25:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 26:T996,Found string "System.Collections.Generic.IEnumerator.Current" (Indicator: "smtp"; Source: "sample.bin"), Found string "SMTP endpoint failed." (Indicator: "smtp"; Source: "sample.bin"), Found string "SMTP fallback failed for the full message." (Indicator: "smtp"; Source: "sample.bin"), Found string "d__11" (Indicator: "smtp"; Source: "sample.bin"), Found string "Message sent through SMTP fallback with quoted history removed." (Indicator: "smtp"; Source: "sample.bin"), Found string " | SMTP fallback: " (Indicator: "smtp"; Source: "sample.bin"), Found string "SMTP" (Indicator: "smtp"; Source: "sample.bin"), Found string "ShouldTrySmtpFallback" (Indicator: "smtp"; Source: "sample.bin"), Found string "No SMTP endpoint was attempted." (Indicator: "smtp"; Source: "sample.bin"), Found string "System.Collections.Generic.IEnumerable.GetEnumerator" (Indicator: "smtp"; Source: "sample.bin"), Found string "SendWithSmtp" (Indicator: "smtp"; Source: "sample.bin"), Found string "SMTP fallback does not create a server Sent Items copy; the client keeps a local sent copy." (Indicator: "smtp"; Source: "sample.bin"), Found string "SmtpEndpoint" (Indicator: "smtp"; Source: "sample.bin"), Found string "System.Collections.Generic.IEnumerator.get_Current" (Indicator: "smtp"; Source: "sample.bin"), Found string "SMTP compact fallback failed." (Indicator: "smtp"; Source: "sample.bin"), Found string "KExchangePortableClient.Services.ExchangeSendService+d__11" (Indicator: "smtp"; Source: "sample.bin"), Found string "Trying SMTP fallback through " (Indicator: "smtp"; Source: "sample.bin"), Found string "CreateSmtpMessage" (Indicator: "smtp"; Source: "sample.bin"), Found string "SmtpClient" (Indicator: "smtp"; Source: "sample.bin"), Found string "AddSmtpBodyAndAttachments" (Indicator: "smtp"; Source: "sample.bin"), Found string "NormalizeSmtpAddress" (Indicator: "smtp"; Source: "sample.bin"), Found string "GetSmtpHost" (Indicator: "smtp"; Source: "sample.bin"), Found string "SendWithSmtpFallback" (Indicator: "smtp"; Source: "sample.bin"), Found string "SMTP host could not be derived from EWS URL." (Indicator: "smtp"; Source: "sample.bin"), Found string "GetSmtpEndpoints" (Indicator: "smtp"; Source: "sample.bin")27:Ta90,Found reference to API "_searchDebounceTimer" (Indicator: "time"; Source: "sample.bin"), Found reference to API "Network error while connecting to Exchange." (Indicator: "connect"; Source: "sample.bin"), Found reference to API "get_ServerSentCopyCreated" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "OpenConnection" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "OpenConnection" (Indicator: "open"; Source: "sample.bin"), Found reference to API "MapDeleteError" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "SelectFolderById" (Indicator: "select"; Source: "sample.bin"), Found reference to API "set_CreateNoWindow" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "set_ConnectionFailedFolders" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "d__109" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "d__131" (Indicator: "select"; Source: "sample.bin"), Found reference to API "d__131" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SyncService" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "9Adapter name or local IPv4 used for Exchange connections." (Indicator: "connect"; Source: "sample.bin"), Found reference to API "add_CancelSyncRequested" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "get_ReadIndicator" (Indicator: "read"; Source: "sample.bin"), Found reference to API "InitializeEditorCoreAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "_markAsReadPendingMessageId" (Indicator: "read"; Source: "sample.bin"), Found reference to API "IsRead" (Indicator: "read"; Source: "sample.bin"), Found reference to API "d__45" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "remove_SyncRequested" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "HExchangePortableClient.Views.ComposeWindow+d__72" (Indicator: "select"; Source: "sample.bin"), Found reference to API "ExecuteReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "The selected synchronization problems have no Exchange item IDs." (Indicator: "select"; Source: "sample.bin"), Found reference to API "The selected synchronization problems have no Exchange item IDs." (Indicator: "sync"; Source: "sample.bin"), Found reference to API "get_UtcDateTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "_consecutiveTransientSyncFailures" (Indicator: "sync"; Source: "sample.bin")28:T292e,"INSERT INTO KnownRecipients (DisplayName, Email, CompanyName, BusinessPhone, MobilePhone, Source, LastUsedUtc) VALUES (@DisplayName, @Email, @CompanyName, @BusinessPhone, @MobilePhone, @Source, @LastUsedUtc);" (Source: sample.bin, Indicator: "insert into knownrecipients (displayname, email, companyname, businessphone, mobilephone, source, lastusedutc) values (@displayname, @email, @companyname, @businessphone, @mobilephone, @source, @lastusedutc);"), "UPDATE Messages SET LocalDeleted = 1, UpdatedUtc = @UpdatedUtc WHERE Id = @Id;" (Source: sample.bin, Indicator: "update messages set localdeleted = 1, updatedutc = @updatedutc where id = @id;"), "UPDATE Messages SET ReminderShownUtc = @Now, ReminderSnoozeUntilUtc = NULL, UpdatedUtc = @Now WHERE IsReminderSet = 1 AND ReminderShownUtc IS NULL AND LocalDeleted = 0 AND ReminderDueByUtc IS NOT NULL AND ReminderDueByUtc != '' AND ReminderDueByUtc < @Now;" (Source: sample.bin, Indicator: "update messages set remindershownutc = @now, remindersnoozeuntilutc = null, updatedutc = @now where isreminderset = 1 and remindershownutc is null and localdeleted = 0 and reminderduebyutc is not null and reminderduebyutc != '' and reminderduebyutc < @now;"), "UPDATE Messages SET ReminderSnoozeUntilUtc = @Until, ReminderShownUtc = NULL, UpdatedUtc = @Now WHERE Id = @Id OR (MeetingStartUtc IS NOT NULL AND trim(MeetingStartUtc) != '' AND EXISTS (SELECT 1 FROM Messages selected WHERE selected.Id = @Id AND selected.MeetingStartUtc = Messages.MeetingStartUtc AND lower(trim(ifnull(selected.Subject, ''))) = lower(trim(ifnull(Messages.Subject, ''))) AND lower(trim(ifnull(selected.MeetingOrganizer, ''))) = lower(trim(ifnull(Messages.MeetingOrganizer, '')))));" (Source: sample.bin, Indicator: "update messages set remindersnoozeuntilutc = @until, remindershownutc = null, updatedutc = @now where id = @id or (meetingstartutc is not null and trim(meetingstartutc) != '' and exists (select 1 from messages selected where selected.id = @id and selected.meetingstartutc = messages.meetingstartutc and lower(trim(ifnull(selected.subject, ''))) = lower(trim(ifnull(messages.subject, ''))) and lower(trim(ifnull(selected.meetingorganizer, ''))) = lower(trim(ifnull(messages.meetingorganizer, '')))));"), "SELECT COUNT(1) FROM Messages WHERE FolderId = @FolderId AND LocalDeleted = 0 AND IsRead = 0;" (Source: sample.bin, Indicator: "select count(1) from messages where folderid = @folderid and localdeleted = 0 and isread = 0;"), "UPDATE Messages SET IsRead = 1, UpdatedUtc = @UpdatedUtc WHERE Id = @Id;" (Source: sample.bin, Indicator: "update messages set isread = 1, updatedutc = @updatedutc where id = @id;"), "InsertPlainTextIntoEditorAsync" (Source: sample.bin, Indicator: "insertplaintextintoeditorasync"), "INSERT INTO Contacts (DisplayName, Email, CompanyName, BusinessPhone, MobilePhone) SELECT DisplayName, Email, CompanyName, BusinessPhone, MobilePhone FROM KnownRecipients;" (Source: sample.bin, Indicator: "insert into contacts (displayname, email, companyname, businessphone, mobilephone) select displayname, email, companyname, businessphone, mobilephone from knownrecipients;"), "INSERT OR REPLACE INTO AccountSettings (Id, AccountName, DisplayName, Email, EwsUrl, Login, IgnoreSslErrors, UpdatedUtc) VALUES (1, @AccountName, @DisplayName, @Email, @EwsUrl, @Login, @IgnoreSslErrors, @UpdatedUtc);" (Source: sample.bin, Indicator: "insert or replace into accountsettings (id, accountname, displayname, email, ewsurl, login, ignoresslerrors, updatedutc) values (1, @accountname, @displayname, @email, @ewsurl, @login, @ignoresslerrors, @updatedutc);"), "SELECT ExchangeItemId, FolderDisplayName, Subject, Sender, ItemClass, HasAttachments, FailureCategory, FailureStage, LastError, FailedUtc, Attempts, SkipUntilUtc FROM FailedItems ORDER BY FailedUtc DESC;" (Source: sample.bin, Indicator: "select exchangeitemid, folderdisplayname, subject, sender, itemclass, hasattachments, failurecategory, failurestage, lasterror, failedutc, attempts, skipuntilutc from faileditems order by failedutc desc;"), "SELECT ExchangeDeleted FROM Messages WHERE ExchangeItemId = @ExchangeItemId LIMIT 1;" (Source: sample.bin, Indicator: "select exchangedeleted from messages where exchangeitemid = @exchangeitemid limit 1;"), "UPDATE FailedItems SET Attempts = 0, SkipUntilUtc = '' WHERE ExchangeItemId = @ExchangeItemId;" (Source: sample.bin, Indicator: "update faileditems set attempts = 0, skipuntilutc = '' where exchangeitemid = @exchangeitemid;"), "SELECT F.Id, F.ExchangeFolderId, F.DisplayName, F.WellKnownName, F.LocalPath, F.IsSystem, (SELECT COUNT(1) FROM Messages M WHERE M.FolderId = F.Id AND M.LocalDeleted = 0 AND M.IsRead = 0) AS UnreadCount FROM Folders F WHERE ExchangeFolderId IS NOT NULL AND DisplayName NOT LIKE '{%' AND (WellKnownName IN ('IPF.Appointment', 'IPF.Task') OR WellKnownName LIKE 'IPF.Contact%' OR DisplayName IN ('Birthdays', 'Calendar', 'Contacts', 'Suggested Contacts')) AND DisplayName NOT IN ('Recipient Cache', 'PeopleCentricConversation Buddies') ORDER BY DisplayName COLLATE NOCASE;" (Source: sample.bin, Indicator: "select f.id, f.exchangefolderid, f.displayname, f.wellknownname, f.localpath, f.issystem, (select count(1) from messages m where m.folderid = f.id and m.localdeleted = 0 and m.isread = 0) as unreadcount from folders f where exchangefolderid is not null and displayname not like '{%' and (wellknownname in ('ipf.appointment', 'ipf.task') or wellknownname like 'ipf.contact%' or displayname in ('birthdays', 'calendar', 'contacts', 'suggested contacts')) and displayname not in ('recipient cache', 'peoplecentricconversation buddies') order by displayname collate nocase;"), "INSERT INTO Contacts (DisplayName, Email, CompanyName, BusinessPhone, MobilePhone) VALUES (@DisplayName, @Email, @CompanyName, @BusinessPhone, @MobilePhone);" (Source: sample.bin, Indicator: "insert into contacts (displayname, email, companyname, businessphone, mobilephone) values (@displayname, @email, @companyname, @businessphone, @mobilephone);"), "SELECT M.Id, M.SentAuditId, M.Subject, M.ToRecipients, COALESCE(NULLIF(M.DateTimeSentUtc, ''), M.DateTimeReceivedUtc) FROM Messages M JOIN Folders F ON F.Id = M.FolderId WHERE lower(F.DisplayName) = 'sent items' AND M.LocalDeleted = 0 ORDER BY M.Id;" (Source: sample.bin, Indicator: "select m.id, m.sentauditid, m.subject, m.torecipients, coalesce(nullif(m.datetimesentutc, ''), m.datetimereceivedutc) from messages m join folders f on f.id = m.folderid where lower(f.displayname) = 'sent items' and m.localdeleted = 0 order by m.id;"), "SELECT LastRefreshUtc FROM ContactSyncState WHERE Id = 1;" (Source: sample.bin, Indicator: "select lastrefreshutc from contactsyncstate where id = 1;"), "UPDATE Messages SET ExchangeDeleted = 1, UpdatedUtc = @UpdatedUtc WHERE ExchangeItemId = @ExchangeItemId;" (Source: sample.bin, Indicator: "update messages set exchangedeleted = 1, updatedutc = @updatedutc where exchangeitemid = @exchangeitemid;"), "INSERT INTO Messages (ExchangeItemId, InternetMessageId, FolderId, FromName, FromEmail, ToRecipients, CcRecipients, BccRecipients, Subject, PreviewText, DateTimeReceivedUtc, DateTimeSentUtc, IsRead, HasAttachments, HtmlBody, TextBody, BodyFormat, SentAuditId, ExchangeDeleted, LocalDeleted, IsReminderSet, ReminderDueByUtc, MeetingStartUtc, MeetingEndUtc, MeetingLocation, MeetingOrganizer, MeetingRequiredAttendees, MeetingOptionalAttendees, CreatedUtc, UpdatedUtc) VALUES (@ExchangeItemId, @InternetMessageId, @FolderId, @FromName, @FromEmail, @ToRecipients, @CcRecipients, @BccRecipients, @Subject, @PreviewText, @DateTimeReceivedUtc, @DateTimeSentUtc, @IsRead, @HasAttachments, @HtmlBody, @TextBody, @BodyFormat, @SentAuditId, 0, 0, @IsReminderSet, @ReminderDueByUtc, @MeetingStartUtc, @MeetingEndUtc, @MeetingLocation, @MeetingOrganizer, @MeetingRequiredAttendees, @MeetingOptionalAttendees, @CreatedUtc, @UpdatedUtc);" (Source: sample.bin, Indicator: "insert into messages (exchangeitemid, internetmessageid, folderid, fromname, fromemail, torecipients, ccrecipients, bccrecipients, subject, previewtext, datetimereceivedutc, datetimesentutc, isread, hasattachments, htmlbody, textbody, bodyformat, sentauditid, exchangedeleted, localdeleted, isreminderset, reminderduebyutc, meetingstartutc, meetingendutc, meetinglocation, meetingorganizer, meetingrequiredattendees, meetingoptionalattendees, createdutc, updatedutc) values (@exchangeitemid, @internetmessageid, @folderid, @fromname, @fromemail, @torecipients, @ccrecipients, @bccrecipients, @subject, @previewtext, @datetimereceivedutc, @datetimesentutc, @isread, @hasattachments, @htmlbody, @textbody, @bodyformat, @sentauditid, 0, 0, @isreminderset, @reminderduebyutc, @meetingstartutc, @meetingendutc, @meetinglocation, @meetingorganizer, @meetingrequiredattendees, @meetingoptionalattendees, @createdutc, @updatedutc);"), "SELECT COUNT(1) FROM FailedItems;" (Source: sample.bin, Indicator: "select count(1) from faileditems;"), "SELECT Attempts, SkipUntilUtc, FailureCategory FROM FailedItems WHERE ExchangeItemId = @ExchangeItemId LIMIT 1;" (Source: sample.bin, Indicator: "select attempts, skipuntilutc, failurecategory from faileditems where exchangeitemid = @exchangeitemid limit 1;"), "SELECT MessageId, FileName FROM Attachments WHERE MessageId IN (" (Source: sample.bin, Indicator: "select messageid, filename from attachments where messageid in ("), "SELECT DisplayName, Email, CompanyName FROM Contacts WHERE Email IS NOT NULL AND Email <> '' ORDER BY DisplayName COLLATE NOCASE;" (Source: sample.bin, Indicator: "select displayname, email, companyname from contacts where email is not null and email <> '' order by displayname collate nocase;"), "INSERT INTO Folders (ExchangeFolderId, DisplayName, WellKnownName, LocalPath, IsSystem, LastSyncUtc) VALUES (@ExchangeFolderId, @DisplayName, @WellKnownName, @LocalPath, @IsSystem, @LastSyncUtc);" (Source: sample.bin, Indicator: "insert into folders (exchangefolderid, displayname, wellknownname, localpath, issystem, lastsyncutc) values (@exchangefolderid, @displayname, @wellknownname, @localpath, @issystem, @lastsyncutc);"), "DELETE FROM Contacts WHERE Id = @Id;" (Source: sample.bin, Indicator: "delete from contacts where id = @id;"), "DELETE FROM Messages WHERE FolderId = @FolderId; DELETE FROM SyncState WHERE FolderId = @FolderId; DELETE FROM Folders WHERE Id = @FolderId;" (Source: sample.bin, Indicator: "delete from messages where folderid = @folderid; delete from syncstate where folderid = @folderid; delete from folders where id = @folderid;")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample eadcd5b3b19c… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample eadcd5b3b19c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"ExchangePortableClient.exe\",\"applicationCategory\":[\"peexe\",\"assembly\",\"executable\"],\"identifier\":\"eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":25},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L25",null,{"initialData":{"schema_version":"1.0.15","sha256":"eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1793624584421,"unified_at":"2026-11-02T13:03:04.421Z","metadata":{"hashes":{"sha256":"eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256","sha1":"bedba59e148e3532c9c0434fbd8275c06cdc094b","md5":"9c8128776404b90808ff422d8121637a"},"file_info":{"file_name":"ExchangePortableClient.