23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T48e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious BKDR_AN.FE26C9FB Sample d9c8dab2efb3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d9c8dab2efb3…. Malware family: BKDR_AN.FE26C9FB. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11","keywords":["Malicious","BKDR_AN.FE26C9FB","malware analysis","sandbox report","threat intelligence","d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11"],"about":{"@type":"SoftwareApplication","name":"splayer.bin","applicationCategory":["peexe","executable"],"identifier":"d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"BKDR_AN.FE26C9FB","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T442,"" touched file "%WINDIR%\system32\en-US\odbcint.dll.mui" "" touched file "%WINDIR%\system32\en-US\MFC42.DLL.mui" "" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "" touched file "%WINDIR%\EXPlorer.EXE....\" "" touched file "%WINDIR%\explorer.exe\" "" touched file "%WINDIR%\system32\c_1252.nls" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db" "adprtext.exe" touched file "%WINDIR%\system32\en-US\odbcint.dll.mui" "adprtext.exe" touched file "%WINDIR%\system32\en-US\MFC42.DLL.mui" "adprtext.exe" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "adprtext.exe" touched file "%WINDIR%\EXPlorer.EXE....\" "adprtext.exe" touched file "%WINDIR%\explorer.exe\" "adprtext.exe" touched file "%WINDIR%\system32\c_1252.nls"25:T618,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQlSURBVFhH1ZbXaxRRGMW3ZdMUe8EgdlBJAipiJQqCGrEgvkR98UFQfPLFP0AfBIkIgojYC3YMWBIsxCCioKJoULEl9t5iB1Gvv5PcSe6OY9zdRMHA4c5sZu453/nKnVDof/wbH42aqRkxMzwSMf9M/+RY1ORDWACGIyA/GjH9ue4ZDpte4ZDpy4qY1hU0EdKRkK3KyTZb2+QmYEtujtmdnWX2Z2aaQ7hxGEzj2RxE9GwNIcWxmJkTzzCbIPKT634L2IWAfVkSkGEqeP4kjuxGRCYCujaISM+RKWy2AWJFGUQuURvBTpzZi4CDCC3nncpI2JwiFech3st1FmuXVEVMwvbNltwVINKZRDq4ofDq0RmyYUS8BgFHSIEr4CL/H8L/Y6k4MYbNvMhFLqwmykjTJo3kngh3ncX7J4hcDlwCV8E+BGcn60Kpr9iWkuMOVLiPLLDzwlZkAQIuOAJucK0A/ihC0bv5VuUnQ+xTU1+AwxBxDuHXuL5pXXD2+jWAsZDPy4w3CpD1hfR5sy81M4GikM7H+uust8B1asE6ENwVE6hgN/p+TqGlOelMG4jL2eca5AVNQypYwEInegnx8pl2H/NiO5v7TonkwQLWOf0u+9O1PsAt0xEh40A+GAD6+DtiFDZpqnkpWNu6AkLTcWAJ9VRGYRZyneufC0WqfmfwrMhurP400x8KlUA0ElRB+gDCZ+AleAeKCdimuGH/UajbQcttB9tAKb3fktzPgLgEkipwH8KH4Dl4Dd6D1X4B/XlhK/Nch4rm+p4mASkdJAvYZxvBaPrdAbXgEXhqyd+yfrIifqmxlfG4KQMH6AZBD9jxm3QaVGjqe02+GnAPPLHRv7H2f2H9amsgIQ0jqIMKDqFyDhRhELlzWjEpET3YWENH0Yt8B1Yr969s1B8t+XfWXv65oMrcwzA6hhBhGWJSbcVu7LEc0tNsPpW1PfcqPEX/ASgF38APMNc/6DrzY3dm9ykHOsUy+L1tg2VJ/ck1nQVFvKviq7PRH+R+LMJELjzGYT2XUOxy4YzFWVahSyjgwT9IGc97VyFT1avtZP1Q7vXt4AmQE3mI8Hdb/YdlFdBZrg8KrRXcywn7ZfNbN+bw3GLSdxcXZbfIP4Oj1m4dULqu47kxvzsbRFSEsiusQrXFel4cAfK4HwxKbFoWsRZDONr2/gvu3cgv87tSq0g9y51JGDhv6o9N5essUEsJqu7bQO2lKq+WS6AWqNVErGr3cq52q0wsNM+55L4xVEy92VwfEyIUsQaL2subbo+5Vpt5Uct2TToNm1LI9Xmeaie55dX4ManTrIINNdMVrSabSL0WE7Ha7CVWTyF98UTipDsosLbd74KBiFAtVOJMDbgLlIrjYDa/d0ssrJYRB53rjp3Nfhm35CBLatg4D7Xo1EyV7K89/xPgJuvFFkK8jQAAAABJRU5ErkJggg==26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGZkRAAAAAAAAAAAAAAABmZmZmZEAAAAAAAAAAAAJmZmZmZmZkQAAAAAAAAAAmZmZmZmZmZkQAAAAAAAACZmRAAEBEBmZmQAAAAAAABmZEAAAAAARmZkQAZAAAAmZkAAAAAAAAAmZkAmZAAAJmRAAAAAAAAAAmZEJmQAAEREAAAAAAAABkQmZmZEAABEQAAAAAAAACZkZmZmQAAEREAAAAAAAAAmZmZmZkAABERAAAAAAAAARmZmZmZAAAREQAAAAAAAAABEZmZkQAAEREAAAAAAAAAABAZmZEAABERAAAAAAAAAAAAAREAAAAREQAAAAAAAAAAAAAAAAAAEREAAAAAAAAAAAAAAAAAABERAAAAAAAAAAAAGQAAAAABERAAAAAAAAAAAZmQAAAAABERAAAAAAAAAAmZEAAAAAARERAAAAAAAACZmQAAAAAAARERAAAAAAARmZEAAAAAAAEREREQAAARGZkAAAAAAAAAERERERERERmRAAAAAAAAAAERERERERERAAAAAAAAAAAAEBEREREREAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////z///+AB//+AAP/+AAA//gAAH/gAAAh4AIAAMAPwADAP/AAgH/gAID/wACA/8AAgf/AAQH/wAED//ADA//4AwH//wOB//4HgP/8D4D/+A+Af/gPwD/gD+APwB/gAAA/8AAAP/gAAH/8AAD//gAD///AD///+P///////w==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABGZkRAAAAAAAAAAAAAAABmZmZmZEAAAAAAAAAAAAJmZmZmZmZkQAAAAAAAAAAmZmZmZmZmZkQAAAAAAAACZmRAAEBEBmZmQAAAAAAABmZEAAAAAARmZkQAZAAAAmZkAAAAAAAAAmZkAmZAAAJmRAAAAAAAAAAmZEJmQAAEREAAAAAAAABkQmZmZEAABEQAAAAAAAACZkZmZmQAAEREAAAAAAAAAmZmZmZkAABERAAAAAAAAARmZmZmZAAAREQAAAAAAAAABEZmZkQAAEREAAAAAAAAAABAZmZEAABERAAAAAAAAAAAAAREAAAAREQAAAAAAAAAAAAAAAAAAEREAAAAAAAAAAAAAAAAAABERAAAAAAAAAAAAGQAAAAABERAAAAAAAAAAAZmQAAAAABERAAAAAAAAAAmZEAAAAAARERAAAAAAAACZmQAAAAAAARERAAAAAAARmZEAAAAAAAEREREQAAARGZkAAAAAAAAAERERERERERmRAAAAAAAAAAERERERERERAAAAAAAAAAAAEBEREREREAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////z///+AB//+AAP/+AAA//gAAH/gAAAh4AIAAMAPwADAP/AAgH/gAID/wACA/8AAgf/AAQH/wAED//ADA//4AwH//wOB//4HgP/8D4D/+A+Af/gPwD/gD+APwB/gAAA/8AAAP/gAAH/8AAD//gAD///AD///+P///////w==2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAABmZmZgAAAAAAZmZmYAAAAGeIiIZgAAAAAGiIiGYAB3d3iIiHd3d3d3dod3hnd3iPiIiIh4iIiIiIaIiIa7t4+IiIiIeIiIiIu2iIiGu7ePiIiIiHiIiIiIhoiIh7u3j4iIiIiId3d3d2eIiIiLt4+IiIiIiIiIiIiIiIj4i7ePiIiP/4iIiIiIiIiI+Iu3j4+P//+IiIiIiIiIiPiLh4+Pj////////4iIiIj4i4eP/4///4iIiIiIiIj/iIiHj//4iI+IiIh3d3d3d4iIh4/////4+IiIiIiIiIiIiIeP////iI+IiIiIiIiIiIiHj/////iI+IiIiIiIiIiIh4//////iIiIiIiIiIiIiIeP//////+IiIiIiIiIiIiHj///////+IiIiIiIiIiIh4/////////4j///////iIeP//////////+IiIiHd3eHiP/////////4iIiIiIiIh4iIiIiIiIiIiIjub///iIeIiIiIiIiIiIiI7u///4iHiIiIiIiImZ//iIh3d3d3dwiIiIiIiJmf///4iIiIiHAIiKov/4iIiIiId3d3d3dwCIiqr///+Ih3AAAAAAAAAACIiIiIiIiHcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADwH/gP4A/4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAGAAD//wAB//////////////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790430278110,"unified_at":"2026-09-26T13:44:38.110Z","metadata":{"hashes":{"sha256":"d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11","sha1":"bc1c8a5e38d7c46f8e15f85449fd4f52a75e6c2b","md5":"7aea2b07f8f5e00bee146eebf90e4f84","sha512":"0b7dfb622f9c9833bd52ee2260b6d00f303e1a63265cf700f4c1714a4b60312c3558f6d1efbe34c0dde83c51d4f6b5cd4957eb2ed03c3e6c4e6bb3623029231d","ssdeep":"3072:sh9f163N9uIqhwnR4mClKpUGMveVPAF1Okq7mMHucE+xrAA+AvQ01O5moBglax+I:DudwnmmSXGMszNCM/VAA9Q013oelzHo","ssdeep_chunks":["3072:sh9f163","3072:h9f163N","3072:9f163N9","3072:f163N9u","3072:163N9uI","3072:63N9uIq","3072:3N9uIqh","3072:N9uIqhw","3072:9uIqhwn","3072:uIqhwnR","3072:IqhwnR4","3072:qhwnR4m","3072:hwnR4mC","3072:wnR4mCl","3072:nR4mClK","3072:R4mClKp","3072:4mClKpU","3072:mClKpUG","3072:ClKpUGM","3072:lKpUGMv","3072:KpUGMve","3072:pUGMveV","3072:UGMveVP","3072:GMveVPA","3072:MveVPAF","3072:veVPAF1","3072:eVPAF1O","3072:VPAF1Ok","3072:PAF1Okq","3072:AF1Okq7","3072:F1Okq7m","3072:1Okq7mM","3072:Okq7mMH","3072:kq7mMHu","3072:q7mMHuc","3072:7mMHucE","3072:mMHucE+","3072:MHucE+x","3072:HucE+xr","3072:ucE+xrA","3072:cE+xrAA","3072:E+xrAA+","3072:+xrAA+A","3072:xrAA+Av","3072:rAA+AvQ","3072:AA+AvQ0","3072:A+AvQ01","3072:+AvQ01O","3072:AvQ01O5","3072:vQ01O5m","3072:Q01O5mo","3072:01O5moB","3072:1O5moBg","3072:O5moBgl","3072:5moBgla","3072:moBglax","3072:oBglax+","3072:Bglax+I","6144:sh9f163","6144:h9f163N","6144:9f163N9","6144:f163N9u","6144:163N9uI","6144:63N9uIq","6144:3N9uIqh","6144:N9uIqhw","6144:9uIqhwn","6144:uIqhwnR","6144:IqhwnR4","6144:qhwnR4m","6144:hwnR4mC","6144:wnR4mCl","6144:nR4mClK","6144:R4mClKp","6144:4mClKpU","6144:mClKpUG","6144:ClKpUGM","6144