26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T4d2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojanransom.Generic Sample da2eecf561bf… — Score 93/100 — Hybrid Analysis","description":"Malicious verdict for sample da2eecf561bf…. Malware family: Trojanransom.Generic. Threat score 93/100. 19/29 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df","keywords":["Malicious","Trojanransom.Generic","malware analysis","sandbox report","threat intelligence","da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df"],"about":{"@type":"SoftwareApplication","name":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin","applicationCategory":["peexe","executable"],"identifier":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df","additionalType":"Malicious sample"},"threatScore":93,"malwareFamily":"Trojanransom.Generic","antivirusDetections":{"malicious":19,"total":29},"behavioralIndicators":{"malicious":5,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T634,"" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\IDTemplates\DEU\AdobeID.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\IDTemplates\DEU\DefaultID.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\IDTemplates\ENU\AdobeID.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\IDTemplates\ENU\DefaultID.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\PDFSigQFormalRep.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\Dynamic.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\SignHere.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\DEU\StandardBusiness.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\Dynamic.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Reader\plug_ins\Annotations\Stamps\Words.pdf" with delete access "" opened "%PROGRAMFILES%\Adobe\Reader 11.0\Resource\ENUtxt.pdf" with delete access28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//93d3d3d3d3d3d3d3d3////d3d3d3d3d3d3d3d3d////3f//////////////3f///93//////////////93////iP//////////////d////4j//////////////3f///93/wAAAAAA//////93////d/8AAAAAAP//////d////3f//////////////3f///93//////////////93////iP8AAAAAAAAAAAD/d////4j/AAAAAAAAAAAA/3f///93//////////////93////d///////////////d////4j/AAAAAAAAAP///3f///+I/wAAAAAAAAD///93////d///////////////d////3f//////////////3f///93/wAAAAAA//////93////d/8AAAAAAP//////d////4j//////////////3f///+I//////////////93////d/8AAAAAAAAAAAD/d////3f/AAAAAAAAAAAA/3f///93//////////////93////d///////////////d////3f/AAAAAAAAAP///3f///93/wAAAAAAAAD///93////d///////////////d////3f//////////////3f///93d3d3d3d3d3d3d3d3////d3d3d3d3d3d3d3d3d//wAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAA/AAAAPwAAAD8AAAAw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":93,"unified_at_epoch_ms":1791456088120,"unified_at":"2026-10-08T10:41:28.120Z","metadata":{"hashes":{"sha256":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df","sha1":"ecbc89562f1c3582390a0891d86bcf916c77d0ed","md5":"b24a0d9fcbac2f8809b40d17b13004fa","sha512":"55fe0cee72d3b964f7639cf7ce18c71f21fecdabef180f973becd8470ea1dcc3c6fcbcb93926c376552718650e35a39f2105444dc3dfc21a2398c72fa32747ed","ssdeep":"24576:0PuzWpu3Y45X2FUywPqUwzUz0I5imPq48/s/JPMjrF2:0uCu30UXkI0I7Pq4yoJar","ssdeep_chunks":["24576:0PuzWpu","24576:PuzWpu3","24576:uzWpu3Y","24576:zWpu3Y4","24576:Wpu3Y45","24576:pu3Y45X","24576:u3Y45X2","24576:3Y45X2F","24576:Y45X2FU","24576:45X2FUy","24576:5X2FUyw","24576:X2FUywP","24576:2FUywPq","24576:FUywPqU","24576:UywPqUw","24576:ywPqUwz","24576:wPqUwzU","24576:PqUwzUz","24576:qUwzUz0","24576:UwzUz0I","24576:wzUz0I5","24576:zUz0I5i","24576:Uz0I5im","24576:z0I5imP","24576:0I5imPq","24576:I5imPq4","24576:5imPq48","24576:imPq48/","24576:mPq48/s","24576:Pq48/s/","24576:q48/s/J","24576:48/s/JP","24576:8/s/JPM","24576:/s/JPMj","24576:s/JPMjr","24576:/JPMjrF","24576:JPMjrF2","49152:0PuzWpu","49152:PuzWpu3","49152:uzWpu3Y","49152:zWpu3Y4","49152:Wpu3Y45","49152:pu3Y45X","49152:u3Y45X2","49152:3Y45X2F","49152:Y45X2FU","49152:45X2FUy","49152:5X2FUyw","49152:X2FUywP","49152:2FUywPq","49152:FUywPqU","49152:UywPqUw","49152:ywPqUwz","49152:wPqUwzU","49152:PqUwzUz","49152:qUwzUz0","49152:UwzUz0I","49152:wzUz0I5","49152:zUz0I5i","49152:Uz0I5im","49152:z0I5imP","49152:0I5imPq","49152:I5imPq4","49152:5imPq48","49152:imPq48/","49152:mPq48/s","49152:Pq48/s/","49152:q48/s/J","49152:48/s/JP","49152:8/s/JPM","49152:/s/JPMj","49152:s/JPMjr","49152:/JPMjrF","49152:JPMjrF2","24576:0uCu30U","24576:uCu30UX","24576:Cu30UXk","24576:u30UXkI","24576:30UXkI0","24576:0UXkI0I","24