21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample db8e7098c2ba… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample db8e7098c2ba…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e"],"about":{"@type":"SoftwareApplication","name":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","applicationCategory":["peexe","assembly","executable"],"identifier":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":6},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T459,"" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\security.config.cch" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config" "" touched file "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\config\enterprisesec.config.cch" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v2.0.50727_64\index2b5.dat" "" touched file "C:\Windows\System32\l_intl.nls" "" touched file "C:\Windows\assembly\pubpol107.dat"23:T8b8,Pattern match: "www.microsoft.com/exporting" Pattern match: "http://ocsp.thawte.com0" Pattern match: "http://crl.thawte.com/ThawteTimestampingCA.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com07" Pattern match: "http://ts-aia.ws.symantec.com/tss-ca-g2.cer0" Pattern match: "http://ts-crl.ws.symantec.com/tss-ca-g2.crl0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://csc3-2010-aia.verisign.com/CSC3-2010.cer0" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftCodeVerifRoot.crl0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl0X" Pattern match: "http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T" Pattern match: "www.microsoft.com/pki/certs/MicrosoftRootCert.crt0" Pattern match: "http://www.sysinternals.com" Pattern match: "www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a" Pattern match: "www.microsoft.com/pkiops/certs/MicCodSigPCA2011_2011-07-08.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0" Pattern match: "www.microsoft.com/pkiops/docs/primarycps.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0" Pattern match: "www.microsoft.com/PKI/docs/CPS/default.htm0@" Pattern match: "crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z" Pattern match: "http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0" Pattern match: "www.microsoft.com" Pattern match: "www.sysinternals.com"24:T20e4,"\pard\brdrb\brdrs\brdrw10\brsp20 \sb120\sa120\b\f0\fs24 SYSINTERNALS SOFTWARE LICENSE TERMS\fs28\par" (Indicator: "sysinternals") "\pard\sb120\sa120\b0\fs19 These license terms are an agreement between Sysinternals (a wholly owned subsidiary of Microsoft Corporation) and you. Please read them. They apply to the software you are downloading from Systinternals.com, which includes the media on which you received it, if any. The terms also apply to any Sysinternals\par" (Indicator: "sysinternals") "\caps\fs20 2.\tab\fs19 Scope of License\caps0 .\b0 The software is licensed, not sold. This agreement only gives you some rights to use the software. Sysinternals reserves all other rights. Unless applicable law gives you more rights despite this limitation, you may use the software only as expressly permitted in this agreement. In doing so, you must comply with any technical limitations in the software that only allow you to use it in certain ways. You may not\b\par" (Indicator: "sysinternals") "\pard\fi-357\li357\sb120\sa120\tx360\b\fs20 3.\tab SENSITIVE INFORMATION. \b0 Please be aware that, similar to other debug tools that capture \ldblquote process state\rdblquote information, files saved by Sysinternals tools may include personally identifiable or other sensitive information (such as usernames, passwords, paths to files accessed, and paths to registry accessed). By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.\b\par" (Indicator: "sysinternals") "\fs20 11.\tab\fs19 Disclaimer of Warranty.\caps0 \caps The software is licensed "as - is." You bear the risk of using it. SYSINTERNALS gives no express warranties, guarantees or conditions. You may have additional consumer rights under your local laws which this agreement cannot change. To the extent permitted under your local laws, SYSINTERNALS excludes the implied warranties of merchantability, fitness for a particular purpose and non-infringement.\par" (Indicator: "sysinternals") "\pard\fi-360\li360\sb120\sa120\tx360\fs20 12.\tab\fs19 Limitation on and Exclusion of Remedies and Damages. You can recover from SYSINTERNALS and its suppliers only direct damages up to U.S. $5.00. You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.\par" (Indicator: "sysinternals") "\pard\li360\sb120\sa120 It also applies even if Sysinternals knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 EXON\'c9RATION DE GARANTIE.\b0 Le logiciel vis\'e9 par une licence est offert \'ab tel quel \'bb. Toute utilisation de ce logiciel est \'e0 votre seule risque et p\'e9ril. Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b\'e9n\'e9ficier de droits additionnels en vertu du droit local sur la protection dues consommateurs, que ce contrat ne peut modifier. La ou elles sont permises par le droit locale, les garanties implicites de qualit\'e9 marchande, d'ad\'e9quation \'e0 un usage particulier et d'absence de contrefa\'e7on sont exclues.\par" (Indicator: "sysinternals") "\pard\keepn\sb120\sa120\b LIMITATION DES DOMMAGES-INT\'c9R\'caTS ET EXCLUSION DE RESPONSABILIT\'c9 POUR LES DOMMAGES.\b0 Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement \'e0 hauteur de 5,00 $ US. Vous ne pouvez pr\'e9tendre \'e0 aucune indemnisation pour les autres dommages, y compris les dommages sp\'e9ciaux, indirects ou accessoires et pertes de b\'e9n\'e9fices.\par" (Indicator: "sysinternals") "\pard\sb120\sa120 Elle s'applique \'e9galement, m\'eame si Sysinternals connaissait ou devrait conna\'eetre l'\'e9ventualit\'e9 d'un tel dommage. Si votre pays n'autorise pas l'exclusion ou la limitation de responsabilit\'e9 pour les dommages indirects, accessoires ou de quelque nature que ce soit, il se peut que la limitation ou l'exclusion ci-dessus ne s'appliquera pas \'e0 votre \'e9gard.\par" (Indicator: "sysinternals") "Sysinternals1>0<" (Indicator: "sysinternals") "Sysinternals0" (Indicator: "sysinternals") "http://www.sysinternals.com 0" (Indicator: "sysinternals") "SYSINTERNALS SOFTWARE LICENSE TERMSThese license terms are an agreement between Sysinternals(a wholly owned subsidiary of Microsoft Corporation) and you.Please read them.They apply to the software you are downloading from technet.microsoft.com / sysinternals, which includes the media on which you received it, if any.The terms also apply to any Sysinternals* updates,*supplements,*Internet - based services,*and support servicesfor this software, unless other terms accompany those items.If so, those terms apply.BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS.IF YOU DO NOT ACCEPT THEM, DO NOT USE THE SOFTWARE.If you comply with these license terms, you have the rights below.INSTALLATION AND USER RIGHTSYou may install and use any number of copies of the software on your devices.SCOPE OF LICENSEThe software is licensed, not sold.This agreement only gives you some rights to use the software.Sysinternals reserves all other rights.Unless applicable law gives you more rights despite this limitation, you may" (Indicator: "sysinternals") "information, files saved by Sysinternals tools may include personally identifiable or other sensitive information(such as usernames, passwords, paths to files accessed, and paths to registry accessed).By using this software, you acknowledge that you are aware of this and take sole responsibility for any personally identifiable or other sensitive information provided to Microsoft or any other party through your use of the software.DOCUMENTATIONAny person that has valid access to your computer or internal network may copy and use the documentation for your internal, reference purposes.EXPORT RESTRICTIONSThe software is subject to United States export laws and regulations.You must comply with all domestic and international export laws and regulations that apply to the software.These laws include restrictions on destinations, end users and end use.For additional information, see www.microsoft.com / exporting .SUPPORT SERVICESBecause this software is "as is " we may not provide support services for it." (Indicator: "sysinternals") "DISCLAIMER OF WARRANTYThe software is licensed "as - is." You bear the risk of using it.Sysinternals gives no express warranties, guarantees or conditions.You may have additional consumer rights under your local laws which this agreement cannot change.To the extent permitted under your local laws, sysinternals excludes the implied warranties of merchantability, fitness for a particular purpose and non - infringement.LIMITATION ON AND EXCLUSION OF REMEDIES AND DAMAGESYou can recover from sysinternals and its suppliers only direct damages up to U.S.