24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 44:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4fb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_60% Sample e4a9a2dd5498… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample e4a9a2dd5498…. Malware family: Win/malicious_confidence_60%. Threat score 87/100. 4/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33","keywords":["Malicious","Win/malicious_confidence_60%","malware analysis","sandbox report","threat intelligence","e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33"],"about":{"@type":"SoftwareApplication","name":"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_60%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4f6,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin")26:T40b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin")27:Taa0,"m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg" (Indicator: "CertOpenStore"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal erroruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CertCloseStore"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "file too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal erroruserArenaStateGC (dedicated)read mem statsupdatemaxprocsasynctimerchangcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexRtlGetVersion" (Indicator: "CryptGenRandom"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference ": [%4d-%4d) %6d %sbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.IsNilreflect.Value.FloatstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [controller reset]mspan.sweep: state=sysMemStat overflowbad sequence numberntdll.dll not foundwinmm.dll not foundruntime: g0 stack [panic during mallocpanic holding locksmissing deferreturnunexpected gp.parampanic during panic, g->atomicstatus=unexpected g statusbad runtime" (Indicator: "CryptReleaseContext"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CertOpenSystemStoreW"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=" (Indicator: "CryptAcquireContextW"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "usheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Type4656612873077392578125unexpected method stepexit hook invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrai" (Indicator: "CertGetCertificateChain"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "n phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transit" (Indicator: "CertFreeCertificateChain"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown func" (Indicator: "CertFreeCertificateContext"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin"), Found api reference "tionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory1455191522836685180664062572759576141834259033203125unknown ABI parameter kindRtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStorePageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workco" (Indicator: "CertCreateCertificateContext"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin"), Found api reference ": resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicysync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertAddCertificateContextToStore"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin"), Found api reference ": resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicysync: negative WaitGroup counterslice bounds out of range [::%x]slice bounds out of range [:%x:]slice bounds out of range [%x::] (types from different packages)end outside usable address spaceruntime: failed to release pagesruntime: fixalloc size too largeinvalid limiter event type foundscanstack: goroutine not stoppedscavenger state is already wiredsweep increased allocation countremovespecial on invalid pointerruntime: root level max pages = NtAssociateWaitCompletionPacket" (Indicator: "CertVerifyCertificateChainPolicy"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin"), Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffer152587890625762939453125gotypesaliashttpmuxgo121multipathtcprandautoseedtlsunsafeekmOpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil not value method heap metadata span.base()=bad flushGen created at: not pointer != sweepgen MB globals work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxch" (Indicator: "CertOpenStore"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CertOpenSystemStoreW"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closed14901161193847656257450580596923828125reflect.Value.Bytesreflect.Value.Fieldreflect.Value.IndexembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersSetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio" (Indicator: "CryptAcquireContextW"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "usheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=reflectlite.Value.Type4656612873077392578125unexpected method stepexit hook invoked exitRtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page size (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDra" (Indicator: "CertGetCertificateChain"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "n phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCall23283064365386962890625reflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportexit hook invoked panicGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWtracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transi" (Indicator: "CertFreeCertificateChain"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStart2910383045673370361328125GODEBUG: can not enable "hash of unhashable type: GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleall goroutines stack traceGC background sweeper waitcall from unknown fun" (Indicator: "CertFreeCertificateContext"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for 363797880709171295166015625reflect.Value.UnsafePointerabi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextGC mark assist wait for workc" (Indicator: "CertCreateCertificateContext"; File: "e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin")2a:T1a4a,Contains base64 string in header "Keep" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Encoding" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "gzip" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "Language" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "telegram" in header "GET /w09ksp HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Host: telegram.me" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news" Contains base64 string in header "news" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0Content-Length: 345Host: juj.realmadridiran.news"2b:Te64,Found XOR loop in file "sample.bin" at offset 89298; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1452785; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1557489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1565425; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1603569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1607153; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1609656; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1736433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1799665; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1928433; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1953265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2073635; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2202147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2523033; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 