26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T472,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample ee937717efe9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ee937717efe9…. Malware family: Malware. Threat score 100/100. 24/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d"],"about":{"@type":"SoftwareApplication","name":"satana_unpacked.exe","applicationCategory":["peexe","executable"],"identifier":"ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":24,"total":26},"behavioralIndicators":{"malicious":5,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T546,GetProcessHeap@KERNEL32.DLL at 00026027-00002644-15916-3-00402600 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-15916-25-00404BE0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-15916-20-00404FA0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-15916-5-00402BF0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-15916-17-00403C60 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-23147-20-00404FA0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-23147-17-00403C60 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-23147-5-00402BF0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-23147-3-00402600 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-23147-25-00404BE0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-28811-19-00404FA0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-28811-16-00403C60 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-28811-23-00404BE0 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-28811-2-00402600 GetProcessHeap@KERNEL32.DLL at 00026027-00002644-28811-4-00402BF0 GetProcessHeap@KERNEL32.DLL at 00029929-00003404-34824-20-00404FA0 GetProcessHeap@KERNEL32.DLL at 00029929-00003404-34824-5-00402BF0 GetProcessHeap@KERNEL32.DLL at 00029929-00003404-34824-17-00403C60 GetProcessHeap@KERNEL32.DLL at 00029929-00003404-34824-3-00402600 GetProcessHeap@KERNEL32.DLL at 00029929-00003404-34824-25-00404BE028:T608,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAQaSURBVFhH7VdLV1NXGPV/OadWWxV5KPiMaItdC5eCCBR0QULegRgDWCQYwiMEQkBqayu1U1uIHTjSkc7oBEhyc1954O537s3jAjdN0C6YNGvtdZJzc8+3v/09zjlHjvz/OWwFrE43+vptB4p+iwPktwqLzYF379fx5u0Hwvv/FN92epT1do/M4QIBq30Qf6xGPwura6+xFv0La69VrNL3P2mOQW/tHQRMZgeSgoR0SkZKlj4B6nuyDnavx2yIqYwS7oICJrNdmTxI7CGQyWYVAisrr/Dy9zcVYeW3V8hm0gqi0agu8gocvTEBBvZbV4FsjgAzXtOzgNp7YdT1zqPeOIez5hDOWUNodAbRODCDC54pXPROKiT/Xl9HShLKhm1fBK7YlmFwPIXBuYSmwUVc80Rw3buAb0bm0Tw6hxu+EL7zz2oI8J+nAIvHtkaBFu/PaBn+CTcfPcOtxwTfMlr9T9EWWMKd6UW0ByPomAsXCKQlPpeEojpK6qgFU6DKNKwfAkaAF9XYMFk7xl+gy/8rugK/oHv6OW6T8Zv+MJrHg7g65ofBN46mCV+RgCiUVYAZP/3IWZoAx4sFAsbgS9yfeYGmoRBO2sbwhWUIXzoe4sSAB189cOOkdwCnR5waAjkFyHOlFNm4SwVmvHGmtzICrU9+xAnzKKr6h3HM5sVxJxkffICvHw7i1LBL8eTMY7uGQLKsAsx48/OW0gSSGgWqjCOq13YyXvCajI+4UP2DA2fGbKh9YtmRA7IsQ6JQlGpkzPi/ExCKIThmzUnOvPaQ5EMkOXldPWpHjc+KOr8ZZwOmYhWI5augAgLFJDzuoli7NZIzr0ny2nEr6if6cW7SiAaStNAHBH5fbXxPI2JVwPaCfBVoE6161IEakryOJK8PkPGpPkqm+7gQ6tlXH9CGpiwBbaLV5iWfNKFhuhfng/dwca4bl8OdOwikchVQyWZWloA20RTJp4yq17M9uDT/PS4vdMKw2F4gIFEOsATUa0BsTqRnHMchHo8jEY/t3Qt2h0CbaA3TfeQ1k7wbl8JduBLpwNWldjQttxUIyGLpMpQlCi0RTCTiiMViiMe2ShDQdEJtop2fZZKT1yS5IXKXjN/BteVWXH92S0OA0/U+35YFSlLm+ebmJra2NvUJCKJ6UJicWqxoK2YVMBGIKLuhRAZKbccCzyPJJcjwlkqAoJsDiaRaBWxvZ4vuB0KyqACLOcsHnk+Co3kWd+b1xsaGgpIEYpwEdibAdgppmQeQBrI0lxKQIWBbprmPhG0C/Y89RwofM2qS5fu/JIrgSZEkGefI8zjFnsU/D6aGrgKMwKEdydgZvafP/Mn3AhO9b7G7YHe5YXW4YbY6YSxzz7jddrd4KC2cTvMXhYMfczeUgzecV+GwL4eHbP8fuv0VoZ+XlYMAAAAASUVORK5CYII=1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791047448338,"unified_at":"2026-10-03T17:10:48.338Z","metadata":{"hashes":{"sha256":"ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d","sha1":"808061052c9efc7c7255ffeb92c77b02bbb8cfee","md5":"d236fcc8789f94f085137058311e848b","sha512":"730c6bf2d17a6fd4b1de4a361848381256187e3cda1133f8d990107a44274078486b310f97751eef771e1e618c2e233f8852a4d61dc93b5ed1c757131e58948d","ssdeep":"768:f9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:ZXzXol6cc+lQZMMc2","ssdeep_chunks":["768:f9NJK3q","768:9NJK3qZ","768:NJK3qZR","768:JK3qZRh","768:K3qZRhx","768:3qZRhxX","768:qZRhxXH","768:ZRhxXHI","768:RhxXHIQ","768:hxXHIQB","768:xXHIQBs","768:XHIQBsL","768:HIQBsLL","768:IQBsLL1","768:QBsLL16","768:BsLL16B","768:sLL16BK","768:LL16BKc","768:L16BKc+","768:16BKc+b","768:6BKc+bB","768:BKc+bBQ","768:Kc+bBQZ","768:c+bBQZ/","768:+bBQZ/U","768:bBQZ/UM","768:BQZ/UMc","768:QZ/UMc2","1536:f9NJK3q","1536:9NJK3qZ","1536:NJK3qZR","1536:JK3qZRh","1536:K3qZRhx","1536:3qZRhxX","1536:qZRhxXH","1536:ZRhxXHI","1536:RhxXHIQ","1536:hxXHIQB","1536:xXHIQBs","1536:XHIQBsL","1536:HIQBsLL","1536:IQBsLL1","1536:QBsLL16","1536:BsLL16B","1536:sLL16BK","1536:LL16BKc","1536:L16BKc+","1536:16BKc+b","1536:6BKc+bB","1536:BKc+bBQ","1536:Kc+bBQZ","1536:c+bBQZ/","1536:+bBQZ/U","1536:bBQZ/UM","1536:BQZ/UMc","1536:QZ/UMc2","768:ZXzXol6","768:XzXol6c","768:zXol6cc","768:Xol6cc+","768:ol6cc+l","768:l6cc+lQ","768:6cc+lQZ","768:cc+lQZM","768:c+lQZMM","768:+lQZMMc","768:lQZMMc2"],"imphash":"abd569e3d01e9e84f7c5b68e45349f11"},"file_info":{"file_name":"satana_unpacked.