34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T480,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ea3de7e7f4c2… — Score 35/100 — Hybrid Analysis","description":"Malicious verdict for sample ea3de7e7f4c2…. Malware family: Trojan.Generic. Threat score 35/100. 10/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122"],"about":{"@type":"SoftwareApplication","name":"bounty-62388904362694764","applicationCategory":["html"],"identifier":"ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122","additionalType":"Malicious sample"},"threatScore":35,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":2},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T949,"urlblockindex_1_.bin" has type "data"- [targetUID: 00000000-00001572] "8O7QICV4.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\8O7QICV4.txt]- [targetUID: 00000000-00003648] "~DF020913C00A0FC55B.TMP" has type "data"- Location: [%TEMP%\~DF020913C00A0FC55B.TMP]- [targetUID: 00000000-00001572] "bg-cropped_1_.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 progressive precision 8 713x1227 components 3"- [targetUID: 00000000-00001572] "search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: 00000000-00001572] "RecoveryStore._9689FD59-A7C5-11ED-950D-080027527FB8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: 00000000-00001572] "6TSGO1KZ.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\6TSGO1KZ.txt]- [targetUID: 00000000-00001572] "JavaDeployReg.log" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\JavaDeployReg.log]- [targetUID: 00000000-00003648] "SAE9JMZF.txt" has type "ASCII text"- Location: [%APPDATA%\Microsoft\Windows\Cookies\SAE9JMZF.txt]- [targetUID: 00000000-00001572] "en-US.4" has type "data"- Location: [%LOCALAPPDATA%\Microsoft\Internet Explorer\DomainSuggestions\en-US.4]- [targetUID: 00000000-00001572] "_AF50EC00-A7C7-11ED-950D-080027527FB8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: 00000000-00001572] "4Z88JEOR3L5PQUE5MBPU.temp" has type "data"- Location: [%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\4Z88JEOR3L5PQUE5MBPU.temp]- [targetUID: 00000000-00001572] "~DFF3F3D848131A2005.TMP" has type "data"- Location: [%TEMP%\~DFF3F3D848131A2005.TMP]- [targetUID: 00000000-00001572] "favicon_1_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: 00000000-00001572] "favicon_2_.ico" has type "MS Windows icon resource - 1 icon 32x32 32 bits/pixel"- [targetUID: 00000000-00001572] "search_1_.json" has type "JSON data"- [targetUID: 00000000-00001572] "~DF21147AE06B4D91F3.TMP" has type "data"- Location: [%TEMP%\~DF21147AE06B4D91F3.TMP]- [targetUID: 00000000-00001572] "_9689FD5B-A7C5-11ED-950D-080027527FB8_.dat" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: 00000000-00001572]37:T2586,"GET /img/bg-cropped.jpg HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: abc.xyz DNT: 1 Connection: Keep-Alive" "LX54L?{>o/g`#sF[8w'n>w9`;= E|Oc3}reyHl92\|64Q_K\d"%ku>v /#6}m_nv[&yflmiy4g+KCO[S[3g"fx}^<~fU/[__c<\Zf)nN=o_:9/{9e ,Xq`}DFg/+W}v=OVOK8L<:o[_Xkocssk<[1oy_ekW{os{ge5jl_)t<=.W$&s1k'ZJ=V"dbCy DS#+ZRMdD", " )VbmlIM}DS%H"+E1jndcmeKd6yLmgDW+D&67= ""07gc$6q\5nz9rLi#6g-yK*lDD@S/fPLlAI # J @ tD".s{NEpUxVmp@y5uzW'6<<}1H3-;5^f|kzo[kJ""-hXt\tB}. H+\Wf""HI#:BW"2]gk/_>3@x~Oc-w2o/ x:!