571625; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1231833; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342139; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1452752; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1511099; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1598395; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1605819; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1608635; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1644475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1670843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1744827; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1770939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1788091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1836663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1860283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1888955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1972923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2576350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2717592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 185910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226643; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 411493; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412189; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 412830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 423209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1568162; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2363309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2658928; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2749468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2916092; code bytes = 80302c:T9f2," HTTP/1.1 200 OK Server: nginx/1.30.1 Date: Sat 04 Jul 2026 12:54:55 GMT Content-Type: text/html; charset=utf-8 Content-Length: 4424 Connection: keep-alive Set-Cookie: stel_ssid=38518f9f50fe518a09_837805080130522002; expires=Sun 05 Jul 2026 12:54:55 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Content-Encoding: gzip Strict-Transport-Security: max-age=35768000 with response body ==>3C21444F43545950452068746D6C3E0A3C68746D6C3E0A20203C686561643E0A202020203C6D65746120636861727365743D227574662D38223E0A202020203C.......32:T8b5," "------04ca85a004238f49e5e0Content-Disposition: form-data; name="hwid"23EBD35BE7F8D3C20DA4-d27478a5-2058-E584CC4------04ca85a004238f49e5e0Content-Disposition: form-data; name="build_id"29d72d28b7dcb3bfe0e7b93acea5fb70------04ca85a004238f49e5e0Content-Disposition: form-data; name="format"json------04ca85a004238f49e5e0--" HTTP/1.1 200 OK Date: Sat 04 Jul 2026 12:54:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Server: cloudflare Vary: Accept-Encoding Cf-Cache-Status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=260 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Y3kvlBVYaGWjoSKgaDjvuuzpj%2F0n3msyeEjSwTHxkl2l1oaQ9kFx0e%2F%2Fz4Gp8wBE3WMEGWUJYYn%2BsLpRf6B9bK9pnOlIoBV9lNno3Y68tD8C5uaTEyIXgkq24k%2FUbWhF888bWZg0x4tUeQ%3D%3D"}]} Content-Encoding: gzip CF-RAY: a15e4805eed7b586-SJC alt-svc: h3=":443"; ma=86400 with response body ==>626C6F636B.......41:Td0c,"status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress\" (Indicator: \"64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=3814697265625crypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeGetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWGetProcAddress\") in Source: e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.04901","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007020-00000C2B-2840541979\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007020-00000C2B-2840541979\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007020-00000C2B-2840361128\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\"\n Found system information discovery API: \"internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb\" in file \"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin\" has section name .rdata with entropy \"7.179425603351968\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\" \"------04ca85a004238f49e5e0Content-Disposition: form-data; name=\"hwid\"23EBD35BE7F8D3C20DA4-d27478a5-2058-E584CC4------04ca85a004238f49e5e0Content-Disposition: form-data; name=\"build_id\"29d72d28b7dcb3bfe0e7b93acea5fb70------04ca85a004238f49e5e0Content-Disposition: form-data; name=\"format\"json------04ca85a004238f49e5e0--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["suspicious","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6a49028368cedcfa740c78de","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"W64.Evo","contacted_countries":["GBR"],"submit_name":"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin","analysis_start_time":"2026-07-04T12:54:28+00:00","indicators_count":{"informative":147,"suspicious":27,"malicious":2},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"149.154.167.99","port":443,"protocol":"TCP","country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"address":"104.21.49.89","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}],"dns_resolutions":[{"domain":"juj.realmadridiran.news","address":"104.21.49.89","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"domain":"telegram.me","address":"149.154.167.99","ttl":101,"country":"United Kingdom","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}],"http_requests":[{"host":"telegram.me","host_ip":"149.154.167.99:443","url":"/w09ksp","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /w09ksp HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nHost: telegram.me","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"host":"juj.realmadridiran.news","host_ip":"104.21.49.89:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----04ca85a004238f49e5e0\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Safari/537.36 Edg/147.0.0.0\nContent-Length: 345\nHost: juj.realmadridiran.news","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}],"processes":[{"pid":7020,"ppid":0,"name":"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin.exe","command_line":"","sha256":"e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33","normalized_path":"C:\\e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33.bin.exe","uid":"00000000-00007020","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["webio.dll","IPHLPAPI.DLL","rsaenh.dll","cryptbase.dll","shlwapi.dll","cryptsp.dll","dpapi.dll","ucrtbase.dll","gdi32full.dll","powrprof.dll","mswsock.dll","dnsapi.dll","ntasn1.dll","ncryptsslp.dll","gpapi.dll","fltLib.dll","combase.dll","oleaut32.dll","imm32.dll","KernelBase.dll","rpcrt4.dll","user32.dll","gdi32.dll","sechost.dll","ole32.dll","winhttp.dll","OnDemandConnRouteHelper.dll","ntdll.dll","kernel32.dll","apphelp.dll","ws2_32.dll","advapi32.dll","cfgmgr32.dll","bcrypt.dll","sspicli.dll","win32u.dll","msvcp_win.dll","msvcrt.dll","winmm.dll","winmmbase.dll","nsi.dll","FWPUCLNT.DLL","crypt32.dll","VxSSL64.dll","bcryptprimitives.dll","winnsi.dll","rasadhlp.dll","schannel.dll","msasn1.dll","mskeyprotect.dll","ncrypt.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a49028368cedcfa740c78de"}]}]}},"report_ids":{"sandbox_job_ids":["6a49028368cedcfa740c78de"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_60% Sample e4a9a2dd5498… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e4a9a2dd5498…. Malware family: Win/malicious_confidence_60%. Threat score 87/100. 4/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_60% Sample e4a9a2dd5498… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e4a9a2dd5498…. Malware family: Win/malicious_confidence_60%. Threat score 87/100. 4/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e4a9a2dd549897824e652f48e0b98511f2a3a3e85d614126a6233a541faa7b33"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_60% Sample e4a9a2dd5498… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e4a9a2dd5498…. Malware family: Win/malicious_confidence_60%. Threat score 87/100. 4/27 AV engines flagged this file. 2 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L44","11",{}]]