23:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 22:T47f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample ed0b4e2bf108… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ed0b4e2bf108…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T435,The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: C0:E4:9D:2D:7D:90:A5:CD:42:7F:02:D9:12:56:94:D5:D6:EC:5B:71; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Timestamping CA - G2, O=GlobalSign nv-sa, C=BE" (SHA1: 63:B8:2F:AB:61:F5:83:90:96:95:05:0B:00:24:9C:50:29:33:EC:79; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: D4:FB:29:82:26:8B:59:2E:3C:D4:6F:A7:81:94:E7:14:18:29:77:41; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)25:T580,"" touched file "C:\Windows\System32\en-US\msvfw32.dll.mui" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\Fonts\StaticCache.dat" "" touched file "C:\Windows\System32\en-US\user32.dll.mui" "" touched file "C:\Windows\AppPatch\sysmain.sdb" "" touched file "C:\Windows\System32\icacls.exe" "icacls.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "icacls.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "icacls.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "icacls.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "icacls.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "icacls.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\index.dat" "WMIC.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "WMIC.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "WMIC.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "WMIC.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat" "WMIC.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies\index.dat" "WMIC.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History\History.IE5\index.dat"26:T627,Pattern match: "https://baike" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0" Pattern match: "https://www.globalsign.com/repository/0" Pattern match: "crl.globalsign.com/gs/gstimestampingg2.crl0T" Pattern match: "secure.globalsign.com/cacert/gstimestampingg2.crt0" Pattern match: "https://www.verisign.com/rpa" Pattern match: "http://sf.symcb.com/sf.crl0f" Pattern match: "https://d.symcb.com/cps0%" Pattern match: "https://d.symcb.com/rpa0" Pattern match: "http://sf.symcd.com0&" Pattern match: "http://sf.symcb.com/sf.crt0" Pattern match: "https://www.verisign.com/cps0*" Pattern match: "https://www.verisign.com/rpa0" Pattern match: "http://logo.verisign.com/vslogo.gif04" Pattern match: "http://crl.verisign.com/pca3-g5.crl04" Pattern match: "http://ocsp.verisign.com0" Pattern match: "http://www.360.cn" Pattern match: "http://sv.symcb.com/sv.crl0f" Pattern match: "http://sv.symcd.com0&" Pattern match: "http://sv.symcb.com/sv.crt0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://s.symcd.com06" Pattern match: "http://s.symcb.com/universal-root.crl0" Pattern match: "https://d.symcb.com/rpa0@" Pattern match: "http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0" Pattern match: "http://ts-ocsp.ws.symantec.com0" Pattern match: "http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0" Pattern match: "http://www.symauth.com/rpa0"27:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAzMzMzMzMzMzMAAAAAAAAAMzMzMiIzMzMzMAAAAAAAALu7u7BAu7u7uzMAAAAAAAC7u7uwQLu7u7uzMAAAAAAAu7u7sAC7u7u7uzMAAAAAALu7u7AAu7u7u7uzMAAAAAC7u7MwADO7u7u7uzMAAAAAu7sAAAAAC7u7u7uzAAAAALu7sAAAALu7u7u7uwAAAAC7u7sAAAu7u7u7u7sAAAAAu7u7sAC7u7u7u7u7AAAAALu7u7sLu7u7u7u7uwAAAAC7u7u7u7u7u7u7u7sAAAAAMzMzMzMzMzM7uzu7AAAzMzMzMzMzMzMzOzMzuwAAAzMzMzMzMzMzMzMzMzsAAAAzMzMzMzMzMzMzMzMzAAAAAzMzMzMzMzMzMzMzMwAAAAMiIiBGxgVVVVUzMzcwAAAzIiYwRs4FVXVVUzMzMwADMyImMEbOBVV1VVUzMzMwMzMiJnB2zgVVhTFVUzMzMwMzI4twOL4Di4UzFVUzMzAAMyImcEbOBVWFOzFVMzMAAAMiZvBMzwVY9VODFTMwAAAAKP+Ej/hY/4VVOzUzMwAAAAKP+Ej/hY/4VVM1MzMwAAAAKP+Ej/hY/4VVNTMzMwAAAAKP+Ej/hY/4VVUAAAAAAAAAKP+Ej/hY/4VVAAAAAAAAAAKP+Ej/hY/4VQAAAAAAAAAAKACEgAhYAIUAAADwAAP/8AAB//AAAP/wAAB/8AAAP/AAAB/wAAAP8AAAD/AAAA/wAAAP8AAAD/AAAA/wAAAP8AAADwAAAA+AAAAPwAAAD+AAAA/gAAAHwAAAA4AAAAEAAAAAgAAAAcAAAAPgAAAH8AAAA/gAAAH8AAAA/gAAP/8AAD//gAA//8xjPw==28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==29:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHd3d3d3d3d3d3d3d3d3dwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAcAAAAAAAAAAAAAAAAAAHAHAAAAAAAAAAAAAAAAAABwBwAAAAAAAAAAAAAAAAAAcAd3AAAAAAAAAAAAAAAAAHAHd3AAAAAAAAAAAAAAAABwB3d3/wAAAADwD/////AAcAd3f3fwDwAA8AAAAAAAAHAHd393d3cAD/AAAAAAAABwB3d/d3d3AP8AAAAAAAAAcAd3f3f3fwDwAAAAAAAAAHAHd3f/d3cA8AAAAAAAAABwB3d3d3d3AAAAAAAAAAAAcAd3d3d3dwAAAAAAAAAAAHAHd3d3d3cAAAAAAAAAAABwB4iIiIiIiIiIiIiIiIiIcAeIiIiIiIiIiIiIiHh4eHAHd3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////wAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAP///////////////w==2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3AAB2ZnAAAAAAAAAAAAeHh3AAZ3dgAAAAAAAAAAB3d3d3cGd3YAAAAAAAB3d3d4d3eHdnd2AAAAAHd3d3d3f4d3iHZ3dgAAd3d3d3d3d3+Hd4iGd3YAd3d3d3d3d3d/h3eIh4eHAHiIiId3d3d3f4d3iIeIhwB4iIiIiHd3d3+Hd3iHiIcAiIiIiIiId4d/h3eHd3h2AIiId4iIiIf3eId3iId4cACIh4eIiIiHh3iHd3eIeHAAiIf3iIh3d3d4h3d3d3hgAIiHh3eIiIiIeId3d3d3dgCHh3eIiIiIiHiHd3d3iHYAiIiIj//4iIh4h3d3d4hwAI/////4iIiIeId3d3eIcACI/4iId4iIiHiId3cAiHAAd4iIh/d3h3d3d3AAAIhwAAd3iIiIAHAAeIhwAACIcAAAAHd3cAAAB4iIdwAAiHAAAAAAAAAAAHiIiIdwAIhwAAAAAAAAAAeP+IiIdwCIcAAAAAAAAAAAd4/4iIcAiHAAAAAAAAAAAAh3j/iHAIhwAAAAAAAAAAAIiIePhwCIcAAAAAAAAAAACIhwf/cAj3AAAAAAAAAAAAf3AH93AI9wAAAAAAAAAAAPgAeIcACIcAAAAAAAAAAAAAB4hwAAiIAAAAAAAAAAAAAAAAAAAAAAD///////+Dwf//gcH//wBB/+AAAf4AAAHgAAABgAAAAYAAAAGAAAAAgAAAAIAAAACAAAAAgAAAAIAAAAGAAAABgAAAA4AAAAOAAABjgAAD48AAA+P4IAHj//4A4//8AGP//gBj//8AY///AGP//whj//8YY///MOP//+Hj/////w==2c:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790445312941,"unified_at":"2026-09-26T17:55:12.941Z","metadata":{"hashes":{"sha256":"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4","sha1":"2984d310ceae7d13960543012f0b0fe1635f63e7","md5":"453a78910a834ad8830ab9dee7c183e3","sha512":"ecd1ac3b79b39173bf5377d4372b792a423394c73ba09b174bf7a0a4aeedf122d96a6dc96abb229d03d98a9509b8b2c25bf8197280f60d403ea7f39c0e5d238c","ssdeep":"49152:0T6ep1uX9Vp+K+7hWRgXK5Cg2siSR1OsOg9:EX1uXLpa7hWR4KGSR1JOg9","ssdeep_chunks":["49152:0T6ep1u","49152:T6ep1uX","49152:6ep1uX9","49152:ep1uX9V","49152:p1uX9Vp","49152:1uX9Vp+","49152:uX9Vp+K","49152:X9Vp+K+","49152:9Vp+K+7","49152:Vp+K+7h","49152:p+K+7hW","49152:+K+7hWR","49152:K+7hWRg","49152:+7hWRgX","49152:7hWRgXK","49152:hWRgXK5","49152:WRgXK5C","49152:RgXK5Cg","49152:gXK5Cg2","49152:XK5Cg2s","49152:K5Cg2si","49152:5Cg2siS","49152:Cg2siSR","49152:g2siSR1","49152:2siSR1O","49152:siSR1Os","49152:iSR1OsO","49152:SR1OsOg","49152:R1OsOg9","98304:0T6ep1u","98304:T6ep1uX","98304:6ep1uX9","98304:ep1uX9V","98304:p1uX9Vp","98304:1uX9Vp+","98304:uX9Vp+K","98304:X9Vp+K+","98304:9Vp+K+7","98304:Vp+K+7h","98304:p+K+7hW","98304:+K+7hWR","98304:K+7hWRg","98304:+7hWRgX","98304:7hWRgXK","98304:hWRgXK5","98304:WRgXK5C","98304:RgXK5Cg","98304:gXK5Cg2","98304:XK5Cg2s","98304:K5Cg2si","98304:5Cg2siS","98304:Cg2siSR","98304:g2siSR1","98304:2siSR1O","98304:siSR1Os","98304:iSR1OsO","98304:SR1OsOg","98304:R1OsOg9","49152:EX1uXLp","49152:X1uXLpa","49152:1uXLpa7","49152:uXLpa7h","49152:XLpa7hW","49152:Lpa7hWR","49152:pa7hWR4","49152:a7hWR4K","49152:7hWR4KG","49152:hWR4KGS","49152:WR4KGSR","49152:R4KGSR1","49152:4KGSR1J","49152:KGSR1JO","49152:GSR1JOg","49152:SR1JOg9"],"imphash":"978f47a34222ffb2b8b4ba1c70ab3bfe"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1661896,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1509105230000,"last_seen":1677400713000,"last_multi_scan":1677400713000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ransomware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":10,"suspicious_count":18,"malicious_count":9,"total":37},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransom","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.FlyStudio.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.RansomHeur.mljdu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Ransom.XiaoBa.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Agent.OSCF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.CLL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.XiaoBa (A)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Filecoder.NOE trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Win32.Crypmodadv.xnr","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Encoder.eumktf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom_XIAOBA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom_XIAOBA.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan-Ransom.Crypmodadv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Crypmodadv.Win32.149","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSHTA.EXE\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSHTA.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000\")","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!dtum8nk!appdata!roaming!microsoft!windows!cookies!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!dtum8nk!appdata!local!microsoft!windows!history!history.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!dtum8nk!appdata!local!microsoft!windows!temporary internet files!content.ie5!\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" on 2017-10-27.12:43:02.091","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00014777-00002656)\n Spawned process \"cmd.exe\" with commandline \"cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014778-00002512)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadow /all /quiet\" (UID: 00019353-00003996)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00022149-00004016)\n Spawned process \"mshta.exe\" with commandline \"\"%USERPROFILE%\\Desktop\\_@Explanation@_.hta\"\" (UID: 00037730-00002936)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} boostatuspolicy ignoreallfailures\" (UID: 00041072-00003156)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$24","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"dH1rDN9f9.doc\" has type \"data\"\n \"omniprov.doc\" has type \"data\"\n \"6SZfLTu9z.doc\" has type \"data\"\n \"_@Explanation@_.hta\" has type \"HTML document ISO-8859 text with CRLF line terminators\"\n \"lCEf83Wf7e4nuIMk.doc\" has type \"data\"\n \"0zIG0D.doc\" has type \"data\"\n \"PROTTPLV.DOC\" has type \"data\"\n \"mtgFs8Za.doc\" has type \"data\"\n \"F3hzum1.doc\" has type \"data\"\n \"hKY8.doc\" has type \"data\"\n \"5F1yaAIKfUGQcmmt.doc\" has type \"data\"\n \"EKeaJO.doc\" has type \"data\"\n \"ndattrib.h\" has type \"data\"\n \"d3d10sdklayers.h\" has type \"data\"\n \"KeepAliveP.c\" has type \"data\"\n \"readme.txt\" has type \"data\"\n \"PH01562U.BMP\" has type \"Sendmail frozen configuration - version \\252C\\257\\210\\031\\023Hv\\263\\\\223*\\320<\\006.\\243\\031\\034\\337\\021\\267\\357\\305\\327\\205G\\352\\003\\026\\261\\200^>\\274\\027\\033\\337I\\203\\266\\230\\364h\\026\\327p\\371\\317\\237\\353\\002\\255\\204_\"\n \"HokZm0_2HRA[1].htm\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$26","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WMIC.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")\n \"mshta.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"UPX1 with unusual entropies 7.80687736928","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe.bin\" has a section named \"UPX0\"\n \"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe.bin\" has a section named \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"icacls.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"vssadmin.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WMIC.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WMIC.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mshta.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"\" called \"OpenService\" to access the \"MMCSS\" service\n \"\" called \"OpenService\" to access the \"AudioSrv\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%WINDIR%\\System32\\icacls.exe\", Handle: 360)\n \"\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 280)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"XIAOBA\"; Value: \"C:\\ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Detected indicator that file is ransomware","description":"\"ortant files have been encrypted\" (Source: ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe.bin, Indicator: \"files have been encrypted\")\n \"nt files have been encrypted!\" (Source: ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe.bin, Indicator: \"files have been encrypted\")","origin":"File/Memory","relevance":7,"id":"string-13","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"The input sample dropped very many files","description":"The input sample dropped 2000 files (often an indicator for ransomware)","origin":"Binary File","relevance":5,"id":"binary-10","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Reads system information using Windows Management Instrumentation Commandline (WMIC)","description":"Process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00022149-00004016)","origin":"Monitored Target","relevance":3,"id":"target-10","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"mshta.