$5.00.You cannot recover any other damages, including consequential, lost profits, special, indirect or incidental damages.This limitation applies to* anything related to the software, services, content(including code) on third party Internet sites, or third party programs; and* claims for breach of contract, breach of warranty, guarantee or condition, strict liability, negligence, or other tort to the extent permitted by applicable law.It also applies even" (Indicator: "sysinternals") "if Sysinternals knew or should have known about the possibility of the damages.The above limitation or exclusion may not apply to you because your country may not allow the exclusion or limitation of incidental, consequential or other damages.Please note : As this software is distributed in Quebec, Canada, some of the clauses in this agreement are provided below in French.Remarque : Ce logiciel" (Indicator: "sysinternals") "ril.Sysinternals n'accorde aucune autre garantie expresse. Vous pouvez b" (Indicator: "sysinternals") "POUR LES DOMMAGES.Vous pouvez obtenir de Sysinternals et de ses fournisseurs une indemnisation en cas de dommages directs uniquement" (Indicator: "sysinternals") "me si Sysinternals connaissait ou devrait conna" (Indicator: "sysinternals")25:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790622776249,"unified_at":"2026-09-28T19:12:56.249Z","metadata":{"hashes":{"sha256":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","sha1":"0963034dfb7c0f703f5254595aea0a17ff95d376","md5":"5c7c894a1ccfd8c8e0f174b0149a6601","sha512":"3404ccd9f609c12e3ff71be49d7026b719478ebcc3235422098912a419c9236402c31e6ec55b2c9f4b6dec2664413d3d77db73ed56b09872ea5be5ab3bdb4ebc","ssdeep":"6144:Nb4adBRd179O3EjTB7ftk2pJpXT8DOSi9x/jK8y:LdBh7U3QTpfXzokjK","ssdeep_chunks":["6144:Nb4adBR","6144:b4adBRd","6144:4adBRd1","6144:adBRd17","6144:dBRd179","6144:BRd179O","6144:Rd179O3","6144:d179O3E","6144:179O3Ej","6144:79O3EjT","6144:9O3EjTB","6144:O3EjTB7","6144:3EjTB7f","6144:EjTB7ft","6144:jTB7ftk","6144:TB7ftk2","6144:B7ftk2p","6144:7ftk2pJ","6144:ftk2pJp","6144:tk2pJpX","6144:k2pJpXT","6144:2pJpXT8","6144:pJpXT8D","6144:JpXT8DO","6144:pXT8DOS","6144:XT8DOSi","6144:T8DOSi9","6144:8DOSi9x","6144:DOSi9x/","6144:OSi9x/j","6144:Si9x/jK","6144:i9x/jK8","6144:9x/jK8y","12288:Nb4adBR","12288:b4adBRd","12288:4adBRd1","12288:adBRd17","12288:dBRd179","12288:BRd179O","12288:Rd179O3","12288:d179O3E","12288:179O3Ej","12288:79O3EjT","12288:9O3EjTB","12288:O3EjTB7","12288:3EjTB7f","12288:EjTB7ft","12288:jTB7ftk","12288:TB7ftk2","12288:B7ftk2p","12288:7ftk2pJ","12288:ftk2pJp","12288:tk2pJpX","12288:k2pJpXT","12288:2pJpXT8","12288:pJpXT8D","12288:JpXT8DO","12288:pXT8DOS","12288:XT8DOSi","12288:T8DOSi9","12288:8DOSi9x","12288:DOSi9x/","12288:OSi9x/j","12288:Si9x/jK","12288:i9x/jK8","12288:9x/jK8y","6144:LdBh7U3","6144:dBh7U3Q","6144:Bh7U3QT","6144:h7U3QTp","6144:7U3QTpf","6144:U3QTpfX","6144:3QTpfXz","6144:QTpfXzo","6144:TpfXzok","6144:pfXzokj","6144:fXzokjK"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":442880,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499286492000,"last_seen":1621093962000,"last_multi_scan":1621093962000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["fakecry","ransomware","petya"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":7,"suspicious_count":6,"malicious_count":5,"total":18},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Wanna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILPerseus.112642","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.PBSX-7112","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.WannaCry (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Filecoder.IL trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/BTCware.d","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.FakeCry","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005110711 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Wanna.alwi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransom-Wannacry.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Tpyn.eqosmg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":" Ransom.WannaCry.S1375230","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Genasom-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_.ED4F7D9B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_.ED4F7D9B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.WannaCry.O","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Wanna","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"93.184.220.29:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\sysint\\ProcExp\\Sys\\Win32\\Release\\ProcExpDriver.pdb\"\n \"C:\\sysint\\ProcExp\\Sys\\x64\\Release\\ProcExpDriver.pdb\"\n \"%USERPROFILE%\\Desktop\\WannaCry\\ed\\obj\\Release\\ed.