:lKpUGMv","6144:KpUGMve","6144:pUGMveV","6144:UGMveVP","6144:GMveVPA","6144:MveVPAF","6144:veVPAF1","6144:eVPAF1O","6144:VPAF1Ok","6144:PAF1Okq","6144:AF1Okq7","6144:F1Okq7m","6144:1Okq7mM","6144:Okq7mMH","6144:kq7mMHu","6144:q7mMHuc","6144:7mMHucE","6144:mMHucE+","6144:MHucE+x","6144:HucE+xr","6144:ucE+xrA","6144:cE+xrAA","6144:E+xrAA+","6144:+xrAA+A","6144:xrAA+Av","6144:rAA+AvQ","6144:AA+AvQ0","6144:A+AvQ01","6144:+AvQ01O","6144:AvQ01O5","6144:vQ01O5m","6144:Q01O5mo","6144:01O5moB","6144:1O5moBg","6144:O5moBgl","6144:5moBgla","6144:moBglax","6144:oBglax+","6144:Bglax+I","3072:Dudwnmm","3072:udwnmmS","3072:dwnmmSX","3072:wnmmSXG","3072:nmmSXGM","3072:mmSXGMs","3072:mSXGMsz","3072:SXGMszN","3072:XGMszNC","3072:GMszNCM","3072:MszNCM/","3072:szNCM/V","3072:zNCM/VA","3072:NCM/VAA","3072:CM/VAA9","3072:M/VAA9Q","3072:/VAA9Q0","3072:VAA9Q01","3072:AA9Q013","3072:A9Q013o","3072:9Q013oe","3072:Q013oel","3072:013oelz","3072:13oelzH","3072:3oelzHo"],"imphash":"03051e7ceb9b549db23c4848b4a74e95"},"file_info":{"file_name":"splayer.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":286840,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499292114000,"last_seen":1679581030000,"last_multi_scan":1679581030000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":13,"malicious_count":6,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Nymaim","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.Fareit","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1341157","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.78496","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Drivedos-6042667-2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.XYPD-1812","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Johnnie.78496 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.DETI trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HEUR:VirTool/Obfuscator.gen!C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0051d65b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Androm.kois","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FJJU!7AEA2B07F8F5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.elhoyo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Zbot-UM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_AN.FE26C9FB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_AN.FE26C9FB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"SScope.Malware-Cryptor.Hlux","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Backdoor.Androm.Win32.36466","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"BKDR_AN.FE26C9FB","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00027948-00002680-15112-34-002015EF","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"antarcticped.top\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"G:\\vc\\BroadcastSvr\\Release\\BroadcastSvr.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\356E\\2C37.bat\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{0382CED2-86BF-2D11-A8E7-1AB15C0BEE75}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{B92517C0-C493-538C-96FD-38372A81EC5B}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"\" on 2016-9-7.00:16:00.170\n \"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"\" on 2016-9-7.00:18:00.741","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"\" (UID: 00026703-00003496)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"\" (UID: 00027499-00003376)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"\" (UID: 00027757-00002504)\n Spawned process \"adprtext.exe\" with commandline \"\"C:\\D9C8DA~1.EXE\"\" (UID: 00027948-00002680)\n Spawned process \"adprtext.exe\" with commandline \"\"C:\\D9C8DA~1.EXE\"\" (UID: 00028521-00003144)\n Spawned process \"explorer.exe\" with commandline \"%WINDIR%\\Explorer.EXE\" (UID: 00028969-00001928)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"82B1.bin\" has type \"ASCII text with CRLF line terminators\"\n \"prefs.js\" has type \"ASCII text with very long lines with CRLF line terminators\"\n \"d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.exe\" has type \"empty \"\n \"adprtext.exe\" has type \"empty \"\n \"{93F8BFCC-D624-3D16-7877-6AC12C9B3E85}\" has type \"empty \"\n \"2C37.bat\" has type \"ASCII text with CRLF line terminators\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$24","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.93233936111","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"adprtext.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"adprtext.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"API-GSVC\"; Value: \"%APPDATA%\\cmdisvc6\\adprtext.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" marked \"C:\\D9C8DA~1.EXE\" for deletion","origin":"API Call","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"adprtext.exe\" opened \"C:\\D9C8DA~1.EXE\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"explorer.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegEnumKeyW\n CreateFileA\n CreateFileW\n GetModuleFileNameW\n GetModuleHandleA\n GetStartupInfoA\n FindWindowW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"40532a7758582b77186a2b77653c2c770000000000bffb750000000056ccfb75000000007ccafb7500000000376867756a2c2c77d62d2c7700000000206967750000000029a6fb7500000000a48d677500000000f70efb7500000000\" to virtual address \"0x773E1000\" (part of module \"NSI.DLL\")\n \"adprtext.exe\" wrote bytes \"40532a7758582b77186a2b77653c2c770000000000bffb750000000056ccfb75000000007ccafb7500000000376867756a2c2c77d62d2c7700000000206967750000000029a6fb7500000000a48d677500000000f70efb7500000000\" to virtual address \"0x773E1000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/58 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/58 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00028969-00001928)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 4096 bytes starting with PE header signature to file \"%APPDATA%\\cmdisvc6\\adprtext.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f00000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"malicious","category":"System Security","name":"Disables SPDY-connections","description":"\"explorer.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"ENABLESPDY3_0\"; Value: \"00000000\")","origin":"Registry Access","relevance":5,"id":"registry-41","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00025899-00003480)\n Spawned process \"\" (UID: 00026703-00003496)\n Spawned process \"cmd.exe\" with commandline \"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"\" (UID: 00027499-00003376)\n Spawned process \"cmd.exe\" with commandline \"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"\" (UID: 00027757-00002504)\n Spawned process \"adprtext.exe\" with commandline \"\"C:\\D9C8DA~1.EXE\"\" (UID: 00027948-00002680)\n Spawned process \"adprtext.exe\" with commandline \"\"C:\\D9C8DA~1.EXE\"\" (UID: 00028521-00003144)\n Spawned process \"explorer.exe\" with commandline \"%WINDIR%\\Explorer.EXE\" (UID: 00028969-00001928)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Injects into