33:"SampleDetailWrapper" 34:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$33"] 38:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 35:Tb1b,Found reference to API "statute" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "a read-only folder of read-only files moves" (Indicator: "read"; Source: "sample.bin"), Found reference to API "d__101" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "d__88" (Indicator: "sync"; Source: "sample.bin"), Found reference to API " tone, personality, register specifications" (Indicator: "personality"; Source: "sample.bin"), Found reference to API " name the collocation explicitly so the choice needs no judgement at translation time." (Indicator: "time"; Source: "sample.bin"), Found reference to API "learned again harmlessly: no duplicate" (Indicator: "dup"; Source: "sample.bin"), Found reference to API "d__22" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "SendAsync" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "d__29" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "that paragraph - a claim number, a letter, a bullet. Use it to read the document's" (Indicator: "read"; Source: "sample.bin"), Found reference to API " [[TC: [bracketed text] supplied to close hanging sentence]]." (Indicator: "close"; Source: "sample.bin"), Found reference to API "renamed at the next start" (Indicator: "rename"; Source: "sample.bin"), Found reference to API "b__1" (Indicator: "read"; Source: "sample.bin"), Found reference to API "b__1" (Indicator: "write"; Source: "sample.bin"), Found reference to API " appeared while it was being created; try again." (Indicator: "creat"; Source: "sample.bin"), Found reference to API "ROLE (senior marketing translator/transcreator)" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "g__Post|0" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=6" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=3" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "Close the lid" (Indicator: "close"; Source: "sample.bin"), Found reference to API "b__31_0" (Indicator: "write"; Source: "sample.bin"), Found reference to API "d__83" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "CREATE TABLE changes (seq INTEGER PRIMARY KEY AUTOINCREMENT, unit_id INTEGER NOT NULL)" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "state" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "corresponding translated text; never invent, drop, merge or rename a tag; and never replace" (Indicator: "rename"; Source: "sample.bin")36:T1b1e,"INSERT OR IGNORE INTO vals (field, value) VALUES ($f, $v)" (Source: sample.bin, Indicator: "insert or ignore into vals (field, value) values ($f, $v)"), "CREATE TABLE changes (seq INTEGER PRIMARY KEY AUTOINCREMENT, unit_id INTEGER NOT NULL)" (Source: sample.bin, Indicator: "create table changes (seq integer primary key autoincrement, unit_id integer not null)"), "SELECT field, count(*) FROM vals GROUP BY field" (Source: sample.bin, Indicator: "select field, count(*) from vals group by field"), "UPDATE meta SET value = '1' WHERE name = 'schema'" (Source: sample.bin, Indicator: "update meta set value = '1' where name = 'schema'"), "UPDATE units SET lang_a = $la, text_a = $ta, lang_b = $lb, text_b = $tb, key = $key, variant = $v, origin = $o, added = $d WHERE id = $id" (Source: sample.bin, Indicator: "update units set lang_a = $la, text_a = $ta, lang_b = $lb, text_b = $tb, key = $key, variant = $v, origin = $o, added = $d where id = $id"), "INSERT INTO pending (src_lang, src, trg_lang, trg, origin) VALUES ('nl-NL', 'De deur gaat open.', 'en-GB', 'The door opens.', 'studio')" (Source: sample.bin, Indicator: "insert into pending (src_lang, src, trg_lang, trg, origin) values ('nl-nl', 'de deur gaat open.', 'en-gb', 'the door opens.', 'studio')"), "SELECT count(*) FROM vals WHERE value = 'PROJ-001'" (Source: sample.bin, Indicator: "select count(*) from vals where value = 'proj-001'"), "CREATE TABLE translation_units (id INTEGER PRIMARY KEY AUTOINCREMENT, source_text TEXT NOT NULL, target_text TEXT NOT NULL, source_lang TEXT NOT NULL, target_lang TEXT NOT NULL, tm_id TEXT NOT NULL)" (Source: sample.bin, Indicator: "create table translation_units (id integer primary key autoincrement, source_text text not null, target_text text not null, source_lang text not null, target_lang text not null, tm_id text not null)"), "SELECT