/Xdpu+@Zeo4_+b c2y/D%@:tzV-yZo1@4Ftc_IP&fE`o@D@mcX3G<4p*f:g@"" %hBI9qf!2TYRsb8z}>~,TupyntIM4tG?ff|O+tm" .DdnxxhnT:';?ks8a;xqQfl64f''TfB35uD@:, `-n@!((&l"tlxIPfyTpyOzD5{\|<=3 ^/6Mo:X:k$@) @`0P-;}%f;uRJ", "[_sw/IG@#EWddp4I"'}jYP ;{Rq%Ja@bqq(PAB4Jhdl]9$lN*.)%Vi6{kdZL~2>h2ucJ@4o[;aY%M@4U.im DXYBW !Dow *Ki{FcjXx% )s;>nD^xfm9RUkZkZ+2^Oh4biLICj}kZs ktw,:}BJ]"Skz5yZ7kbU6[mZ1VOQs>M:\.l[r31eYQ'awxVlVhD)2"b1GiG9fBBoQJn:+MQn ntVyGhyw$*0x.NOig4M(R9LWX9{/({HO6,#ExR|J9,cfZn8Ql|Ifea5Fhq|G42l\PTnI[Y$&oM'&d "(Uosp+ $?pNi<;d[tDv%2:P>i^Yy#wkSOcC%EKNd0W: ^Ql5lG4[aE\F*;75=*V]2)J[L5 Tus2KEV=.%b4B)4V\w".$MLmNmvX+9 HSjiM)0{(EE" "FK[jmx=+3DE~!JR^L38*~_(>fAIIAGGK`xJS+mIQB*~mo:)JGeg7ZIshjDYmV$[n0Yv81)#m"f(+R7nU)p]^"uZdn "lw-WXzHNSla($.4o{ZOOOHP<(FpyNjqAY{rbH_nv+>K&tiP@:p ,N~6kVk(49%D5I]kZRmPJh[igRBx0!0S2J7U$p]@mVK6'YCAF=WUfD>go'iY6O&I5e<3K9*{]]oPCS(9B6!otMW+#\KZ2>A4=FDV{/=ux4jH_\'_jw(8rK9I6y') QOe\[ak&k)j\GaS%uDP'[OiTe&C{IP1I2H 4s1LPVw]=+}\yI{jS*%1Vy]8O8C" "`c"#VLneWcnv||4iTUG0W7y;=ZGN)KN@Y^ < ;Ga%m- ~RVG[ODg(a@M]U;$7$YTM1_)nc[yVn%fgyc ]~KS k#t\jdsP.%S5LY9RCF_C40.ov7ag *_8%Gf-Z|z>iT~Fj ;hHwCJ+V5XnCJ+?n=6YCJN4~QU ILFz&uL7~`TLXfc0cPZd2o\GLdGn;lzQ[%C)i %za)a@H z:::zB@ZW?U!1AQaq"2 BR`br#3@$0CPS%DTsc&4dt? A#i4M48,ucD!Gi EE)jrdK<0TqbI#6>hI^uL,hf WD~]GT'Q?i+m=T4&a)f-K;TJ2=AR6 Rki e%9Cr)dMI(mB"4Ru}J=&^rR~0x^#|R(TxHVVA{DJ,a'z'8uVMIkHP$,", "}Xa!TdVx 6V&U<(=A!BD L8lVq$V{@< Oh%$*42 oi6[p!$@DaV; P1'Q6E 2IkpP8>b:&<}*g7 hNaBfc|Ve U!BS:qmO PqJeBB3fPBmN8-(86',CU`-WJBDvlI:Gh9rNmbeW[e?\_] Y=e>cg_B q(YH$+5P*]i(V0B0u dp0Ylx0Av?9/.*%_l_%W>*I@5>2hNw8 &`a.!HWUB'4A5A-x4#[EMOg0IO4*JOQBe^isB]^\f jFR mKg|6@;6-HlS'hBMvUBl.OJ PZ dFPk Y?{|35!E.YNJ-fAB$^L `[g8|/:/08jAH8,WHmZ :>3 ]Q9C8[W6j AD&", "~Q4XZ=b$y[RSb9Wy'BlP:Mju:Dp'3t[An;oJW\KT^j91/[N*`&&V3sk[imFJR]UkP<^<.#e<]cUnI&RI! + IQIfPqz0+Q;!aZ )e %>X|Q]4DMa K_Qg @:BcIjCc3OP% JKk! vS'%<:ly7r Sza*X}5w&}zN,!xTiO /1VC(.MKrKHz#8}E&pS'8rwr?bi4Hq9_u>vqbTlj*UEe$^0LGNnK0Fwyn7.8F]Du`jm-IT#.rp'VtK*OWiDWUzQ1 PWCptLvRrsb_E])si_ay,Wa^9 n(VeuvR$]|'e ZXun$bQ1y$ej$#&(ir&lrJ<"Z9qOq M2 !/*n/Sua4@X e@Uvy3]2+!eg*(vdQ v{K5bWIG|Stmi?&bH`Ph(#JH# \)W]'.lI\BV*B"6F-=7)u#,cJ4w+!BRH 0t\ )H ki/K8YGj46&>+F*Sp4|E|bNp@YZ8@XvCD6*( Ry ZGt%6v`IW4*J\W5ZQ)Vva@4-=TJK [2zRsavY%iwDbN P8o7sddm RJJA4||R*s;OK&yMS P7Xn$A'[e/:K)zm0tsJvbn ,uv$()uAeqg9vVrJ]#4LJ9V aY4Jm`mhK0\7V[>Z>]-*%F9RvsMXmm# K P-qE @4^m"u]P@*8nyJ7RaDMR_za*dBZhGHb='Bp$B4%_Pm48<"MqKI!9-;! &Jn)pKu(_S|S~;$t-6GP1<6S%+ew4;", "71KkV!=f^/ad%KsLhkH#E2 rz"HU MICc/"lv ]l^2sKce%/\Qi`0_&tN=RbjM,).J:$tO|*Q K;gz:awr]W]c\ @`Qod#E%e*IBnbaa RQMB(,bhii}t24UC`,9"UQyj1ggm.{cH%TC=V76%eS]U$|33\*Jg k~0]Cm()4.!t8S bDFg 9ZFu+g]P&QV]6t`;E%cP!-Pc MS)eKP 'w;l o'.bmrKV4#JK0hM~@;=# UA$WR+175A#z8O/N=tTP6@ llG2L)9s_H+4u-Uu&i|zGOxs.t9CY*4YBg\BT*bI |>Pc}.jS,.]eXoo@iU%}4"", "Up+o=&nL3):UY(w{2M@uS:-[J B_*i:4RK$XtU8A~b`aX4`0ZEzUVq&XE@;Q(|M2 *B^2UN6#\yMcJN]:q0aI5A);gyI(p]Vg#lci5"blTl9tCLMzMV(fX1@GU@"oH!zm&;zvfEN$U`V(,f_1hiHW JBq/]P+cZ5(+?BuOjc 9EpPD&4IU/V'6_>I*;TU$$,.8i?G29z?]Q E>BKg4p~[K0W2'>!]"RA_PIRKi=BJE` H'M<#^l0iI%%TE/Qx3 VRz>R:p,aM+Il"O@Br6y>jWD#GRiTE-&%hSN7LCRHyy!iINU/T~P.