576:UXkI0I7","24576:XkI0I7P","24576:kI0I7Pq","24576:I0I7Pq4","24576:0I7Pq4y","24576:I7Pq4yo","24576:7Pq4yoJ","24576:Pq4yoJa","24576:q4yoJar"],"imphash":"df57ed77fa15cc824ab0c7f8c79cf802"},"file_info":{"file_name":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":856576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287002000,"last_seen":1660548915000,"last_multi_scan":1660548915000}},"detections":{"summary":{"verdict":"malicious","score":93,"tags":["vCrypt1","Ransomware","upx"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":8,"malicious_count":5,"total":21},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Gen.tpPW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Ransom]/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1206439","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Vcrypt.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.vCrypt (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NLF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.Ransomer","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Gen.drx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Filecoder.eofiil","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.CryptXXX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_VCRYPT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_VCRYPT.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Redemptio.KE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TScope.Trojan.Delf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Gen.Win32.1593","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojanransom.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\vCrypt\"\n \"vCrypt\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"Test2.doc\" has type \"data\"\n \"J0384895.JPG\" has type \"data\"\n \"J0382958.JPG\" has type \"data\"\n \"J0149118.JPG\" has type \"data\"\n \"Dynamic.pdf\" has type \"data\"\n \"J0387337.JPG\" has type \"data\"\n \"J0145212.JPG\" has type \"data\"\n \"J0341557.JPG\" has type \"data\"\n \"PH01239K.JPG\" has type \"data\"\n \"DefaultID.pdf\" has type \"data\"\n \"symhttp.doc\" has type \"data\"\n \"J0341653.JPG\" has type \"data\"\n \"J0099148.JPG\" has type \"data\"\n \"PH03041I.JPG\" has type \"data\"\n \"J0386764.JPG\" has type \"data\"\n \"J0099186.JPG\" has type \"data\"\n \"J0382957.JPG\" has type \"data\"\n \"PH02053J.JPG\" has type \"data\"\n \"J0382948.JPG\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\staticcache.dat\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\USER32.dll.mui\"\n \"\" touched file \"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2\\comctl32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"S4Kz=~,a?*[,nkb-S0+X2/,):Vjw{F`5yGF\\.Kw\"\n Pattern match: \"x.Or/~qot5\"\n Pattern match: \"6.eeZ/T!K#3OtPruVFC/l^IJKOuwH\"\n Pattern match: \"a.etVm/c7c#sXWKKW\"\n Heuristic match: \"$& :/Pi0k &]|D<)WJ(S.%q.Ec\"\n Pattern match: \"0dH.Ts/j1Xtj!;`Nw?\\|9\"\n Pattern match: \"T.QU/\\0U}x`//\"\n Pattern match: \"http://msdl.microsoft.com/download/symbolsyKVhttp://msdl.microsoft.com/download/symbols7Dd\"\n Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\"\n Heuristic match: \"ns-service@pochta.com\"\n Pattern match: \"http://msdl.microsoft.com/download/symbolsgj/\\\\symbols\\symbolsgj3[Dfile://\\\\symbols\\symbols;http:\\\\msdl.microsoft.com\\download\\symbolsgj$d~+http://msdl.microsoft.com/download/symbolsgj{http://symmachinename/Symbolsgjxhttp://symmachinename/Symbolsgj8=u\\\\ser\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.92823080497","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe.bin\" has a section named \"UPX0\"\n \"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$27","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains embedded string with suspicious keywords","description":"Found suspicious keyword \"Lib\" which indicates: \"May run code from a DLL\"","origin":"File/Memory","relevance":10,"id":"string-21","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n GetProcAddress\n LoadLibraryA\n RegCloseKey\n ShellExecuteW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/61 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"4/61 Antivirus vendors marked spawned process \"\" (PID: 2492) as malicious (classified as \"Trojan.Generic\" with 6% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"UPX\" classified file \"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe.bin\" as \"upx\" based on indicators: \"UPX0,UPX1,UPX!