explorer"}],"sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":13,"imported_dlls_count":55,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":27,"files_deleted_count":0,"registry_keys_created_count":22,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":22,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"57cfb794aac2edb5362f7ae2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","submit_name":"splayer.bin","analysis_start_time":"2016-09-07T08:46:25+00:00","indicators_count":{"informative":11,"suspicious":17,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"antarcticped.top","country":"-","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}],"processes":[{"pid":3480,"ppid":0,"name":"d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.exe","command_line":"","normalized_path":"C:\\d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.exe","uid":"00025899-00003480","icon":"$25"},{"pid":3496,"ppid":3480,"name":"d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.exe","command_line":"","normalized_path":"C:\\d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.exe","parent_uid":"00025899-00003480","uid":"00026703-00003496"},{"pid":3376,"ppid":3496,"name":"cmd.exe","command_line":"cmd /c \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00026703-00003496","uid":"00027499-00003376","icon":"$26"},{"pid":2504,"ppid":3376,"name":"cmd.exe","command_line":"cmd /C \"\"%APPDATA%\\cmdisvc6\\adprtext.exe\" \"C:\\D9C8DA~1.EXE\"\"","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00027499-00003376","uid":"00027757-00002504","icon":"$27"},{"pid":2680,"ppid":2504,"name":"adprtext.exe","command_line":"\"C:\\D9C8DA~1.EXE\"","normalized_path":"%APPDATA%\\cmdisvc6\\adprtext.exe","parent_uid":"00027757-00002504","uid":"00027948-00002680","icon":"$28"},{"pid":3144,"ppid":2680,"name":"adprtext.exe","command_line":"\"C:\\D9C8DA~1.EXE\"","normalized_path":"%APPDATA%\\cmdisvc6\\adprtext.exe","parent_uid":"00027948-00002680","uid":"00028521-00003144","icon":"$29"},{"pid":1928,"ppid":3144,"name":"explorer.exe","command_line":"%WINDIR%\\Explorer.EXE","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00028521-00003144","uid":"00028969-00001928","icon":"$2a"}],"all_imported_dlls":["iertutil.dll","sspicli.dll","setupapi.dll","devobj.dll","mfc42.dll","msvcrt.dll","ws2_32.dll","rasadhlp.dll","winrnr.dll","gdi32.dll","oleaut32.dll","imm32.dll","urlmon.dll","cfgmgr32.dll","WSHTCPIP.DLL","rasman.dll","SensApi.dll","kernel32.dll","KernelBase.dll","usp10.dll","shell32.dll","psapi.dll","ntmarta.dll","Wldap32.dll","crypt32.dll","odbcint.dll","cryptbase.dll","profapi.dll","wininet.dll","winbrand.dll","rasapi32.dll","rtutils.dll","pnrpnsp.dll","sechost.dll","shlwapi.dll","dnsapi.dll","NapiNSP.dll","wship6.dll","user32.dll","odbc32.dll","rpcss.dll","propsys.dll","mswsock.dll","advapi32.dll","ntdll.dll","lpk.dll","ole32.dll","nsi.dll","apphelp.dll","comctl32.dll","msasn1.dll","rpcrt4.dll","msctf.dll","uxtheme.dll","clbcatq.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"82B1.bin","sha256":"f3e9730a462ddd3866bc09dc0c746bf15273caaeb03beb73b8b218ee74ed5eb4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"prefs.js","sha256":"a9c68b0c90c703bb7b619a6f63a481dbe7d6323d8937749d8bcb692d86ab04a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"2C37.bat","sha256":"6d0a011b67ce773abe2171a01dd0a9deb7433bf1bde153980a5a3db398ebb8bc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}],"files_written":[{"path":"C:\\d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.ex_","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"C:\\d