@\JE 7&<6B@3&9)~Orm8T[=eF:##]d< <;uF$\+YX!D:OS \Z1WP]F)E]vZ*RBG4qV#*#/(hoHZ^KeQm9F|N}~g N11ZIu$6 *$IVwd;fVrL:%[.v" "Snsd+%fa!["YfU xLfe;E`Q*QF)ym[!v'~0v; hk& {Y'd< V 0)_V`Zj;hyydJZK5(F4l[G41@Yp+tPlr:i[9~s(z,`d}LT7^Pd~PJnAqYUDMQqBa'_T5a';E\B5=52O =QYd\DS5O2Qm A@66?&.(q@J@:qiQJ(x W0<#F<`e hwniQ@*( @PFD~^c-G*!e,'bVz-1OeU q4 ml}{x&;#iF4|7u=i:o8BHVaO|AqkY8yhuO5mlZ+UCW`Q[GL:,/!^zy`bMb>R qNi ) -Zv$sZ^tliY1~i ^^/t&^BWF"dER?yFezn|tL,2Y6*6B E/,u49=&Y'Y~]xU*s=XqD$V7~12DI+..lX h~m'y(>fZja,=0 4+$U`PAIQdZQ/{T6cV 4EujS9@bBO^S*>rR>RF*U7$ulK8)P4Oa4@3#Q(jk]6t;e}h%iJq!@)*nTd#=q5SOXt{ENQsn 8G1'*+YAo9vjk\9'@ODe+yWjQhCJfUJh(9(pW!gc)oZGEcZZbiwRMk_iL4R2 U8*[r=-n6NXTAES1 B[Q@MiM"zm8 (t@ dGutBMA M6I(4 D8G$O", "1H*]FU.5(7x8SH.azi>HMTKGT+$'5Q p4+y5>GDxJBW*T5'%JY@Kd&%go%'-eT&>Jw,V^Z#t125+^4^ &u{!m,v,vVT cr5ithQ.8`F^dEHDToS.ch=&)$VFY*?zf&AMR(X@F|kt3W2ltf:F.U,)>*k [5J H| F%rRL:Py:BeyyBHE "QrG< X>T$K>TLNER|+X"7#0uRJ(q9i JMs+<|Cqx#de'm,`}l 6Ba; @5TWN)hh jRH pEiV:38g[K SMDB\V1$X_QuegD.SLYB@yW%%Y_u5u"b@T!vpU:wCg^h0a*5lS=4&P*/ZS4u0%dhC7Wo\$("D5bZ_4$>YD~m>RCbFI 3LByG[/ia+fluc;ZC-$!E|>y[_Rd$In4nXRt6${!*& u6y+*QK4C'mmIMBQB nXX8L)$-B'EOe'+>@S5#>x,Vm6UO6V$Eb $"atOWT&\TSQjR!"hL)H6UP(oqx+$HrS4mYxPcRj6cHi/?Y)C|KH :1nQ'uWq~k:6>G+cKGdz4 }"`6tG-nnIv>7trL|8.<3IC7~I[n]g5!5vj" "CMw4BT)$J~NLaU!')(pj8rrav8 U!6Vm'?^w# 'NjQ*bDl,oPpA1Q2h8taK;NO8:)>.O-N#~M5 m(P7EVl\t()9~Pi)*R {W|$qU02e }1;.w[^HI!PuOM)5o5&\AvejZjH" +/eVm' !$&uMP;#h <1W}~AtA%b:B%>p:$UJ& V|hLF'eOt-NuUD5ispT7 ?'\8Sf*)Xji(1cIB;ji$:_omR%;Ts@hCRV+ 2.-DEE*cI4y)VTIe)HZiv]v(f#g-8K/vl;LD?+R=$BH48YXr[5K8IG9sS4\Xe:7-wHl{k&< e8 4i\@)j)/Sem99>UPjj j-'b=jb]61TMK J{H {Yq9_\q=4M'*VJH\L5;6(dGatD^TE@ *:7KLn|~q'[L-=]:Da8HRH(cHh?(SbK| .%]_h>`&*{2}+Eg>IPmak T@pN\Ih2JGYGbD?>GF|e^zi(6;Pc(6QOpb1 u!@t:Zw^N[ ", "zCC#N(.~n)I?9|AlVeI:r;|S$4t9+vDS<9R[NnithTq>CI)5Cm-PH S|>U;^>ILHw%^)SRMlfOrP(e}Y4^l>_xYj1ZIJbM)J=eh`V7Fl8(~9<8EzvG%Z{+kvO|%BPWX<* b`vBqhWY*1*Q#2%Z_6-2EHIy6Zmy$?g O5rM>p>HCQYv6~l|l =tRN@,D;^-7FtnQhdm*bE_;QTa0"E=yt86RcZd54b6rS.IyFKPcHia;?K)=F8{DhN*T>*R\nC!5}ihi^~JI)WR)v&uIFWqJ4Yhe2iE7S+=&J }vL*mJR(`7rt< 6@`ijRiW 6WMI1GRrAhJT9+>J0IhE{T#r6GiWkO'K0$je l4 B\A*Czd*US7\/H$lRew E#3VmGq9@NYsWV7![ltXMvRxA&G" "U4QU$pR4Q$eJ Ud m|N[.PR n(}FMj8~ UPxB&YeWzw}S Ti/UDQ+fK+j*'A<; /ZmZ `g0pTB_S@)H9ewu'b/6Q\I ?"`d(MAZ(I:7#8%./`>HD+_^&I:(Mj8=~f'*m5j^']V%+;XRW%G`IIU=!r,MEA=SARu`'.m$/ziSm>*kIc VLYJq", "L@Y?a&b_8RV !/:&vBJ )9>@"Y+pUQACm7&=FJ4E1;'@+ufr@{eNlUL`@6| "+0i8[EJa2RmImY'.[lEHG|k?7iXH>JEF(=/$!%T2> 5'ah] VI7wqhW3MrMI|GregX)Z<(UNA [(Cyo_'I}1,%i pD`&_i(5WKP,)X]ay~*06=}a IG|H>9QWBL?pyRvRkZ8\4* *M0T"")5Chet|PmU< 5LQb"gK?PBr '(EHvcgeQPuon LPhR-a? JTpO-e~8!ll-H}aP"du[ k-W80"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":35,"unified_at_epoch_ms":1793944619119,"unified_at":"2026-11-06T05:56:59.119Z","metadata":{"hashes":{"sha256":"ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122","sha1":"3fc88c0dd8a2613d79b2eeae3afeaa4d283a2703","md5":"5aae5ce999ebbbdbb1f296a7681ba337","sha512":"aab8148b71a8620d956268e21f62df6d4103e8b7eca0e6ac4136b88a19986dd2aab19bb7dc17160bd9e35bba2d6d9a5e72c03a2706ddb560c3af6f25d86b79d9","ssdeep":"1536:Aalrx8RL86fZ1i7oGSB3u3QBhEFy/1Kp///Bgf0XAnEwwZIyFzTexE9PlY44P9xI:AyWRHGohBeQYy1URyVy+xQCxFJl8DMm","ssdeep_chunks":["1536:Aalrx8R","1536:alrx8RL","1536:lrx8RL8","1536:rx8RL86","1536:x8RL86f","1536:8RL86fZ","1536:RL86fZ1","1536:L86fZ1i","1536:86fZ1i7","1536:6fZ1i7o","1536:fZ1i7oG","1536:Z1i7oGS","1536:1i7oGSB","1536:i7oGSB3","1536:7oGSB3u","1536:oGSB3u3","1536:GSB3u3Q","1536:SB3u3QB","1536:B3u3QBh","1536:3u3QBhE","1536:u3QBhEF","1536:3QBhEFy","1536:QBhEFy/","1536:BhEFy/1","1536:hEFy/1K","1536:EFy/1Kp","1536:Fy/1Kp/","1536:y/1Kp//","1536:/1Kp///","1536:1Kp///B","1536:Kp///Bg","1536:p///Bgf","1536:///Bgf0","1536://Bgf0X","1536:/Bgf0XA","1536:Bgf0XAn","1536:gf0XAnE","1536:f0XAnEw","1536:0XAnEww","1536:XAnEwwZ","1536:AnEwwZI","1536:nEwwZIy","1536:EwwZIyF","1536:wwZIyFz","1536:wZIyFzT","1536:ZIyFzTe","1536:IyFzTex","1536:yFzTexE","1536:FzTexE9","1536:zTexE9P","1536:TexE9Pl","1536:exE9PlY","1536:xE9PlY4","1536:E9PlY44","1536:9PlY44P","1536:PlY44P9","1536:lY44P9x","1536:Y44P9xI","3072:Aalrx8R","3072:alrx8RL","3072:lrx8RL8","3072:rx8RL86","3072:x8RL86f","3072:8RL86fZ","3072:RL86fZ1","3072:L86fZ1i","3072:86fZ1i7","3072:6fZ1i7o","3072:fZ1i7oG","3072:Z1i7oGS","3072:1i7oGSB","3072:i7oGSB3","3072:7oGSB3u","3072:oGSB3u3","3072:GSB3u3Q","3072:SB3u3QB","3072:B3u3QBh","3072:3u3QBhE","3072:u3QBhEF","3072:3QBhEFy","3072:QBhEFy/","3072:BhEFy/1","3072:hEFy/1K","3072:EFy/1Kp","3072:Fy/1Kp/","3072:y/1Kp//","3072:/1Kp///","3072:1Kp///B","3072:Kp///Bg","3072:p///Bgf","3072:///Bgf0","3072://Bgf0X","3072:/Bgf0XA","3072:Bgf0XAn","3072:gf0XAnE","3072:f0XAnEw","3072:0XAnEww","3072:XAnEwwZ","3072:AnEwwZI","3072:nEwwZIy","3072:EwwZIyF","3072:wwZIyFz","3072:wZIyFzT","3072:ZIyFzTe","3072:IyFzTex","3072:yFzTexE","3072:FzTexE9","3072:zTexE9P","3072:TexE9Pl","3072:exE9PlY","3072:xE9PlY4","3072:E9PlY44","3072:9PlY44P","3072:PlY44P9","3072:lY44P9x","3072:Y44P9xI","1536:AyWRHGo","1536:yWRHGoh","1536:WRHGohB","1536:RHGohBe","1536:HGohBeQ","1536:GohBeQY","1536:ohBeQYy","1536:hBeQYy1","1536:BeQYy1U","1536:eQYy1UR","1536:QYy1URy","1536:Yy1URyV","1536:y1URyVy","1536:1URyVy+","1536:URyVy+x","1536:RyVy+xQ","1536:yVy+xQC","1536:Vy+xQCx","1536:y+xQCxF","1536:+xQCxFJ","1536:xQCxFJl","1536:QCxFJl8","1536:CxFJl8D","1536:xFJl8DM","1536:FJl8DMm"],"imphash":"Unknown"},"file_info":{"file_name":"bounty-62388904362694764","file_type":["html"],"file_type_id":"html","file_size":171231,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675870446000,"last_seen":1677253417000,"last_multi_scan":1677253417000}},"detections":{"summary":{"verdict":"malicious","score":35,"tags":null},"stats":{"av":{"malicious_count":10,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":7},"sandbox_signatures":{"informative_count":13,"suspicious_count":2,"malicious_count":0,"total":15},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/HTA.SAgent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"EXP/OneNote.cwu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65486960","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Onenote.Downloader.Agent-9986651-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"ONE/Agent.I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65486960 