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":424960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793624577000,"last_seen":1793624577000,"last_multi_scan":1793624577000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":16},"sandbox_signatures":{"informative_count":22,"suspicious_count":0,"malicious_count":0,"total":22},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to create a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"$26","origin":"sample.bin","mitre_attack_id":"T1071.003","id":"string-499","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/winfx/2006/xaml\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"10.0.14.0\" found in string \"PresentationBuildTasks\t10.0.14.0\", \"0.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$28","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1620","id":"string-615","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"MessageBox\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateDirectory\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"DestroyIcon\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetParent\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"CreateService\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"Sleep\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"RegisterWaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\myproject\\exmail\\project\\src\\ExchangePortableClient\\obj\\Release\\ExchangePortableClient.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFiles\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"DeleteFile\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"System.Security.Cryptography\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"ToBase64String\" (Indicator: \"ToBase64String\"; Source: \"sample.bin\"), Found string \"base64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \";base64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"System.Security.Cryptography.X509Certificates\" (Indicator: \"System.Security.Cryptography\"; Source: \"sample.bin\"), Found string \"WriteBase64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE m.FolderId = @FolderId AND m.LocalDeleted = 0\" (Indicator: \"where \"; Source: \"sample.bin\"), Found string \"WHERE m.LocalDeleted = 0\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"5__5\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"password\" (Indicator: \"password\"; Source: \"sample.bin\"), Found string \"Connection failed. Check EWS URL, login, password, SSL settings, and network.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"5__7\" (Indicator: \"sendmessage\"; Source: \"sample.bin\"), Found reference to API \"BuildSendMessage\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to create a service (API string)","description":"Found reference to API \"CreateService\" (Indicator: \"CreateService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-199","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"ExchangeFolderDeleteService\" (Source: \"sample.bin\"), Found string \"FailedSyncItemDeleteService\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-690","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-106","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Sample eadcd5b3b19c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample eadcd5b3b19c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256"}],["$","meta","4",{"property":"og:title","content":"Sample eadcd5b3b19c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample eadcd5b3b19c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/eadcd5b3b19cd829206b05037090841e84d2c21342cc24663ef0f033da539256"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample eadcd5b3b19c… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample eadcd5b3b19c…. Threat score 0/100. 0/25 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]