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":35328,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499293417000,"last_seen":1713426244000,"last_multi_scan":1713426244000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":8,"suspicious_count":18,"malicious_count":5,"total":31},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Satana","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Satan.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Malware.AC8F81D8","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Ransom_Win32_Natasa_A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Ransom.Satan.A (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/MBRlock.AR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Ransom/Satana.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004f30f61 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Satan.toWS","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FKOP!D236FCC8789F","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Satan.elzbag","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader/W32.Upatre.35328.CY","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Risk.DMWY-3084","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MBRlock.JT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Deshacop","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.MBRlock.Win32.423","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.DLL at 00026027-00002644-15916-23-004033F0\n GetLocalTime@KERNEL32.DLL at 00026027-00002644-23147-23-004033F0\n GetLocalTime@KERNEL32.DLL at 00026027-00002644-28811-21-004033F0\n GetLocalTime@KERNEL32.DLL at 00029929-00003404-34824-23-004033F0\n GetLocalTime@KERNEL32.DLL at 00029929-00003404-39910-23-004033F0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.127.26.186:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"\" created file \"%TEMP%\\!satana!.txt\"\n \"\" created file \"%TEMP%\\cglgny.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}\"\n \"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameA@ADVAPI32.DLL at 00026027-00002644-15916-17-00403C60\n GetUserNameA@ADVAPI32.DLL at 00026027-00002644-23147-17-00403C60\n GetUserNameA@ADVAPI32.DLL at 00026027-00002644-28811-16-00403C60\n GetUserNameA@ADVAPI32.DLL at 00029929-00003404-34824-17-00403C60\n GetUserNameA@ADVAPI32.DLL at 00029929-00003404-39910-17-00403C60","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"!satana!.txt\" has type \"ASCII text with CRLF line terminators\"\n \"cglgny.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"orjovaja@mail.com\"\n Heuristic match: \"ail.com\"\n Heuristic match: \"To decrypt you need send on this E-mail: orjovaja@mail.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"\" at 00026027-00002644-00000105-64273938","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00026027-00002644-15916-1-00405420\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00026027-00002644-23147-1-00405420\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00026027-00002644-28811-1-00405420\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00029929-00003404-34824-1-00405420\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00029929-00003404-39910-1-00405420","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"$27","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /add.php HTTP/1.0\nHost: 185.127.26.186\nContent-type: application/x-www-form-urlencoded\nContent-length: 169\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Users\\PSPUBWS\\Searches\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \"\" read file \"%USERPROFILE%\\Links\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"cglgny.