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/OneHta-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.HTA.Agent.IA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.SAgent.Script.103","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}],"sandbox_signatures":[{"level":"informative","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"Key\" (Indicator: \"key\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":10,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"142.250.191.46:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_519\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"UpdatingNewTabPageData\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"IsoScope_624_IESQMMUTEX_0_331\"\n \"IsoScope_624_IESQMMUTEX_0_303\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"IsoScope_624_ConnHashTable<1572>_HashTable_Mutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"IsoScope_624_IESQMMUTEX_0_519\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1572\"\n \"IsoScope_624_IE_EarlyTabStart_0xf98_Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_303\"\n \"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_331\"\n \"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\"WScript.Shell\" [Source: ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122.bin]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"GET /img/bg-cropped.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: abc.xyz\nDNT: 1\nConnection: Keep-Alive\" (Indicator: \"mozilla/5.0 (\")\n \"GET /img/bg-cropped.jpg HTTP/1.1\nAccept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5\nAccept-Language: en-US\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko\nAccept-Encoding: gzip, deflate\nHost: abc.xyz\nDNT: 1\nConnection: Keep-Alive\" (Indicator: \"user-agent: \")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$36","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"iexplore.exe\" writes a file \"%TEMP%\\JavaDeployReg.log\"\n \"iexplore.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{9689FD59-A7C5-11ED-950D-080027527FB8}.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$37","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://abc.xyz/img/bg-cropped.jpg\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 142.250.191.46 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"8O7QICV4.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\8O7QICV4.txt]- [targetUID: 00000000-00003648]\n Dropped file: \"6TSGO1KZ.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\6TSGO1KZ.txt]- [targetUID: 00000000-00001572]\n Dropped file: \"SAE9JMZF.txt\" - Location: [%APPDATA%\\Microsoft\\Windows\\Cookies\\SAE9JMZF.txt]- [targetUID: 00000000-00001572]\n Dropped file: \"4Z88JEOR3L5PQUE5MBPU.