA000.00000002.mdmp Found - (Indicator: "des") in Source: 00000000-00003548.00000000.67280.7F6F0000.00000002.mdmp 00000000-00003548.00000000.67287.7F6F0000.00000002.mdmp29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiHd0B4iIiIiIgAiHiIiIiIhIiGiIiIiIiIiIiIiIiIiIiIiIh3h3d4iIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiAR0BgiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiId3iIiIiIiIiIiIiIiIiIiIiHiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiHd3h4h3iIiIiIiIiIiIiIiIiHd3d4iIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiId3eIiIiIiIiIiIiIiIiHd3eIiIiIiIiIiIiIiIiIiIh2d0iIiIiIiIiEdndId4iIiIiIiIiIiIiIiIiHd3d4h2eHd4iIiIiIiIh3d4h3eIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiHd3iIiIiIiIiIiIiIiIiIiId3aIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiIiHh3iIiIiIiIiIiIiIiIiAAAAAAAAAAHeIiIj4iIiIgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791025913158,"unified_at":"2026-10-03T11:11:53.158Z","metadata":{"hashes":{"sha256":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404","sha1":"29a2c2af11add1e56744521a27affffae545e494","md5":"48ae937bd9a1d8629ddd149ea01b85d1","sha512":"9998816c6c117a3fb12cd3fe4b91e444df0ab2e7bf4bd664258cc25675d414ef35deb7f32657acf04bbaddb0d53420bf5429af3ad85a0d5407bbfb040b5769a6","ssdeep":"24576:jtzJTMCf4ihjAhhOMccCWfqoz+tN04sGNn/lBij2l0/eGRYpyuD8Iy/Je/XCGb3i:5zFj4iVAhhHccN0N04sGt/lBij2l0/e4","ssdeep_chunks":["24576:jtzJTMC","24576:tzJTMCf","24576:zJTMCf4","24576:JTMCf4i","24576:TMCf4ih","24576:MCf4ihj","24576:Cf4ihjA","24576:f4ihjAh","24576:4ihjAhh","24576:ihjAhhO","24576:hjAhhOM","24576:jAhhOMc","24576:AhhOMcc","24576:hhOMccC","24576:hOMccCW","24576:OMccCWf","24576:MccCWfq","24576:ccCWfqo","24576:cCWfqoz","24576:CWfqoz+","24576:Wfqoz+t","24576:fqoz+tN","24576:qoz+tN0","24576:oz+tN04","24576:z+tN04s","24576:+tN04sG","24576:tN04sGN","24576:N04sGNn","24576:04sGNn/","24576:4sGNn/l","24576:sGNn/lB","24576:GNn/lBi","24576:Nn/lBij","24576:n/lBij2","24576:/lBij2l","24576:lBij2l0","24576:Bij2l0/","24576:ij2l0/e","24576:j2l0/eG","24576:2l0/eGR","24576:l0/eGRY","24576:0/eGRYp","24576:/eGRYpy","24576:eGRYpyu","24576:GRYpyuD","24576:RYpyuD8","24576:YpyuD8I","24576:pyuD8Iy","24576:yuD8Iy/","24576:uD8Iy/J","24576:D8Iy/Je","24576:8Iy/Je/","24576:Iy/Je/X","24576:y/Je/XC","24576:/Je/XCG","24576:Je/XCGb","24576:e/XCGb3","24576:/XCGb3i","49152:jtzJTMC","49152:tzJTMCf","49152:zJTMCf4","49152:JTMCf4i","49152:TMCf4ih","49152:MCf4ihj","49152:Cf4ihjA","49152:f4ihjAh","49152:4ihjAhh","49152:ihjAhhO","49152:hjAhhOM","49152:jAhhOMc","49152:AhhOMcc","49152:hhOMccC","49152:hOMccCW","49152:OMccCWf","49152:MccCWfq","49152:ccCWfqo","49152:cCWfqoz","49152:CWfqoz+","49152:Wfqoz+t","49152:fqoz+tN","49152:qoz+tN0","49152:oz+tN04","49152:z+tN04s","49152:+tN04sG","49152:tN04sGN","49152:N04sGNn","49152:04sGNn/","49152:4sGNn/l","49152:sGNn/lB","49152:GNn/lBi","49152:Nn/lBij","49152:n/lBij2","49152:/lBij2l","49152:lBij2l0","49152:Bij2l0/","49152:ij2l0/e","49152:j2l0/eG","49152:2l0/eGR","49152:l0/eGRY","49152:0/eGRYp","49152:/eGRYpy","49152:eGRYpyu","49152:GRYpyuD","49152:RYpyuD8","49152:YpyuD8I","49152:pyuD8Iy","49152:yuD8Iy/","49152:uD8Iy/J","49152:D8Iy/Je","49152:8Iy/Je/","49152:Iy/Je/X","49152:y/Je/XC","49152:/Je/XCG","49152:Je/XCGb","49152:e/XCGb3","49152:/XCGb3i","24576:5zFj4iV","24576:zFj4iVA","24576:Fj4iVAh","24576:j4iVAhh","24576:4iVAhhH","24576:iVAhhHc","24576:VAhhHcc","24576:AhhHccN","24576:hhHccN0","24576:hHccN0N","24576:HccN0N0","24576:ccN0N04","24576:cN0N04s","24576:N0N04sG","24576:0N04sGt","24576:N04sGt/","24576:04sGt/l","24576:4sGt/lB","24576:sGt/lBi","24576:Gt/lBij","24576:t/lBij2","24576:j2l0/e4"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"Proforma Inv..exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1021952,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678866312000,"last_seen":1678866312000,"last_multi_scan":1678866312000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":3,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":15,"suspicious_count":10,"malicious_count":3,"total":28},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.IZP.