26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 39:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4fd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample e2faaa60c6b7… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample e2faaa60c6b7…. Malware family: Win/malicious_confidence_90%. Threat score 88/100. 11/27 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e2faaa60c6b7dbfa1f677b72458378b30fa071c38cf375ba2fd55b89d4f85fd0","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","e2faaa60c6b7dbfa1f677b72458378b30fa071c38cf375ba2fd55b89d4f85fd0"],"about":{"@type":"SoftwareApplication","name":"e2faaa60c6b7dbfa1f677b72458378b30fa071c38cf375ba2fd55b89d4f85fd0.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"e2faaa60c6b7dbfa1f677b72458378b30fa071c38cf375ba2fd55b89d4f85fd0","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":1,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T6f9,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilegeNtAllocateVirtualMemoryNtWriteVirtualMemoryNtOpenProcessNtQuerySystemInformationNtQueryObjectIoCompletionbdservicehost.exe360tray.exeSchedulevssshell32.dllIsUserAnAdminU" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilegeNtAllocateVirtualMemoryNtWriteVirtualMemoryNtOpenProcessNtQuerySystemInformationNtQueryObjectIoCompletionbdservicehost.exe360tray.exeSchedulevssshell32.dllIsUserAnAdminU" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilegeNtAllocateVirtualMemoryNtWriteVirtualMemoryNtOpenProcessNtQuerySystemInformationNtQueryObjectIoCompletionbdservicehost.exe360tray.exeSchedulevssshell32.dllIsUserAnAdminU" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp")28:T6ae,"/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\panicking.rs" (Indicator: "/rustc/"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference string "note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace" (Indicator: "rust_backtrace"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference string "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\thread\id.rs" (Indicator: "/rustc/"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference string "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\stdio\windows.rs" (Indicator: "/rustc/"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference string "fatal runtime error: out of TLS indexes, aborting/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\thread_local\key\windows.rs" (Indicator: "/rustc/"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference string "too many active read locks on RwLock/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\sync\rwlock\futex.rs" (Indicator: "/rustc/"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp")2f:T603," + : punycode{}.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.27\src\legacy.rs" Heuristic match: "parseinterrorkindemptyinvaliddigitposoverflownegoverflowzero/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\core\src\ops\function.rs" Heuristic match: "reentrant init/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\core\src\cell\once.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\thread\local.rs" Heuristic match: "/rust/deps\gimli-0.32.3\src\read\line.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\core\src\num\wrapping.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\core\src\str\pattern.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\io\mod.rs" Heuristic match: "internal error: entered unreachable code/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\pal\windows\mod.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "/rust/deps\object-0.37.3\src\read\coff\symbol.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\panicking.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\unit.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\thread\id.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\stdio\windows.rs" Heuristic match: "fatal runtime error: out of tls indexes, aborting/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\thread_local\key\windows.rs" Heuristic match: "too many active read locks on rwlock/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\..\..\backtrace\src\symbolize\gimli.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\path.rs" Heuristic match: "/rust/deps\addr2line-0.25.1\src\function.rs" Heuristic match: "advancing ioslice beyond its length/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\..\..\backtrace\src\symbolize\gimli\lru.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\..\..\backtrace\src\symbolize\gimli\coff.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "lvw+o .to" Heuristic match: "sg.im" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\core\src\wtf8.rs" Heuristic match: "/rustc/ac68faa20c58cbccd01ee7208bf3b6e93a7d7f96/library\std\src\sys\thread_local\key\windows.rs"33:T529,Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007296.00000000.269895.02680000.00000004.mdmp, 00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilegeNtAllocateVirtualMemoryNtWriteVirtualMemoryNtOpenProcessNtQuerySystemInformationNtQueryObjectIoCompletionbdservicehost.exe360tray.exeSchedulevssshell32.dllIsUserAnAdminU" (Indicator: "NtQueryObject"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilegeNtAllocateVirtualMemoryNtWriteVirtualMemoryNtOpenProcessNtQuerySystemInformationNtQueryObjectIoCompletionbdservicehost.exe360tray.exeSchedulevssshell32.dllIsUserAnAdminU" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp")34:Ta12,Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp")35:T6ec,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp")36:T597,Found reference to API "QueryServiceStatusExOpenProcessTokenLookupPrivilegeValueWAdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "QueryServiceStatusExOpenProcessTokenLookupPrivilegeValueWAdjustTokenPrivileges" (Indicator: "LookupPrivilegeValue"; File: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007296.00000000.269895.02680000.00000004.mdmp") Found reference to API "SeDebugPrivilege2" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007296.00000000.269895.02680000.00000004.mdmp") Found reference to API "QueryServiceStatusExOpenProcessTokenLookupPrivilegeValueWAdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "QueryServiceStatusExOpenProcessTokenLookupPrivilegeValueWAdjustTokenPrivileges" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp") Found reference to API "SeDebugPrivilegeNtAllocateVirtualMemoryNtWriteVirtualMemoryNtOpenProcessNtQuerySystemInformationNtQueryObjectIoCompletionbdservicehost.exe360tray.exeSchedulevssshell32.dllIsUserAnAdminU" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007296.00000000.269895.40001000.00000040.mdmp")37:T425,"