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\4Z88JEOR3L5PQUE5MBPU.temp]- [targetUID: 00000000-00001572]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/90 reputation engines marked \"http://gotobestdeals.com/images/pixel.gif\" as malicious (3% detection rate)\n 5/90 reputation engines marked \"https://transfer.sh\" as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/60 Antivirus vendors marked sample as malicious (6% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":25,"imported_dlls_count":130,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"63e3cbedaf478b3cea14d662","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"malware_family":"Onenote.Downloader.Agent","contacted_countries":["USA"],"submit_name":"ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122.one","analysis_start_time":"2023-02-08T16:21:02+00:00","indicators_count":{"informative":13,"suspicious":2,"malicious":0},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"142.250.191.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}],"processes":[{"pid":1572,"ppid":0,"name":"iexplore.exe","command_line":"C:\\ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122.html","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","uid":"00000000-00001572","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB7klEQVR42u2XzYrqMBiG5w5FdOeleBsiWLs8unfhHYg7F4J/iHjc+DszbRfaf/ue8yV0qh2DTeLs5oMXWmjyPGnyFfr29lu/lavpdIr9fo/T6YTD4VAw/PntdovhcIhSqQRlgdlshiRJoFJRFIHGk0SlUoGyQBAEbEISSZIrrldRYsRxFqrVaoXlconJZIJyuQxNATE4D08FNpu/2O127H48HqNWq0FZoMiqs0RsDK1+vV6za9u2MRgMUK1WISXg+75QQARPBebzObrdP//TRafTQa/XQ7/ff5WAGE4HkJLW8XhkMqPRiEloCsRCeArOEiIMw7tOWiwWOgLPV30LTwV4aJ4El8tFVUAHHrCQgOM4sgIee4XPX3kemoGpkyg0j+PYcgKelxeIlOBB4LNviaaAHDwT8F8hoAdPBeiDJCngsoGiFhOD7wXoMFMn2bYlL0ADi5zy/J7fwrlALC/gunkBNTh1k6ZAKA3nAt5XNATiAm0mXvmtgGUpCFALFjnlIjCFuom6yLI+dQSKwL+DeVwdgfBpiz2CcwH3K4oCFzawyCl/vPoXCejClQTov+B8PrP953AvJ+B+C20ZST9KGEb4+HiXE/iJKixQr9fRbDZhmm202zyGkV4bdzEMSuthWi0e0zTRaDTU/5R+uv4BptK4NzAQLaQAAAAASUVORK5CYII="},{"pid":3648,"ppid":1572,"name":"iexplore.exe","command_line":"SCODEF:1572 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00001572","uid":"00000000-00003648"}],"all_imported_dlls":["clbcatq.dll","dhcpcsvc6.dll","duser.dll","d3d11.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","msvcrt.dll","user32.dll","sspicli.dll","winnsi.dll","msctf.dll","ws2_32.dll","IEShims.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","rsaenh.dll","Wpc.dll","imm32.dll","nlaapi.dll","version.dll","userenv.dll","msvcr100.dll","wintrust.dll","msimtf.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","webio.dll","msasn1.dll","ExplorerFrame.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","cryptbase.dll","d2d1.dll","fltLib.dll","cryptsp.dll","rpcss.dll","dwmapi.dll","mscoree.dll","sechost.dll","usp10.dll","IPHLPAPI.DLL","WindowsCodecs.dll","credssp.dll","mlang.dll","deploy.dll","npmproxy.dll","wininet.dll","msimg32.dll","mpr.dll","samcli.dll","ole32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","crypt32.dll","mscorwks.dll","slc.dll","winhttp.dll","wevtapi.dll","cscapi.dll","sxs.dll","comctl32.dll","ncrypt.dll","mscoreei.dll","linkinfo.dll","sqmapi.dll","mswsock.dll","RpcRtRemote.dll","rpcrt4