26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 37:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4f6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample eb5285d7ef59… — Score 89/100 — Hybrid Analysis","description":"Malicious verdict for sample eb5285d7ef59…. Malware family: Win/malicious_confidence_100%. Threat score 89/100. 6/27 AV engines flagged this file. 2 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/eb5285d7ef5971067805bffe6658f26bcead1a53a054f257cc80c7e034c9231b","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","eb5285d7ef5971067805bffe6658f26bcead1a53a054f257cc80c7e034c9231b"],"about":{"@type":"SoftwareApplication","name":"eb5285d7ef5971067805bffe6658f26bcead1a53a054f257cc80c7e034c9231b.bin","applicationCategory":["peexe","executable"],"identifier":"eb5285d7ef5971067805bffe6658f26bcead1a53a054f257cc80c7e034c9231b","additionalType":"Malicious sample"},"threatScore":89,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T52e,Contains base64 string in header "like" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "4664" in header "GET / HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: icanhazip.com" Contains base64 string in header "like" in header "GET /12/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 130.12.180.190" Contains base64 string in header "4664" in header "GET /12/n.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 130.12.180.190" Contains base64 string in header "like" in header "GET /12/30798.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 130.12.180.190" Contains base64 string in header "4664" in header "GET /12/30798.txt HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36Host: 130.12.180.190"28:T775," HTTP/1.1 200 OK Date: Thu 04 Jun 2026 20:24:44 GMT Content-Type: text/plain Content-Length: 14 Connection: keep-alive Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET set-cookie: __cf_bm=CRTHQy8I0goHFhyxcoQV_gN2.krnNca1S1nwmilKT8c-1780604684.8427994-1.0.1.1-udKHfYF7n_ew9Wi7kCA6txqXtAOmmiQKxwNSHBmSiUkNK9OydfMVs00rc8h6d_CFfISfQua52fS0NEeV10F3tfYjZtHxLg5wNdgU9MmdkcjSk.GNSiPsNEKjQf8QH1Jh; HttpOnly; Path=/; Domain=icanhazip.com; Expires=Thu 04 Jun 2026 20:54:44 GMT Server: cloudflare CF-RAY: a069a9b04a6afca9-SJC alt-svc: h3=":443"; ma=86400 with response body ==>36342E3132342E31322E3136320A....... "GET /12/n.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 04 Jun 2026 20:24:45 GMT Content-Type: text/plain Content-Length: 6 Last-Modified: Sun 17 May 2026 08:18:13 GMT Connection: keep-alive ETag: "6a0979c5-6" Accept-Ranges: bytes with response body ==>36323831320A....... "GET /12/30798.txt HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36 Host: 130.12.180.190" Response ==> HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu 04 Jun 2026 20:24:45 GMT Content-Type: text/plain Content-Length: 258212 Last-Modified: Fri 15 May 2026 02:41:35 GMT Connection: keep-alive ETag: "6a0687df-3f0a4" Accept-Ranges: bytes with response body ==>720A736F72726F776579654077702E706C3A6D616369656A313939370A626B6C61726768406D742E6E65743A6B69746B61743132330A76696B61732E76616962.......2c:T725," Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a21def5d544905372070d75"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"