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11.exe","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%TEMP%\\356E\\2C37.tmp","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42.DLL.mui","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%APPDATA%\\cmdisvc6\\adprtext.ex_","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%LOCALAPPDATA%\\CSIDL_","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%LOCALAPPDATA%\\CSIDL_X","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%TEMP%\\356E\\2C37.bat","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%WINDIR%\\system32\\c_1252.nls","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%APPDATA%\\cmdisvc6","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%WINDIR%\\SYSTEM32\\ntdll.dll","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%APPDATA%\\cmdisvc6\\adprtext.exe","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\prefs.js","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%APPDATA%\\Microsoft\\{765CEAE2-5DA9-189B-970A-E1CCBBDEA5C0}","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"pipe\\{93F8BFCC-D624-3D16-7877-6AC12C9B3E85}","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%TEMP%\\82B1.bin","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Themes\\slideshow.ini","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\1BF08513-BEE6-055F-A07F-D209D423264D\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\APPDATALOW\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3G2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GP2\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.3GPP\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AAC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADT\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ADTS\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFC\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AIFF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASF\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.ASX\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AU3\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\FILEEXTS\\.AVI\\OPENWITHPROGIDS\\","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{0382CED2-86BF-2D11-A8E7-1AB15C0BEE75}","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{B92517C0-C493-538C-96FD-38372A81EC5B}","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{4711FF31-FA1D-1115-3C6B-CED530CFE2D9}","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\{1F360C78-F20C-A907-F4C3-46ED68A7DA71}","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"57cfb794aac2edb5362f7ae2"}]}]}},"report_ids":{"sandbox_job_ids":["57cfb794aac2edb5362f7ae2"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious BKDR_AN.FE26C9FB Sample d9c8dab2efb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d9c8dab2efb3…. Malware family: BKDR_AN.FE26C9FB. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11"}],["$","meta","4",{"property":"og:title","content":"Malicious BKDR_AN.FE26C9FB Sample d9c8dab2efb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d9c8dab2efb3…. Malware family: BKDR_AN.FE26C9FB. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d9c8dab2efb3cf1f19a02d2b4d4bac49885cc3e213d35738baff12d10ab62d11"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious BKDR_AN.FE26C9FB Sample d9c8dab2efb3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d9c8dab2efb3…. Malware family: BKDR_AN.FE26C9FB. Threat score 100/100. 20/28 AV engines flagged this file. 6 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]