.dll","oleaccrc.dll","FWPUCLNT.DLL","netprofm.dll","setupapi.dll","advapi32.dll","ieui.dll","apphelp.dll","schannel.dll","url.dll","cfgmgr32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","urlmon.dll","profapi.dll","wshqos.dll","scrrun.dll","imageres.dll","MSOHEV.DLL","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","comdlg32.dll","netutils.dll","rasadhlp.dll","propsys.dll","Wldap32.dll","DWrite.dll","shlwapi.dll","shell32.dll","wship6.dll","d3d10warp.dll","imagehlp.dll","ssv.dll","ntshrui.dll","normaliz.dll","devobj.dll","WSHTCPIP.DLL","dui70.dll","bcryptprimitives.dll","gpapi.dll","jp2ssv.dll","iertutil.dll","lpk.dll","secur32.dll","mshtml.dll","jscript9.dll","ntdll.dll","netapi32.dll","ieproxy.dll","dhcpcsvc.dll","bcrypt.dll","msvcr90.dll","wkscli.dll","ntmarta.dll","samlib.dll","gdi32.dll","oleacc.dll","nsi.dll","dnsapi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dxgi.dll","KernelBase.dll","ieframe.dll","uxtheme.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","srvcli.dll","URLREDIR.DLL","kernel32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"favicon_1_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"favicon_2_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"6TSGO1KZ.txt","sha256":"c57edb67b11e09c5a77363349aac5f08d90699a5ce10e852bf5a6e38ec8794d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"8O7QICV4.txt","sha256":"b8a3a6f11e5c6710373b2faf4599e19d72a8734bdb1d7fee97a0f5e7fb1696a4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"SAE9JMZF.txt","sha256":"b4f2e04fad5af5b9fbfcbc7890ef540ee70c5718322ec7aca504dffa30bd948a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"4Z88JEOR3L5PQUE5MBPU.temp","sha256":"b681bf53bbe6fabf2f2d1273efc69cb7276655811399fcba21118b487bbfac4a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"en-US.4","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"JavaDeployReg.log","sha256":"4cf4f407d895dbace5d4a707da3ec5d3ed4d25b204cc9f4d2776b4ed2156b764","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"~DF020913C00A0FC55B.TMP","sha256":"8e0ba90c37f0d999d01dc50b31ccd736cc9824530f48794804a6b171c530f945","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"~DF21147AE06B4D91F3.TMP","sha256":"2112a52eab21bcc367ba2c5b93e8af120bf4c2e9bc1a57c5b3593685cc5cfd62","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"~DFF3F3D848131A2005.TMP","sha256":"96efbf3e7a4635e12e79cae46b0d5add1f6f2894f28ded4da51df03e262bd8ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"bg-cropped_1_.jpg","sha256":"e3e1120cd1d079bff16387daa06256e703fe6bed3e1c3a2281d184af3b7b5d1a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"search__0633EE93-D776-472f-A0FF-E1416B8B2E3A_.ico","sha256":"5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"RecoveryStore._9689FD59-A7C5-11ED-950D-080027527FB8_.dat","sha256":"386cbaa665a3d1e90c6f19cc080fc6123c9bb5bcd54e8768958d0fd0ba9ceb96","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"_AF50EC00-A7C7-11ED-950D-080027527FB8_.dat","sha256":"841099c773413a86d6108c6222e986db00e06b2d12b6df95e6307516a0088817","