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\mscorlib\\0478aed7fc25ae268474c704fd2a3e0f\\mscorlib.ni.dll\" at EB8E0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$22","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$23","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Possibly checks for the presence of an Antivirus engine","description":"\"mfevtps.exe\" (Indicator: \"mfevtps.exe\")\n \"msascui.exe\" (Indicator: \"msascui.exe\")\n \"mpcmdrun.exe\" (Indicator: \"mpcmdrun.exe\")","origin":"File/Memory","relevance":3,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"$24","origin":"File/Memory","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"\" sleeping for \"1566804069\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch.2536.3763375\" with delete access\n \"\" opened \"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch.2536.3763375\" with delete access\n \"\" opened \"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch.2536.3763437\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"The input sample contains an embedded RTF document","description":"\"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe.bin\" has an embedded RTF document (Line: 631; Offset: 117)","origin":"Binary File","relevance":10,"id":"binary-3","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe.bin\" (Offset: 249417)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"51/66 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"51/66 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"malicious","category":"Unusual Characteristics","name":"References suspicious system modules","description":"\"ntoskrnl.exe\"","origin":"File/Memory","relevance":5,"id":"string-24","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":27,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":34,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["fakecry","ransomware","petya"],"sample_flags":["Network Traffic","Sample not shared"],"sandbox_reports":[{"id":"5a42e90f7ca3e137d510b854","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["EU"],"submit_name":"OTX_db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","analysis_start_time":"2017-12-27T01:40:42+00:00","indicators_count":{"informative":7,"suspicious":6,"malicious":5},"tags":["Network Traffic","Sample not shared"],"is_in_unified_schema":true},{"id":"5954fe127ca3e1671b6dc2c2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":39,"malware_family":"ML.Attribute","submit_name":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","analysis_start_time":"2017-06-29T15:19:25+00:00","indicators_count":{"informative":6,"suspicious":6,"malicious":4},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"93.184.220.29","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}],"processes":[{"pid":2536,"ppid":0,"name":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe","command_line":"","sha256":"db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e","normalized_path":"C:\\db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe","uid":"00010361-00002536","icon":"$25"}],"all_imported_dlls":["System.ni.dll","mscoree.dll","kernel32.dll","lpk.dll","msctf.dll","mscorwks.dll","mscorjit.dll","rpcrt4.dll","mscoreei.dll","shlwapi.dll","ole32.dll","usp10.dll","ntdll.dll","KernelBase.dll","advapi32.dll","gdi32.dll","user32.dll","imm32.dll","shell32.dll","msvcrt.dll","sechost.dll","version.dll","msvcr80.dll","profapi.dll","mscorlib.ni.dll","cryptbase.dll","oleaut32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"C:\\db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe.config","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\64bit\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_64\\index2b5.dat","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"C:\\db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e.exe","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\assembly\\pubpol107.dat","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework64\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index248.dat","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\system32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\assembly\\pubpol47.dat","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\machine.config","sources":[{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\FUSION\\GACCHANGENOTIFICATION\\DEFAULT\\","sources":[{"report_type":"sandbox","report_id":"5a42e90f7ca3e137d510b854"},{"report_type":"sandbox","report_id":"5954fe127ca3e1671b6dc2c2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5a42e90f7ca3e137d510b854","5954fe127ca3e1671b6dc2c2"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Trojan.Generic Sample db8e7098c2ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample db8e7098c2ba…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample db8e7098c2ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample db8e7098c2ba…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/db8e7098c2bacad6ce696f3791d8a5b75d7b3cdb0a88da6e82acb28ee699175e"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample db8e7098c2ba… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample db8e7098c2ba…. Malware family: Trojan.Generic. Threat score 100/100. 19/26 AV engines flagged this file. 5 malicious and 6 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]