\" (Author: Kevin Breen )","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":5,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":38,"dropped_files_count":0,"extracted_files_count":36,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["vCrypt1","Ransomware","upx"],"sample_flags":["Extracted Files","User Comment"],"sandbox_reports":[{"id":"5908b275aac2ed0338f73748","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":93,"malware_family":"Trojan.Generic","submit_name":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin","analysis_start_time":"2017-05-02T17:24:07+00:00","indicators_count":{"informative":8,"suspicious":11,"malicious":5},"tags":["Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}],"processes":[{"pid":2492,"ppid":0,"name":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe","command_line":"","sha256":"da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df","normalized_path":"C:\\da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df.bin.exe","uid":"00014288-00002492","icon":"$28"}],"all_imported_dlls":["KernelBase.dll","advapi32.dll","sechost.dll","rpcrt4.dll","shfolder.dll","msctf.dll","rpcss.dll","wtsapi32.dll","netutils.dll","cryptbase.dll","ntdll.dll","user32.dll","FWPUCLNT.DLL","idndl.dll","netapi32.dll","uxtheme.dll","winnsi.dll","msvcrt.dll","shlwapi.dll","winsta.dll","nsi.dll","lpk.dll","usp10.dll","oleaut32.dll","version.dll","ws2_32.dll","normaliz.dll","clbcatq.dll","kernel32.dll","gdi32.dll","wkscli.dll","ole32.dll","shell32.dll","imm32.dll","IPHLPAPI.DLL","comctl32.dll","srvcli.dll","dwmapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"AdobeID.pdf","sha256":"6b20f65c0de47354d25eb803c491e068e11588ec140e339bd745143079dc635f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"DefaultID.pdf","sha256":"f4e4afb66c539d17d7be1685917ff777905a9edac0a52277f2a6ba4a0b35c2b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PDFSigQFormalRep.pdf","sha256":"06e0a506a02a3b7818897640f9f1db1364f95ec94d64b8eb6aa865f0bf38b04d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"Dynamic.pdf","sha256":"f0cc4617712304db88d7013b165f5a85c265efe3ee83b3b0bac99dd853da43ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"SignHere.pdf","sha256":"d69b7492c0557b45c85fae7ba56d6bb293e0c5b3e5a6ae9f421522a034d8d257","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"StandardBusiness.pdf","sha256":"dffb3b0ff31e52902a1e11b181a4111c678de7806f5f8fe72aea6f35e13b611f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"Words.pdf","sha256":"6fdaa4a21da036635ede626720144c86eb57cdfc627d16598da6d6882b883473","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"ENUtxt.pdf","sha256":"d51d3d64ce16b6e1c4a15fc4952dfc18f24efccd485ddec2852fbbabc43972b8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"Test2.doc","sha256":"d87b48ce264fd3670f45ee4b6a956468d03f6fa29ac41ffdf265fb56b34d3489","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0384895.JPG","sha256":"abcf058a45e80fe8d26ae09166cbe00016baf06fc8293b6c5d63db86907deaf0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0382958.JPG","sha256":"3ad648fd9b33c79864c5db3194730d84dbe697d629288989434f80b1d72bacb2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0149118.JPG","sha256":"335acb408c4d720ef319b2bcdfc096cda9fea3ac565409facde795ad9840d41a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0387337.JPG","sha256":"a0440cf36a1f5b00b818ba22b1d831f1db5c041cf8aee43a7e2a4ca3ecf1f549","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0145212.JPG","sha256":"47d3c7244629aea18f508f98304fd407530e31a151b56482a3934f7ad9efc4db","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0341557.JPG","sha256":"33289c645455987401179c9fff9ac3315199537221237b72887a91daec9d5f98","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PH01239K.JPG","sha256":"678df7244bf1e9efe908e11fd3f7917bbbfed93f62001913aa4ce32c609b765a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"symhttp.doc","sha256":"b784a1f98e0a5efd7392d3fb99a39b7a77e5e86d503eed4a95dc0acc783b116e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0341653.JPG","sha256":"4774441e17dc5e56a95be490daa9e560bb396995b3299be545ae550ab90e1b74","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"J0099148.JPG","sha256":"66e0802a7b3d53afcecc571c99f4aa403f9a89af3311713c2a2c465b5af3d0d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PH03041I.JPG","sha256":"b43c69f120696c6c30ea347db1883a6030e606d2889d8f6caa2ad139e36071b5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"Worksheet.xls","sha256":"9f837d740a7fe