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"search_1_.json","sha256":"19170bd75edc0b5183a2f9fcc3001d9d222deff61e5915ad1127b65ab581a2a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"_9689FD5B-A7C5-11ED-950D-080027527FB8_.dat","sha256":"47399c1ddf9f577fca1b69a01a37838babf695bf84e6fd91226346db34eccb04","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%TEMP%\\~DFF3F3D848131A2005.TMP","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%TEMP%\\~DF020913C00A0FC55B.TMP","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\bg-cropped[1].jpg","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[1].ico","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[2].ico","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%TEMP%\\~DF21147AE06B4D91F3.TMP","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Last Active\\RecoveryStore.{88B090C0-D917-11E7-B67B-080027A49DD6}.dat","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%TEMP%\\~DF4D99C8FE1DF5E091.TMP","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.4","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\6TSGO1KZ.txt","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\STATS\\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\\IEXPLORE\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\STATS\\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\\IEXPLORE\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\STATS\\{B4F3A835-0E21-4959-BA22-42B3008E02FF}\\IEXPLORE\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXT\\STATS\\{DBC80044-A445-435B-BC74-9C25C1C588A9}\\IEXPLORE\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"IsoScope_624_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"IsoScope_624_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"IsoScope_624_ConnHashTable<1572>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"IsoScope_624_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_1572","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"IsoScope_624_IE_EarlyTabStart_0xf98_Mutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_624_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"IsoScope_624_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"63e3cbedaf478b3cea14d662"}]}]}},"report_ids":{"sandbox_job_ids":["63e3cbedaf478b3cea14d662"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ea3de7e7f4c2… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ea3de7e7f4c2…. Malware family: Trojan.Generic. Threat score 35/100. 10/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ea3de7e7f4c2… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ea3de7e7f4c2…. Malware family: Trojan.Generic. Threat score 35/100. 10/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ea3de7e7f4c2b293a98e568251dd7f36c4e199586df33f3140164d347fd8f122"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ea3de7e7f4c2… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ea3de7e7f4c2…. Malware family: Trojan.Generic. Threat score 35/100. 10/27 AV engines flagged this file. 0 malicious and 2 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null