count(*) FROM vals" (Source: sample.bin, Indicator: "select count(*) from vals"), "SELECT lang_a, text_a, lang_b, text_b, key, variant, origin, added FROM units ORDER BY id" (Source: sample.bin, Indicator: "select lang_a, text_a, lang_b, text_b, key, variant, origin, added from units order by id"), "SELECT count(*) FROM sqlite_master WHERE type = 'table' AND name = 'translation_memories'" (Source: sample.bin, Indicator: "select count(*) from sqlite_master where type = 'table' and name = 'translation_memories'"), "INSERT INTO translation_memories (name, tm_id) VALUES ('Alpha', 'a'), ('Beta', 'b'), ('Delta', 'd'), ('', 'e')" (Source: sample.bin, Indicator: "insert into translation_memories (name, tm_id) values ('alpha', 'a'), ('beta', 'b'), ('delta', 'd'), ('', 'e')"), "CREATE TABLE translation_units (id INTEGER PRIMARY KEY AUTOINCREMENT, source_text TEXT NOT NULL, target_text TEXT NOT NULL, source_lang TEXT NOT NULL, target_lang TEXT NOT NULL, tm_id TEXT NOT NULL, project_id TEXT, context_before TEXT, context_after TEXT, source_hash TEXT NOT NULL, created_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP, modified_date TIMESTAMP DEFAULT CURRENT_TIMESTAMP, usage_count INTEGER DEFAULT 0, created_by TEXT, notes TEXT, target_hash TEXT, UNIQUE(source_hash, target_text, tm_id))" (Source: sample.bin, Indicator: "create table translation_units (id integer primary key autoincrement, source_text text not null, target_text text not null, source_lang text not null, target_lang text not null, tm_id text not null, project_id text, context_before text, context_after text, source_hash text not null, created_date timestamp default current_timestamp, modified_date timestamp default current_timestamp, usage_count integer default 0, created_by text, notes text, target_hash text, unique(source_hash, target_text, tm_id))"), "CREATE TABLE translation_units (id INTEGER PRIMARY KEY AUTOINCREMENT, source_text TEXT NOT NULL, target_text TEXT NOT NULL, source_lang TEXT NOT NULL, target_lang TEXT NOT NULL, tm_id TEXT NOT NULL, source_hash TEXT NOT NULL)" (Source: sample.bin, Indicator: "create table translation_units (id integer primary key autoincrement, source_text text not null, target_text text not null, source_lang text not null, target_lang text not null, tm_id text not null, source_hash text not null)"), "SELECT created, changed, created_by, changed_by, date_from FROM units WHERE id = $id" (Source: sample.bin, Indicator: "select created, changed, created_by, changed_by, date_from from units where id = $id"), "SELECT count(*) FROM unit_vals uv JOIN vals v ON v.id = uv.val_id WHERE v.field = 'Project'" (Source: sample.bin, Indicator: "select count(*) from unit_vals uv join vals v on v.id = uv.val_id where v.field = 'project'"), "SELECT seq FROM sqlite_sequence WHERE name = 'changes'" (Source: sample.bin, Indicator: "select seq from sqlite_sequence where name = 'changes'"), "CREATE TABLE IF NOT EXISTS changes (seq INTEGER PRIMARY KEY AUTOINCREMENT, unit_id INTEGER NOT NULL)" (Source: sample.bin, Indicator: "create table if not exists changes (seq integer primary key autoincrement, unit_id integer not null)"), "SELECT text_b FROM units WHERE lang_a = 'en' AND lang_b = 'nl' AND length(text_b) BETWEEN 30 AND 300 AND abs(random()) % 2000 = 0 LIMIT 300" (Source: sample.bin, Indicator: "select text_b from units where lang_a = 'en' and lang_b = 'nl' and length(text_b) between 30 and 300 and abs(random()) % 2000 = 0 limit 300"), "INSERT INTO pending (src_lang, src, trg_lang, trg, origin, confirmed_at, user, project, client, subject, document) VALUES ($sl, $s, $tl, $t, $o, $ca, $u, $p, $c, $sj, $d)" (Source: sample.bin, Indicator: "insert into pending (src_lang, src, trg_lang, trg, origin, confirmed_at, user, project, client, subject, document) values ($sl, $s, $tl, $t, $o, $ca, $u, $p, $c, $sj, $d)"), "CREATE TABLE IF NOT EXISTS meta (name TEXT PRIMARY KEY, value TEXT)" (Source: sample.bin, Indicator: "create table if not exists meta (name text primary key, value text)"), "SELECT added FROM units" (Source: sample.bin, Indicator: "select added from units"), "SELECT count(*) FROM sqlite_master WHERE type = 'table' AND name = 'meta'" (Source: sample.bin, Indicator: "select count(*) from sqlite_master where type = 'table' and name = 'meta'"), "SELECT count(*) FROM sqlite_master WHERE type = 'table' AND name = 'vals'" (Source: sample.bin, Indicator: "select count(*) from sqlite_master where type = 'table' and name = 'vals'"), "INSERT OR IGNORE INTO unit_vals (unit_id, val_id, added) SELECT $u, $v, $t WHERE (SELECT count(*) FROM unit_vals uv JOIN vals x ON x.id = uv.val_id WHERE uv.unit_id = $u AND x.field = $f) < " (Source: sample.bin, Indicator: "insert or ignore into unit_vals (unit_id, val_id, added) select $u, $v, $t where (select count(*) from unit_vals uv join vals x on x.id = uv.val_id where uv.unit_id = $u and x.field = $f) < ")37:T5dc,Heuristic match: "_shared/style.md", Heuristic match: "_shared/brief.md", Pattern match: "http://placeholder/", Pattern match: "https://generativelanguage.googleapis.com/v1beta/models/", Pattern match: "https://api.github.com/repos/supervertaler/supervertaler-for-trados/releases/latest", Heuristic match: "style.md", Heuristic match: "explain (in general).md", Pattern match: "https://api.deepseek.com/v1", Pattern match: "https://api.anthropic.com/v1/models?limit=100", Heuristic match: "_shared/terminology.md", Pattern match: "https://api.x.ai/v1", Heuristic match: "brief.md", Pattern match: "https://api.mistral.ai/v1", Heuristic match: "' is already in terminology.md", Pattern match: "https://openrouter.ai/api/v1", Pattern match: "https://api.lemonsqueezy.com/v1/licenses", Pattern match: "https://supervertaler.com", Heuristic match: "explain (within project context).md", Pattern match: "https://api.openai.com/v1", Heuristic match: "select u.id, u.lang_a, u.text_a, u.lang_b, u.text_b, u.variant, u.created, u.changed, (select value from vals where id = u.created_by), (select value from vals where id = u.changed_by), u.added, (select group_concat(v.field || char(9) || v.value, char(10))", Heuristic match: " *.sn", Pattern match: "https://api.cognitive.microsofttranslator.com/translate?api-version=3.0&from=", Heuristic match: "terminology.md", Heuristic match: "superbench.md", Pattern match: "https://api.anthropic.com/v1/messages", Pattern match: "https://api.openai.com/v1/models"30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"TechArticle\",\"headline\":\"Sample f1169736f809… — Score 0/100 — Hybrid Analysis\",\"description\":\"Threat analysis for sample f1169736f809…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.\",\"url\":\"/sample/f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46\",\"keywords\":[\"malware analysis\",\"sandbox report\",\"threat intelligence\",\"f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46\"],\"about\":{\"@type\":\"SoftwareApplication\",\"name\":\"SuperVault.Tests.exe\",\"applicationCategory\":[\"peexe\",\"assembly\",\"executable\"],\"identifier\":\"f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46\"},\"threatScore\":0,\"antivirusDetections\":{\"malicious\":0,\"total\":27},\"behavioralIndicators\":{\"malicious\":0,\"suspicious\":0},\"publisher\":{\"@type\":\"Organization\",\"name\":\"Hybrid Analysis\",\"url\":\"https://www.hybrid-analysis.com\"}}"}}],["$","$L34",null,{"initialData":{"schema_version":"1.0.17","sha256":"f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1794436201002,"unified_at":"2026-11-11T22:30:01.002Z","metadata":{"hashes":{"sha256":"f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46","sha1":"4fceec7b0eff42085f81b8dd8b71f33abd5499a4","md5":"685927355f925059a136baf98ece5ae3"},"file_info":{"file_name":"SuperVault.Tests.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1005056,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1794436194000,"last_seen":1794436194000,"last_multi_scan":1794436194000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":16,"suspicious_count":0,"malicious_count":0,"total":16},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve files based on search patterns"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains native function calls (syscalls strings)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"$35","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$36","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://api.github.com/repos/Supervertaler/Supervertaler-for-Trados/releases/latest\" (Indicator: \"github.com\")","origin":"sample.bin","id":"string-135","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"); using MoveFileEx, which has to wait for readers.