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"QWXFOMHO\"; Value: \"%TEMP%\\!satana!.txt\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" touched file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\"\n \"\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\"\n \"\" touched file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"\" touched file \"C:\\Windows\\system32\\imageres.dll\"\n \"\" touched file \"C:\\Windows\\AppPatch\\pcamain.sdb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"185.127.26.186\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\"; Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d.exe.bin\" claimed CRC 60234 while the actual is CRC 58698","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameA\n RegCloseKey\n RegCreateKeyExA\n RegOpenKeyExA\n CopyFileW\n CreateFileA\n CreateFileMappingA\n CreateFileW\n CreateProcessA\n CreateThread\n DeleteFileA\n DeleteFileW\n DeviceIoControl\n FindFirstFileW\n FindNextFileW\n GetCommandLineW\n GetComputerNameA\n GetDriveTypeW\n GetFileSize\n GetFileSizeEx\n GetModuleFileNameA\n GetModuleHandleA\n GetProcAddress\n GetTempPathW\n GetTickCount\n LoadLibraryA\n MapViewOfFile\n OutputDebugStringA\n OutputDebugStringW\n Sleep\n VirtualAllocEx\n WriteFile\n WriteProcessMemory\n WSAStartup (Ordinal #115)\n closesocket (Ordinal #3)\n connect (Ordinal #4)\n send (Ordinal #19)\n socket (Ordinal #23)\n NtQueryInformationProcess","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"4053f7765858f876186af876653cf9760000000000bf3d750000000056cc3d75000000007cca3d7500000000376834756a2cf976d62df97600000000206934750000000029a63d7500000000a48d347500000000f70e3d7500000000\" to virtual address \"0x77121000\" (part of module \"NSI.DLL\")\n \"\" wrote bytes \"92e6f47679a8f976be72f976d62df9761de2f47605a2f976bee3f476616ff9766841f7760050f77600000000ad3713778b2d1377b641137700000000\" to virtual address \"0x745A1000\" (part of module \"WSHTCPIP.DLL\")\n \"cglgny.exe\" wrote bytes \"4053f7765858f876186af876653cf9760000000000bf3d750000000056cc3d75000000007cca3d7500000000376834756a2cf976d62df97600000000206934750000000029a63d7500000000a48d347500000000f70e3d7500000000\" to virtual address \"0x77121000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"21/52 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"21/52 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00026027-00002644-15916-23-004033F0\n DeviceIoControl@KERNEL32.DLL at 00026027-00002644-23147-23-004033F0\n DeviceIoControl@KERNEL32.DLL at 00026027-00002644-28811-21-004033F0\n DeviceIoControl@KERNEL32.DLL at 00029929-00003404-34824-23-004033F0\n DeviceIoControl@KERNEL32.DLL at 00029929-00003404-39910-23-004033F0","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 35328 bytes starting with PE header signature to file \"%TEMP%\\cglgny.exe\": 4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtQueryInformationProcess@NTDLL.DLL at 00026027-00002644-15916-1-00405420\n NtQueryInformationProcess@NTDLL.DLL at 00026027-00002644-15916-43-00404B10\n NtQueryInformationProcess@NTDLL.DLL at 00026027-00002644-23147-43-00404B10\n NtQueryInformationProcess@NTDLL.DLL at 00026027-00002644-23147-1-00405420\n NtQueryInformationProcess@NTDLL.DLL at 00026027-00002644-28811-1-00405420\n NtQueryInformationProcess@NTDLL.DLL at 00029929-00003404-34824-43-00404B10\n NtQueryInformationProcess@NTDLL.DLL at 00029929-00003404-34824-1-00405420\n NtQueryInformationProcess@NTDLL.DLL at 00029929-00003404-39910-1-00405420\n NtQueryInformationProcess@NTDLL.DLL at 00029929-00003404-39910-43-00404B10","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}],"incidents":[{"name":"Spyware/Leak","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Contains ability to lookup the windows account name"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":73,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":69,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"57750c17aac2edd57ffcc219","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Generic.Malware.FH","contacted_countries":["RUS"],"submit_name":"satana_unpacked.exe","analysis_start_time":"2016-06-30T14:12:35+00:00","indicators_count":{"informative":8,"suspicious":22,"malicious":6},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.127.26.186","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}],"dns_resolutions":null,"http_requests":[{"host":"185.127.26.186","host_ip":"185.127.26.186:80","url":"/add.php","method":"POST","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}],"processes":[{"pid":2644,"ppid":0,"name":"ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d.exe","command_line":"","normalized_path":"C:\\ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