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Found API related strings"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dotnet file contains pe file in dotnet resource"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains ability to provide interface for network protocols"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin has big resource with name: \"DH\" size: \"49152\" and abnormal entropy:\"6.68224406088\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed string:\"frombase64string\" [Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin]\n Observed string:\"frombase64string\" [Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp\n 00000000-00003548.00000000.67287.010E2000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\") in [Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin]\n \"Sleep\" (Indicator: \"Sleep\") in [Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin]\n \"Sleep\" (Indicator: \"Sleep\") in [Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp\n 00000000-00003548.00000000.67287.010E2000.00000020.mdmp]\n \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\") in [Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp\n 00000000-00003548.00000000.67287.010E2000.00000020.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\".Run\" [Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin]\n Observed keyword:\".Run\" [Source: 00000000-00003548.00000000.67280.010E2000.00000020.mdmp\n 00000000-00003548.00000000.67287.010E2000.00000020.mdmp]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 71af0000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 0\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 0\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 76020000\n \".exe\" loaded module \"%WINDIR%\\MICROSOFT.NET\\FRAMEWORK\\V4.0.30319\\MSCOREEI.DLL\" at base 6cda0000\n \".exe\" loaded module \"GDI32.DLL\" at base 756b0000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\IMM32.DLL\" at base 75630000\n \".exe\" loaded module \"KERNEL32\" at base 76180000\n \".exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE.DLL\" at base 6ce30000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 760D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e002203f16c@ADVAPI32.dll\"\n \"0d000e00fe02f16c@ADVAPI32.dll\"\n \"0b000c00cc02f16c@ADVAPI32.dll\"\n \"10001100da02f16c@ADVAPI32.dll\"\n \"150016002c7aeb6c@ADVAPI32.dll\"\n \"0e000f00a47aeb6c@ADVAPI32.dll\"\n \"0e000f00d87aeb6c@ADVAPI32.dll\"\n \"11001200387feb6c@ADVAPI32.dll\"\n \"11001200a47feb6c@ADVAPI32.dll\"\n \"12001300b87feb6c@ADVAPI32.dll\"\n \"12001300e07feb6c@ADVAPI32.dll\"\n \"14001500bc93eb6c@ADVAPI32.dll\"\n \"1b001c00381fda6c@api-ms-win-core-synch-l1-2-0.DLL\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin\" file has an entrypoint instructions - \"jmp\tdword ptr [0x402000],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,in\tal, dx,cmp\tedx, edi,inc\tbyte ptr [edx + 0x2e],out\t0x3f, al,add\tah, byte ptr [eax],sub\tbh, dl,or\tebp, dword ptr [ebx + 0x2cfa3ffc],xchg\teax, edx,jl\t0x4c8a34,insb\tbyte ptr es:[edi], dx,or\tdword ptr [eax - 0x37], eax,jns\t0x4c8ad7,cmp\tal, 0x64,adc\teax, dword ptr es:[eax - 0x36],add\tedi, ecx,cmp\tah, byte ptr [edi],push\tecx,sbb\tal, byte ptr [eax + 0x30],int3\t,sub\teax, 0x210ce1f3,inc\teax,or\teax, 0x8e82fcb7,xor\teax, 0xf7cf4025,cmpsd\tdword ptr [esi], dword ptr es:[edi],and\tdword ptr [ecx + 0x1540299a], ecx,dec\tebp,xchg\teax, ebp,nop\t,jne\t0x4c8af3,inc\teax,je\t0x4c8a4f,cmp\tbh, byte ptr [edi],xchg\teax, edi,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll\"\n \".exe\" touched file \"C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\".exe\" trying to access non-existent file \"C:\\Windows\\System32\\MSCOREE.DLL.LOCAL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\SYSTEM32\\MSCOREE.DLL.local\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace \"System.Net\" in \"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin\"\n Observed namespace \"System.Net.Sockets\" in \"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin\"\n Observed namespace \"System.Net.NetworkInformation\" in \"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"Sky123.Org\"\n Heuristic match: \")<%.Je\"\n Heuristic match: \")l.tt\"\n Heuristic match: \"ky123.Org\"\n Pattern match: \"www.meitu.com\"\n Heuristic match: \"|M.hR\"\n Heuristic match: \"HEXT=.CX\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.82758827923\n 0.0980041756627","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"25/69 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"7@x.26\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"System.Net.NetworkInformation.IPGlobalProperties::GetActiveUdpListeners() at 48ae937bd9a1d8629ddd149ea01b85d1-6000059-Form1~PortInUse","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"radarsystem.udpSocket::StructToBytes(System.Object,System.Int32) at 