758832f71d984753845bbfad4de14aeaa0f6fa76900b171bc8d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"_Excel1.xls","sha256":"3438f8e70b2ebf66c857565922f19f85973a6078d35c553f440d31d189f2b702","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PROTTPLN.DOC","sha256":"9ba674e2048f841b52cad1ac2b85441a650fd6b85fc24356587c2e0caa5aa29d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"_Excel2.xls","sha256":"bb27bf136581ac5dd06f3f52a8e3d06f1240d8a4ac8ec83e3c6579caa74a7181","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"kernel_debugging_tutorial.doc","sha256":"34a337fd340dde1ca26e6e28679e17938a2c27817600fb9860cf52a2db6306b4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PROTTPLN.PPT","sha256":"6e1a060128518b1b11183178d742208a101ca891b74f15fee990fa954ba4354a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"dml.doc","sha256":"4f9c48783f9269bd919bada132c5bab68ad68f21194cf0186e2b9b1e50226e86","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PROTTPLV.XLS","sha256":"517173d1ffdd01934fd1a8abe30fbaf31077c5da3f083ee21e2067046adcdfe0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PROTTPLV.DOC","sha256":"f14634eda896fc55b3db5cf023ceb69bcd4c9483b2bcb2c31d1eb29aba7287ab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"_Excel3.xls","sha256":"d3710135fd1ad815545bb3377bc35ffd2c84613d8505a4a15ed6962b04168453","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PROTTPLN.XLS","sha256":"97f40f356249b48dd8e87978627c582c7fe016337ba5d001ed4c9d3d4cb61cac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"srcsrv.doc","sha256":"157bdf7f4d32d3266dee44a18c8ee6b0b26a659d2451548d8a2014f9e2993bdb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"themes.doc","sha256":"9f9c379b82428f67eded7bfa265cde908a068c5201f085228b4038d2879922fc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"_Excel4.xls","sha256":"b7dea902f491f1e6bc25be11d855e64d9261d6cd1797e47ebb19b9395339c3f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"PROTTPLV.PPT","sha256":"3b476e6b40f99acbf7396c77ef0ebdd097ba734a145ffc162b6caef53a35baef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"Test.doc","sha256":"f9424e34af7c6296e372f2c5a4895290aa806ecab006b5738664b16b594cd335","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]}],"files_written":[{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%WINDIR%\\WinSxS\\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_5.82.7600.16385_en-us_020378a8991bbcc2\\comctl32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%USERPROFILE%\\Desktop\\???_????????????_?????.txt","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\DEU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\AdobeID.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\IDTemplates\\ENU\\DefaultID.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\PDFSigQFormalRep.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\Dynamic.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\SignHere.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\DEU\\StandardBusiness.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\Dynamic.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\SignHere.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\ENU\\StandardBusiness.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annotations\\Stamps\\Words.pdf","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\vCrypt","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]},{"name":"vCrypt","sources":[{"report_type":"sandbox","report_id":"5908b275aac2ed0338f73748"}]}]}},"report_ids":{"sandbox_job_ids":["5908b275aac2ed0338f73748"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojanransom.Generic Sample da2eecf561bf… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample da2eecf561bf…. Malware family: Trojanransom.Generic. Threat score 93/100. 19/29 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojanransom.Generic Sample da2eecf561bf… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample da2eecf561bf…. Malware family: Trojanransom.Generic. Threat score 93/100. 19/29 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/da2eecf561bfca7e695dbaf97ef468b8a32713388a215a5284d95c757047d7df"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojanransom.Generic Sample da2eecf561bf… — Score 93/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample da2eecf561bf…. Malware family: Trojanransom.Generic. Threat score 93/100. 19/29 AV engines flagged this file. 5 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]