d.exe","uid":"00026027-00002644","icon":"$28"},{"pid":3404,"ppid":2644,"name":"cglgny.exe","command_line":"{e29ac6c0-7037-11de-816d-806e6f6e6963} \"C:\\EE9377~1.EXE\"","normalized_path":"%TEMP%\\cglgny.exe","parent_uid":"00026027-00002644","uid":"00029929-00003404"}],"all_imported_dlls":["msasn1.dll","version.dll","iertutil.dll","ws2_32.dll","lpk.dll","comctl32.dll","profapi.dll","shdocvw.dll","wer.dll","netutils.dll","ntdll.dll","msctf.dll","synceng.dll","acppage.dll","NapiNSP.dll","gdi32.dll","cscapi.dll","sfc_os.dll","msi.dll","urlmon.dll","msvcrt.dll","dnsapi.dll","cryptsp.dll","gameux.dll","KernelBase.dll","winrnr.dll","GdiPlus.dll","wininet.dll","rpcrt4.dll","Wldap32.dll","rsaenh.dll","WinCDEmuContextMenu.dll","slc.dll","rasadhlp.dll","shell32.dll","srvcli.dll","imageres.dll","kernel32.dll","pnrpnsp.dll","apphelp.dll","twext.dll","nlaapi.dll","FWPUCLNT.DLL","syncui.dll","sfc.dll","cfgmgr32.dll","cryptbase.dll","ntmarta.dll","userenv.dll","propsys.dll","WSHTCPIP.DLL","mpr.dll","user32.dll","sechost.dll","shlwapi.dll","sspicli.dll","imm32.dll","oleaut32.dll","clbcatq.dll","ntshrui.dll","devrtl.dll","uxtheme.dll","nsi.dll","setupapi.dll","devobj.dll","crypt32.dll","mswsock.dll","usp10.dll","ole32.dll","xmllite.dll","linkinfo.dll","advapi32.dll","RpcRtRemote.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"!satana!.txt","sha256":"c766cb71c82d9e1fa3013fabc3cc2abaa1d2330c77974d1c58e240be8b6471ef","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"cglgny.exe","sha256":"ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}],"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%TEMP%\\!satana!.txt","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\EE9377~1.EXE","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%TEMP%\\cglgny.exe","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_bulgarian.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_dansk.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_dutch.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_estonian.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_french.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_german.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_greek.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_hebrew.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_italian.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_japanese.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_korean.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_lithuanian.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_norsk.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_polish.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_portuguese.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_romanian.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_russian.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_spanish.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_swedish.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_turkish.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_zh_CN.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_zh_TW.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%PROGRAMFILES%\\WinCDEmu\\langfiles\\vmnt_english.lng","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%WINDIR%\\system32\\imageres.dll","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"C:\\ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d.exe","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C20CD437-BA6D-4ebb-B190-70B43DE3B0F3}","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"57750c17aac2edd57ffcc219"}]}]}},"report_ids":{"sandbox_job_ids":["57750c17aac2edd57ffcc219"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample ee937717efe9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ee937717efe9…. Malware family: Malware. Threat score 100/100. 24/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample ee937717efe9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ee937717efe9…. Malware family: Malware. Threat score 100/100. 24/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ee937717efe9a2e076b9497498b628beb0c84a8476bd288105a59c5aeea01f3d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample ee937717efe9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ee937717efe9…. Malware family: Malware. Threat score 100/100. 24/26 AV engines flagged this file. 5 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]