48ae937bd9a1d8629ddd149ea01b85d1-6000021-Form1~sendData\n System.Type::InvokeMember(System.String,System.Reflection.BindingFlags,System.Reflection.Binder,System.Object,System.Object[]) at 48ae937bd9a1d8629ddd149ea01b85d1-600005c-Form1~InitializeComponent\n System.Net.Sockets.UdpClient::Receive(System.Net.IPEndPoint&) at 48ae937bd9a1d8629ddd149ea01b85d1-6000058-Form1~ReceiveData\n System.Windows.Forms.Control::set_TabIndex(System.Int32) at 48ae937bd9a1d8629ddd149ea01b85d1-6000064-FrequencyForm~InitializeComponent\n System.Net.NetworkInformation.IPGlobalProperties::GetActiveUdpListeners() at 48ae937bd9a1d8629ddd149ea01b85d1-6000059-Form1~PortInUse","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"\n \"11.0.0.0\"\n \"127.0.0.1\"\n \"16.0.0.0\"\n \"7.0.0.1\"\n \"8.3.6.3\"\n Potential IP \"1.0.0.0\" found in string \"Microsoft.Windows.IsolationAutomation,processorArchitecture=\"x86\",publicKeyToken=\"6595b64144ccf1df\",type=\"win32\",version=\"1.0.0.0\"C:\\Windows\\WinSxS\\manifests\\x86_microsoft.windows.isolationautomation_6595b64144ccf1df_1.0.0.0_none_35d357a66c38ade4.manifest\"\n Potential IP \"1.0.0.0\" found in string \"MyApplication.app,version=\"1.0.0.0\"C:\\d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.exe\"\n \"27.0.0.1\"\n Potential IP \"1.0.0.0\" found in string \"\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Dotnet file contains pe file in dotnet resource","description":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin has PE file in resource with name: \"CH\" and filetype: \"PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-109","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"GetCurrentProcess\" (Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetPixel\" (Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin, API is part of module: GDI32.DLL)\n Found string \"QueueUserWorkItem\" (Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin, API is part of module: KERNEL32.DLL)\n Found string \"Rectangle\" (Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin, API is part of module: GDI32.DLL)\n Found string \"Sleep\" (Source: d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.bin, API is part of module: KERNELBASE.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"db4ded6c00000000\" to virtual address \"0x010E2000\" (part of module \"D7573C48DF121D2209F33F38CBBE52B37CA66F60584BF3161A1C2DF4C9E0A404.EXE\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"25/69 Antivirus vendors marked sample as malicious (36% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":21,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"64117e7eb1346ba8290aa51b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"UDS:Trojan.MSIL.Taskun","submit_name":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.exe","analysis_start_time":"2023-03-15T08:14:54+00:00","indicators_count":{"informative":15,"suspicious":11,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}],"processes":[{"pid":3548,"ppid":0,"name":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.exe","command_line":"","sha256":"d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404","normalized_path":"C:\\d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404.exe","uid":"00000000-00003548","icon":"$29"}],"all_imported_dlls":["usp10.dll","ws2_32.dll","fltLib.dll","kernel32.dll","oleaut32.dll","mscoree.dll","KernelBase.dll","advapi32.dll","imm32.dll","msctf.dll","msvcrt.dll","rpcrt4.dll","gdi32.dll","lpk.dll","ole32.dll","mscoreei.dll","ntdll.dll","nsi.dll","api-ms-win-core-synch-l1-2-0.dll","sechost.dll","user32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64117e7eb1346ba8290aa51b"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64117e7eb1346ba8290aa51b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample d7573c48df12… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d7573c48df12…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample d7573c48df12… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d7573c48df12…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d7573c48df121d2209f33f38cbbe52b37ca66f60584bf3161a1c2df4c9e0a404"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample d7573c48df12… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d7573c48df12…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 3/28 AV engines flagged this file. 3 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2a","11",{}]]