34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 5d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Draftor.Generic Sample e203242dfee4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample e203242dfee4…. Malware family: Draftor.Generic. Threat score 100/100. 17/25 AV engines flagged this file. 15 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e203242dfee424e4a3cf548a697a58440019c68501fae20de4fb2be771fa0930","keywords":["Malicious","Draftor.Generic","malware analysis","sandbox report","threat intelligence","e203242dfee424e4a3cf548a697a58440019c68501fae20de4fb2be771fa0930"],"about":{"@type":"SoftwareApplication","name":"e203242dfee424e4a3cf548a697a58440019c68501fae20de4fb2be771fa0930.bin","applicationCategory":["peexe","executable"],"identifier":"e203242dfee424e4a3cf548a697a58440019c68501fae20de4fb2be771fa0930","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Draftor.Generic","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":15,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T532,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string "0/en-US/System.Management.Automation.resourW" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string "System.Management.Automation.resources.DLL" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string "///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp")37:Taf2," HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:45:14 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a557d5a70d4c7e0e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A36333265373536363733363237323636326536333666366432633331333933363265333133393336....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:45:15 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=258 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ZPr1wIjxTiMxdLx2Ev5iyXwGEktBxx4acRiLGhhKKJa8SFANLctlmT2v%2Br%2FOPfuTzd6PmQ23XyyevuKa5GCtyF9uYrSmJ9DNfAOR7LkL%2FrZGs4wIt95WhG7rKjFa"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d5a94eaa6896-SJC with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:45:17 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=36 cfOrigin;dur=269 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=56ijL252A4ammUCpS4IAWBewqghsXctxJTunnMLUbxFg6jMkKJ1T9u1HPm%2FnAgooQoiD%2Fw2MEn8%2Fte6fVPJdKRaLXV8MFIyS22DyDXv4Z72Bgr693eyT9SeMF4o1"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d5b869576896-SJC with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC291C382C3B3....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:46:10 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a557d7010e5b2714-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A36333265373536363733363237323636326536333666366432633331333933363265333133393336....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 88 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:46:11 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=887 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vbRB98EN%2FwNqU27uco%2Br%2BP8Ue61%2FraAYv2YKfbFp52WmHmUWbyDLosFqFAQwkjYrfko8yrYofuEujV0ReAwMMoyGaReGZPGebRqmcfyq4AX6Ajkl1wGMwO2d1%2Bew"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d702ea2c2c47-SJC with response body ==>C2ABC3B633C383C2A3C39BC292C39EC2A1C380C2A3C39EC28B20C29C....... "GET /sa1at/ HTTP/1.1 Host: c.ufsbrf.com User-Agent: Go-http-client/1.1 Content-Length: 354 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Thu 05 Nov 2026 00:46:14 GMT Content-Type: application/octet-stream Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=6 cfOrigin;dur=950 Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=4jNb19odb%2FGRWMaCxK3YEpBKPuSZO3t%2BGWmnod5zesMpSyTSylgo9diWCAH1IPmI4AjrcABozXtsfIhw7rsyrGDu5VG%2BNtsR%2F0vZOK1IXz5ou1xziEN04eH%2BmHXU"}]} alt-svc: h3=":443"; ma=86400 CF-RAY: a557d7159d312c47-SJC with response body ==>C28BC39657C396C38AC39FC280C384C2B3C38AC2A4C392C2883AC38EC282C38CC2A1C396C285C380C2BEC39FC291C382C3B3.......48:T24a4,"'.a>;i@;rd0s!pc^" - Source: "00000000-00008816.00000000.147688.03C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0yo*z7sc" - Source: "00000000-00008816.00000000.147688.03C00000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0k?[j9ztad]r" - Source: "00000000-00008816.00000000.147688.03C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crlget" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0k?[j9zta" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0u+![" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crlm(i6" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google&type=ahttps://dns.google/resolve?name=google.come>'.a>;i@;rd0s!pc^" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0yo*z7sc" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0k?[j9ztad]r" - Source: "00000000-00008816.00000001.149608.03C00000.00000004.mdmp")54:T99c,"powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001112) "powershell.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001112) "powershell.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001112)55:T653,Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; File: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.IO.Compression.ZipFile" (Indicator: "zipfile"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.Algorithms" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.Cng" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.Csp" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.Encoding" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.OpenSsl" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.Pkcs" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.Primitives" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00001112.00000000.151278.00171000.00000020.mdmp")56:T4b6,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00001112.00000000.151278.00182000.00000002.mdmp") Found reference to API "67650,7780,3125,,Process32NextW,kernel32.dll,"00:38:24.906",RX=0,PX=0" (Indicator: "Process32Next"; Source: "00000000-00008816.00000000.147688.01240000.00000004.mdmp")57:T8c9,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp, 00000000-00001112.00000000.151278.02CA0000.00000004.mdmp, 00000000-00001112.00000000.151278.04600000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00001112.00000000.151278.02A00000.00000004.mdmp, 00000000-00001112.00000000.151278.02CA0000.00000004.mdmp, 00000000-00001112.00000000.151278.04600000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00005652.00000000.144113.01670000.00000004.mdmp, 00000000-00005652.00000000.144113.038A0000.00000004.mdmp, 00000000-00005652.00000001.146032.01670000.00000004.mdmp, 00000000-00005652.00000001.146032.038A0000.00000004.mdmp, 00000000-00005652.00000002.147377.01670000.00000004.mdmp, 00000000-00005652.00000002.147377.016AD000.00000004.mdmp, 00000000-00005652.00000002.147377.038A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00005652.00000000.144113.01670000.00000004.mdmp, 00000000-00005652.00000000.144113.038A0000.00000004.mdmp, 00000000-00005652.00000001.146032.01670000.00000004.mdmp, 00000000-00005652.00000001.146032.038A0000.00000004.mdmp, 00000000-00005652.00000002.147377.01670000.00000004.mdmp, 00000000-00005652.00000002.147377.016AD000.00000004.mdmp, 00000000-00005652.00000002.147377.038A0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00008816.00000000.147688.01220000.00000004.mdmp, 00000000-00008816.00000000.147688.01240000.00000004.mdmp, 00000000-00008816.00000001.149608.01220000.00000004.mdmp, 00000000-00008816.00000001.149608.01240000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00008816.00000000.147688.01220000.00000004.mdmp, 00000000-00008816.00000000.147688.01240000.00000004.mdmp, 00000000-00008816.00000001.149608.01220000.00000004.mdmp, 00000000-00008816.00000001.149608.01240000.00000004.mdmp")58:Ta00," www.upx.sourceforge.net\"\n \"SecurityHealthService.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aebd0fdb7be2a87670b43d6"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"