26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample d81b8e2085c7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d81b8e2085c7…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 6/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c"],"about":{"@type":"SoftwareApplication","name":"d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c","applicationCategory":["peexe","64bits","executable"],"identifier":"d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":6,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tdb2,Found string "Enter the passwords for the following identifiers to export the apppliance: " (Indicator: "password"; Source: "sample.bin"), Found string " passwordhash Generates a password hash. " (Indicator: "password"; Source: "sample.bin"), Found string "checkmediumpwd command checks the current encryption password on a DEK-encrypted medium or a disk image. See section 9.29.2 "Encrypting Disk Images" of the user manual." (Indicator: "password"; Source: "sample.bin"), Found string "showvminfo <--log=index> [--password-id" (Indicator: "password"; Source: "sample.bin"), Found string " Specifies a new password identifier that is used for correct identification when supplying multiple passwords during VM startup." (Indicator: "password"; Source: "sample.bin"), Found string " --password" (Indicator: "password"; Source: "sample.bin"), Found string "--oldpassword=$HOME/pwfile.orig" (Indicator: "password"; Source: "sample.bin"), Found string " Only the iSCSI secret is encrypted at this time." (Indicator: "secret"; Source: "sample.bin"), Found string " - Change the password of the encrypted image by using the --newpassword option." (Indicator: "password"; Source: "sample.bin"), Found string "guestcontrol mktemp [--directory] [--domain=domainname] [--mode=mode] [--passwordfile=password-file | --password=password] [--quiet] [--secure] [--tmpdir=directory-name] [--username=username] [--verbose] " (Indicator: "password"; Source: "sample.bin"), Found string "Failed to read old password from file" (Indicator: "password"; Source: "sample.bin"), Found string "id] [--password" (Indicator: "password"; Source: "sample.bin"), Found string "--passwordfile" (Indicator: "password"; Source: "sample.bin"), Found string "password to hash required" (Indicator: "password"; Source: "sample.bin"), Found string "A new password must always have a valid identifier set at the same time" (Indicator: "password"; Source: "sample.bin"), Found string "Failed to read password from file" (Indicator: "password"; Source: "sample.bin"), Found string "encryptmedium command enables you to create and manage a DEK-encrypted medium or image. You can encrypt an image, decrypt an image, and change the encryption password of an image. See section 9.29.2 "Encrypting Disk Images" of the user manual." (Indicator: "password"; Source: "sample.bin"), Found string "addencpassword" (Indicator: "password"; Source: "sample.bin"), Found string "--newpasswordid" (Indicator: "password"; Source: "sample.bin"), Found string "VBoxManage checkmediumpwd -- Check encryption password on a DEK-encrypted medium or a disk image." (Indicator: "password"; Source: "sample.bin"), Found string " The settings password is a security feature that encrypts stored settings, which are stored as plain text by default." (Indicator: "password"; Source: "sample.bin"), Found string " VBoxManage [-V | --version] [--dump-build-type] [-q | --nologo] [--settingspw=password] [--settingspwfile=pw-file] [@response-file] [[help] subcommand]" (Indicator: "password"; Source: "sample.bin"), Found string " --password-id" (Indicator: "password"; Source: "sample.bin"), Found string " The following example checks the encryption password for the ol7u4-1.vdi disk image. The password is contained in a file called pwfile." (Indicator: "password"; Source: "sample.bin"), file/memory contains long string with (Indicator: "password"; Source: "sample.bin")28:T442,Found reference to API " - tcpserver creates a TCP socket with the specified TCP port on the host system and connects the virtual serial device to it." (Indicator: " socket "; Source: "sample.bin"), Found reference to API " - Note that the named pipe or local domain socket must already exist." (Indicator: " socket "; Source: "sample.bin"), Found reference to API " - swtpm The VM connects to an external TPM emulation compliant to swtpm. Requires to set the TPM location to connect to (see --tpm-location option)." (Indicator: " connect "; Source: "sample.bin"), Found reference to API " - Use this mode to connect a physical serial port to a VM." (Indicator: " connect "; Source: "sample.bin"), Found reference to API " - Note that the TCP socket must already exist." (Indicator: " socket "; Source: "sample.bin"), Found reference to API " - server creates the specified named pipe or local domain socket on the host system and connects the virtual serial device to it." (Indicator: " socket "; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793182705618,"unified_at":"2026-10-28T10:18:25.618Z","metadata":{"hashes":{"sha256":"d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c","sha1":"7d17e5da8cf48a16e5f8bbfe988a10909a89734f","md5":"9f20267354a2e62591c2c765abc4eec2"},"file_info":{"file_name":"d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2463744,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793182698000,"last_seen":1793182698000,"last_multi_scan":1793182698000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":17,"suspicious_count":2,"malicious_count":2,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/Expiro.EQ virus","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"W64/Moiva-G","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Expiro.HT.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Securityd Memory","attack_id":"T1555.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/002","identifiers":[{"type":"informative","value":"Able to retrieve credentials from memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Contains ability to use Webdav for network"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Found system command-related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with low confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-18","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$27","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"run command executes the ipconfig command on the My Win VM Windows VM as the user1 user. Standard input, standard output, and standard error are redirected from the VM to the host system until the program completes.\" (Indicator: \"ipconfig\"; Source: \"sample.bin\"), Found string \"ipconfig command configures a host-only interface.