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe.bin\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n VirtualProtect\n GetProcAddress\n LoadLibraryA\n ShellExecuteA\n InternetCloseHandle","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"1099ab7600000000653c2877c855277700000000d0bb3c7780123d77d62d287700000000\" to virtual address \"0x70391000\" (part of module \"KSUSER.DLL\")\n \"\" wrote bytes \"4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000\" to virtual address \"0x76B61000\" (part of module \"NSI.DLL\")\n \"WMIC.exe\" wrote bytes \"4053267758582777186a2777653c28770000000000bf3c770000000056cc3c77000000007cca3c7700000000376843756a2c2877d62d287700000000206943750000000029a63c7700000000a48d437500000000f70e3c7700000000\" to virtual address \"0x76B61000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mshta.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"bcdedit.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"30/66 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"30/66 Antivirus vendors marked sample as malicious (45% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"Installation/Persistance","name":"Disables startup repair","description":"Disables startup repair \"cmd.exe\" with commandline \"cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014778-00002512)","origin":"Monitored Target","relevance":8,"id":"target-5","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\icacls.exe\" (Handle: 360)\n \"\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\icacls.exe\" (Handle: 360)\n \"\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\icacls.exe\" (Handle: 360)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Deletes volume snapshots (often used by ransomware)","description":"Deletes volume snapshots files \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00022149-00004016)","origin":"Monitored Target","relevance":10,"id":"target-4","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"Ransomware/Banking","name":"The analysis extracted a known ransomware file","description":"Found dropped filename \"_ReadMe_.txt\" which has been seen in the context of ransomware (Indicator: README_.txt)\n Found dropped filename \"IBurn.csproj.FileList.txt\" which has been seen in the context of ransomware (Indicator: filelist.txt)","origin":"Binary File","relevance":5,"id":"binary-9","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"System Security","name":"Modifies the UAC/LUA settings (Account Control)","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\SYSTEM\"; Key: \"ENABLELUA\"; Value: \"00000000\")","origin":"Registry Access","relevance":8,"id":"registry-10","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"System Security","name":"Modifies the access control lists of files","description":"Process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00014777-00002656)","origin":"Monitored Target","relevance":5,"id":"target-12","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"\" (UID: 00014640-00002404)\n Spawned process \"icacls.exe\" with commandline \"icacls . /grant Everyone:F /T /C /Q\" (UID: 00014777-00002656)\n Spawned process \"cmd.exe\" with commandline \"cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet\" (UID: 00014778-00002512)\n Spawned process \"vssadmin.exe\" with commandline \"vssadmin delete shadow /all /quiet\" (UID: 00019353-00003996)\n Spawned process \"WMIC.exe\" with commandline \"wmic shadowcopy delete\" (UID: 00022149-00004016)\n Spawned process \"mshta.exe\" with commandline \"\"%USERPROFILE%\\Desktop\\_@Explanation@_.hta\"\" (UID: 00037730-00002936)\n Spawned process \"bcdedit.exe\" with commandline \"bcdedit /set {default} boostatuspolicy ignoreallfailures\" (UID: 00041072-00003156)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"Ransomware","details_count":3,"details":[{"detail":"The analysis extracted a known ransomware file"},{"detail":"Deletes volume snapshots (often used by ransomware)"},{"detail":"Detected indicator that file is ransomware"}],"sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"Persistence","details_count":5,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Disables