\" (Indicator: \"MoveFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1570","id":"string-322","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Supervertaler\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\d+\\.\\d+\\s*%; Source: \"sample.bin\"), Found string - \\d+\\.\\d+\\.\\d+; Source: \"sample.bin\"), Found string - Fig\\.\\s*\\d+[A-Z]?; Source: \"sample.bin\"), Found string - Section\\s+\\d+\\.\\d+; Source: \"sample.bin\"), Found string - \\bArtt?\\.\\s*\\d+; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564","id":"string-145","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HMACSHA256\" (Indicator: \"HMAC\"; Source: \"sample.bin\"), Found reference to \"HMACSHA256\" (Indicator: \"HMACSHA256\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://generativelanguage.googleapis.com\", Found HTTPS url \"https://api.github.com\", Found HTTPS url \"https://api.deepseek.com\", Found HTTPS url \"https://api.anthropic.com\", Found HTTPS url \"https://api.x.ai\", Found HTTPS url \"https://api.mistral.ai\", Found HTTPS url \"https://openrouter.ai\", Found HTTPS url \"https://api.lemonsqueezy.com\", Found HTTPS url \"https://supervertaler.com\", Found HTTPS url \"https://api.openai.com\", Found HTTPS url \"https://api.cognitive.microsofttranslator.com\"","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-98","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"https://generativelanguage.googleapis.com/v1beta/models/\" (Indicator: \".googleapis.com\"; Source: \"sample.bin\"), Found string \"https://api.anthropic.com/v1/models?limit=100\" (Indicator: \"api.anthropic.com\"; Source: \"sample.bin\"), Found string \"https://api.openai.com/v1\" (Indicator: \"api.openai.com\"; Source: \"sample.bin\"), Found string \"https://api.anthropic.com/v1/messages\" (Indicator: \"api.anthropic.com\"; Source: \"sample.bin\"), Found string \"https://api.openai.com/v1/models\" (Indicator: \"api.openai.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1102","id":"string-186","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://api.github.com/repos/Supervertaler/Supervertaler-for-Trados/releases/latest\" (Indicator: \"github.com\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1590","id":"string-761","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"^(?[A-Z0-9.&'\\-]*[A-Z][A-Z0-9.&'\\-]*)_(?[^_].*?)\\s*(\$[^()]*\$)?\\s*$\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"Druk op als a < b & c > d.\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"\"\" and \"a < b\" stay text\" (Indicator: \"\"; Source: \"sample.bin\"), Found string \"Press if a < b & c > d.\" (Indicator: \"\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1056.001","id":"string-556","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"{\"type\":\"image\",\"source\":{\"type\":\"base64\",\"media_type\":\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \"ToBase64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \",\"store\":false,\"include\":[\"reasoning.encrypted_content\"]\" (Indicator: \".encrypt\"; Source: \"sample.bin\"), Found string \"protectedBase64\" (Indicator: \"base64\"; Source: \"sample.bin\"), Found string \";base64,\" (Indicator: \"base64\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where something came from, omit the note and keep the rule.\" (Indicator: \"where \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-484","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \" it was saved under another Windows sign-in, or your Windows password was reset. Paste the key in again; nothing else is affected.\" (Indicator: \"password\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 2c:[["$","title","0",{"children":"Sample f1169736f809… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Threat analysis for sample f1169736f809…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46"}],["$","meta","4",{"property":"og:title","content":"Sample f1169736f809… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Threat analysis for sample f1169736f809…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f1169736f809711ac7a58c713d3f55b8b68ebdacabda5cd60b1bb05ea70bcb46"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Sample f1169736f809… — Score 0/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Threat analysis for sample f1169736f809…. Threat score 0/100. 0/27 AV engines flagged this file. 0 malicious and 0 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L38","11",{}]] 32:null