\" (Indicator: \"ipconfig\"; Source: \"sample.bin\"), Found string \"ipconfig [--dhcp | --ip=IPv4-address --netmask=IPv4-netmask | --ipv6=IPv6-address --netmasklengthv6=length]\" (Indicator: \"ipconfig\"; Source: \"sample.bin\"), Found string \"ipconfig\" (Indicator: \"ipconfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-126","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve credentials from memory","description":"Found string \"modifyvm [--guest-debug-provider= none | native | gdb | kd ] [--guest-debug-io-provider= none | tcp | udp | ipc ] [--guest-debug-address= IP-Address | path ] [--guest-debug-port=port]\" (Indicator: \"gdb \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555.002","id":"string-5073","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \" The following example shows how to encrypt the ol7u4-1.vdi image by using the AES-XTS128-PLAIN64 cipher, specifying a password identifier of 1001, and using the $HOME/pwfile password file:\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \" Specifies the cipher to use for encryption. Valid values are AES-XTS128-PLAIN64 or AES-XTS256-PLAIN64.\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"--cipher=\"AES-XTS128-PLAIN64\"\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"Base64 encoding of the property %s failed. (%Rhrc)\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \" Specifies the cipher to use for encryption. Valid values are AES-128 or AES-256.\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"SetProperty(Bstr(pszKey).raw(), bstrBase64Value.raw())\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.virtualbox.org/wiki/vboxlogging\", Pattern match: \"http://myproxy.com:8080\", Pattern match: \"virtualbox.app/contents/macos/vboxmanage\", Pattern match: \"https://www.virtualbox.org/\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"10.0.2.18\", Potential IP \"10.0.2.2\" found in string \" Specifies whether the NAT engine allows traffic from the guest directed to 10.0.2.2 to pass to the host's loopback interface, i.e. localhost or 127.0.0.1.\", \"10.0.1.16\", Potential IP \"192.168.15.0\" found in string \"\"192.168.15.0/24\"\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$28","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"ipconfig command configures a host-only interface.\" (Indicator: \"ipconfig \"; Source: \"sample.bin\"), Found string \"ipconfig [--dhcp | --ip=IPv4-address --netmask=IPv4-netmask | --ipv6=IPv6-address --netmasklengthv6=length]\" (Indicator: \"ipconfig \"; Source: \"sample.bin\"), Found string \"ipconfig\" (Indicator: \"ipconfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1016","id":"string-325","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to use Webdav for network","description":"Found string \"webdav://\" (Indicator: \"webdav\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071.001","id":"string-476","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://www.virtualbox.org\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512\" (Indicator: \"SHA512\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"--host\" (Indicator: \"--host\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"--host\"; Source: \"sample.bin\"), Found string \" --host-only-adapter=none\" (Indicator: \"--host\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1219","id":"string-883","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set command enables you to set a medium property.\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set

[property-value [--flags=flags] ]\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set command modifies the bandwidth limit for a bandwidth group.\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"Set new location of medium with UUID %s finished\n\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set a keyword value that is associated with a virtual machine or configuration\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set %s=%ls\n\" (Indicator: \"set \"; Source: \"sample.bin\"), Found string \"set command enables you to set a guest property by specifying the property and its value. If you omit the value, the property is deleted.\" (Indicator: \"set \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-326","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"No signing private key (--private-key=) was specified!\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"Encountered a problem when validating the signature we just created: %Rrc%#RTeim\nPlease make sure the certificate and private key matches.\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"Successfully read the certificate and private key.\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"Error reading the private key from %s: %Rrc%#RTeim\" (Indicator: \"private key\"; Source: \"sample.bin\"), Found string \"The specified private key file was not found: %s\" (Indicator: \"private key\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1486","id":"string-280","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\" Specifies the absolute path of a file to copy from the host system. For example, C:\\Windows\\System32\\calc.exe. You can use wildcards to specify multiple files. For example, C:\\Windows\\System*\\*.dll.\" [Source: sample.bin], Observed system executable string:\" Specifies the absolute path of one or more files to copy from the guest VM. For example, C:\\Windows\\System32\\calc.exe. You can use wildcards to specify multiple files. For example, C:\\Windows\\System*\\*.dll.\" [Source: sample.bin]","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-625","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\" Specifies the absolute path of a file to copy from the host system. For example, C:\\Windows\\System32\\calc.exe. You can use wildcards to specify multiple files. For example, C:\\Windows\\System*\\*.dll.\" [Source: sample.bin], Observed system executable string:\" Specifies the absolute path of one or more files to copy from the guest VM. For example, C:\\Windows\\System32\\calc.exe. You can use wildcards to specify multiple files. For example, C:\\Windows\\System*\\*.dll.\" [Source: sample.bin], Observed system executable string:\" Specifies the absolute path of the executable program to run on the guest VM. For example: C:\\Windows\\System32\\calc.exe.\" [Source: sample.bin]","origin":"sample.bin","id":"string-170","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - - On a Windows host system, is a named pipe that has a name that uses the following form: \\\\.\\pipe\\.","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-146","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"Process monitor loop timed out\n\" (Indicator: \"process monitor\"; Source: \"sample.bin\"), Found string \"Process monitor loop quit with vrc=%Rrc\n\" (Indicator: \"process monitor\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample d81b8e2085c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d81b8e2085c7…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 6/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample d81b8e2085c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d81b8e2085c7…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 6/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d81b8e2085c79d49637704aa19729d4eadecb8c3b8f757a042779e0dc3858c4c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample d81b8e2085c7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d81b8e2085c7…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 6/24 AV engines flagged this file. 2 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]