startup repair"},{"detail":"Grants permissions using icacls (DACL modification)"},{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Reads system information using Windows Management Instrumentation Commandline (WMIC)"}],"sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":15,"imported_dlls_count":88,"dropped_files_count":0,"extracted_files_count":18,"files_written_count":31,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":6,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ransomware"],"sample_flags":["Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"59f31c137ca3e14ab4518d83","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4","analysis_start_time":"2017-10-27T12:41:44+00:00","indicators_count":{"informative":10,"suspicious":21,"malicious":11},"tags":["Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}],"processes":[{"pid":2404,"ppid":0,"name":"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe","command_line":"","sha256":"ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4","normalized_path":"C:\\ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4.exe","uid":"00014640-00002404","icon":"$27"},{"pid":2656,"ppid":2404,"name":"icacls.exe","command_line":"icacls . /grant Everyone:F /T /C /Q","sha256":"e78b14513c47c1339d96065237e9d270f33d595d5a92f2b5c8f4f841e2a4ad5c","normalized_path":"%WINDIR%\\System32\\icacls.exe","parent_uid":"00014640-00002404","uid":"00014777-00002656","icon":"$28"},{"pid":2512,"ppid":2404,"name":"cmd.exe","command_line":"cmd /c vssadmin delete shadow /all /quiet & wmic shadowcopy delete & bcdedit /set {default} boostatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00014640-00002404","uid":"00014778-00002512","icon":"$29"},{"pid":3996,"ppid":2512,"name":"vssadmin.exe","command_line":"vssadmin delete shadow /all /quiet","sha256":"e09bf4d27555ec7567a598ba89ccc33667252cef1fb0b604315ea7562d18ad10","normalized_path":"%WINDIR%\\System32\\vssadmin.exe","parent_uid":"00014778-00002512","uid":"00019353-00003996","icon":"$2a"},{"pid":4016,"ppid":2512,"name":"WMIC.exe","command_line":"wmic shadowcopy delete","sha256":"132aa270790f56a7524cab968927ed5e1d91b9a26d4badcb24e450e7decc5f81","normalized_path":"%WINDIR%\\System32\\wbem\\WMIC.exe","parent_uid":"00014778-00002512","uid":"00022149-00004016","icon":"$2b"},{"pid":3156,"ppid":2512,"name":"bcdedit.exe","command_line":"bcdedit /set {default} boostatuspolicy ignoreallfailures","sha256":"aa501dc5b621527b0e3dd2787d4969647631c4904d3ae9fc06d177251bc760e3","normalized_path":"%WINDIR%\\System32\\bcdedit.exe","parent_uid":"00014778-00002512","uid":"00041072-00003156","icon":"$2c"},{"pid":2936,"ppid":2404,"name":"mshta.exe","command_line":"\"%USERPROFILE%\\Desktop\\_@Explanation@_.hta\"","sha256":"db40b518deb81b146cc81b0c360aecc84204e3cdc108b1f5f158ee60c1792806","normalized_path":"%WINDIR%\\System32\\mshta.exe","parent_uid":"00014640-00002404","uid":"00037730-00002936","icon":"$2d"}],"all_imported_dlls":["midimap.dll","mshtml.dll","ksuser.dll","oleaut32.dll","apphelp.dll","setupapi.dll","cfgmgr32.dll","vsstrace.dll","framedynos.dll","wbemprox.dll","sechost.dll","imm32.dll","rpcss.dll","wtsapi32.dll","profapi.dll","fastprox.dll","sxs.dll","usp10.dll","msvfw32.dll","IconCodecService.dll","ieframe.dll","avrt.dll","wbemsvc.dll","urlmon.dll","iertutil.dll","winbrand.dll","secur32.dll","msxml3.dll","msvcrt.dll","rpcrt4.dll","avifil32.dll","gdi32.dll","shell32.dll","WindowsCodecs.dll","MSOXMLMF.DLL","ntdll.dll","ws2_32.dll","wininet.dll","GdiPlus.dll","ntmarta.dll","sspicli.dll","msacm32.dll","crypt32.dll","cryptbase.dll","clbcatq.dll","msxml3r.dll","lpk.dll","comctl32.dll","ntdsapi.dll","rasman.dll","advapi32.dll","dwmapi.dll","propsys.dll","wpdshext.dll","MMDevAPI.dll","AudioSes.dll","vssapi.dll","IPHLPAPI.DLL","RpcRtRemote.dll","version.dll","KernelBase.dll","shlwapi.dll","comdlg32.dll","oleaccrc.dll","devobj.dll","winnsi.dll","kernel32.dll","winmm.dll","shdocvw.dll","wintrust.dll","msvcr90.dll","rasapi32.dll","ole32.dll","oleacc.dll","msls31.dll","psapi.dll","cryptsp.dll","msasn1.dll","uxtheme.dll","atl.dll","wbemcomn.dll","dnsapi.dll","rsaenh.dll","msimtf.dll","user32.dll","nsi.dll","msctf.dll","Wldap32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"_@Explanation@_.hta","sha256":"69f9f0fc5444f2897a706cfc1ddcaed784d785e46e9bba9ede803b0fcb1303ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"dH1rDN9f9.doc","sha256":"6e9372d918fb0ceda18cdb038edeaf25a593f7782158b55c6195a7594a1426bd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"omniprov.doc","sha256":"4dd538a61dc00d40cff5f06fc0e3f801876519eef1aa5e253ec984a2fe3adac9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"6SZfLTu9z.doc","sha256":"b5f27e0c9bb4321011a965cf56603aaa4655f8f360a42fa1145e8ed4ddb398c4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"lCEf83Wf7e4nuIMk.doc","sha256":"9189a9f4d827cd069966410529fdf5f5f44c6bcdd5f3111d255956e27cbd70a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"0zIG0D.doc","sha256":"7d7b14a81ce76d078b05323cb6f01b93409e7ab31931887a07ad5ca896f4b0e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"PROTTPLV.DOC","sha256":"ea6f4b19682def305caa1754a7bb44f917f7b321d42952140585bf5f19c60cf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"mtgFs8Za.doc","sha256":"311c07cd6f7f32efb51a480d8078f8ef3e2420ba146ddbf9dcaf52913e3ab115","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"F3hzum1.doc","sha256":"64964f7855da7f57bcae12cf235a19d9cd4cde74a99d7dff6a04635e8ce546f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"hKY8.doc","sha256":"ee0449657ee2de47ca314ba61a5d175277027df7fef44a20bdbc07437f3af149","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"5F1yaAIKfUGQcmmt.doc","sha256":"ef427c0e0555706aecdad5e1e6a939bdbbd4993fab90e4d9e77ab90298f560b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"EKeaJO.doc","sha256":"04321f17146f3667d7762a4a0df488e519efc19ddb28c0aa6a414a3263977af8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"ndattrib.h","sha256":"36c15e6c33e214502b27f9623ab95b71b4b350b0179ce78854723c5cbe149336","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"d3d10sdklayers.h","sha256":"4cb75dce0bee88ca1cd43caaebe9fba6fac28d16db5205bd233979093f66ee91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"KeepAliveP.c","sha256":"ffd38d288e0936057477e686b850b6015a88a86788404ef881c556b41e7a49dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"readme.txt","sha256":"6db2e8e2f5487fb9ddbecd0541de2d2dbca8a754b2e6766ec601f51042c0972d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"PH01562U.BMP","sha256":"8a3ac17d32748ebb3145e873d11ce1e1738fa312f9279efa2723359e9573e573","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"HokZm0_2HRA[1].htm","sha256":"f8a5cb6eb95cb55d35a8f1a9784c78d7acb381288b98b0849abe69cb26a59017","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\msvfw32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\icacls.exe","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\vssadmin.exe","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\vssadmin.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\wbem\\WMIC.exe","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\wbem\\en-US\\WMIC.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\ICacls.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\wbem\\xsl-mappings.xml","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\mshta.exe.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\en-US\\ieframe.dll.mui","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%USERPROFILE%\\Desktop\\_@Explanation@_.hta","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"path":"%WINDIR%\\System32\\bcdedit.exe","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!dtum8nk!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!dtum8nk!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!dtum8nk!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!PrivacIE!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"59f31c137ca3e14ab4518d83"}]}]}},"report_ids":{"sandbox_job_ids":["59f31c137ca3e14ab4518d83"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample ed0b4e2bf108… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ed0b4e2bf108…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample ed0b4e2bf108… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ed0b4e2bf108…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ed0b4e2bf108ec7136af00868abe426da8e8f6d8fc1393b2a107bd2812b795d4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample ed0b4e2bf108… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ed0b4e2bf108…. Malware family: Trojan.Generic. Threat score 100/100. 16/28 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]