26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ef,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample f595cfe5c8d9… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f595cfe5c8d9…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55"],"about":{"@type":"SoftwareApplication","name":"f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55","applicationCategory":["peexe","executable"],"identifier":"f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":2,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T66c9,Found string "upload> -----------------------------7394425D123F068D-- -----------------------------418D36670C1F06AA Content-Disposition: form-data; name="metadata"; filename="0574008c0277a83b807e8da94ee2d663aa42d61d5bb7e6c3522d611cfb5f43f1.xml" Content-Type: application/octet-stream 0574008c0277a83b807e8da94ee2d663aa42d61d5bb7e6c3522d611cfb5f43f1 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt8A5A.tmp 1 0 -----------------------------418D36670C1F06AA-- -----------------------------0F872A7005FE06C7 Content-Disposition: form-data; name="metadata"; filename="78eb87cc35794205d1128bcc95d840278cdfffcaea2d5d00dfa0e5b4f7b0cd31.xml" Content-Type: application/octet-stream 78eb87cc35794205d1128bcc95d840278cdfffcaea2d5d00dfa0e5b4f7b0cd31 02/2"; Source: "sample.bin"), Found string " 51ddde7069b2c822687c3b40ca08217dc183321957fb1c16b6747ef5b298c3ac 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httC46A.tmp 1 0 -----------------------------7FEC71CF43960E6B-- -----------------------------69DA4DEB31350EC4 Content-Disposition: form-data; name="metadata"; filename="b97f417571031abb4fe8d4209f3d9cd968767529d6bcea259063fc503be01568.xml" Content-Type: application/octet-stream b97f417571031abb4fe8d4209f3d9cd968767529d6bcea259063fc503be01568 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httF6B1.tmp 1 0 -----------------------------69DA4DEB31350EC4-- ------------"; Source: "sample.bin"), Found string "----------------------5B9E04F275FC0FE0-- -----------------------------299878FC6FDC0FFD Content-Disposition: form-data; name="metadata"; filename="a06a72093071dd957a4263bbfc63f3a041711e9bf938b08296ea0bd210f775af.xml" Content-Type: application/octet-stream a06a72093071dd957a4263bbfc63f3a041711e9bf938b08296ea0bd210f775af 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httB1D0.tmp 1 0 -----------------------------299878FC6FDC0FFD-- -----------------------------559132CE13B8101E Content-Disposition: form-data; name="metadata"; filename="63b01a0d7354f21a16780ecb4ec049421fa40e7107e3e01a15a02b18fe37f1e6.xml" Content-Type: application/octet-stream 63b01a0d7354f21a16780ecb4ec049421fa40e7107e3e01a15a02b18fe37f1e6 02/21/13 10:53:11 ad4df4795caa47feaa99a73f3ea844ba0a348ba8e14b20387f8650818f3dc1ec 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt3593.tmp 1 0 -----------------------------02AB511F51F5015B-- -----------------------------58A72E0823E4016C Content-Disposition: form-data; name="metadata"; filename="c26e117a4aad4f4e7a82ef80efa8ae030bfb1938db41505f9540b401ec0da87c.xml" Content-Type: application/octet-stream c26e117a4aad4f4e7a82ef80efa8ae030bfb1938db41505f9540b401ec0da87c 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt560F.tmp 1 0 -----------------------------58A72E0823E4016C-- "; Source: "sample.bin"), Found string "B Content-Disposition: form-data; name="metadata"; filename="4b3c1f8d5a6c9801b58e162329cec865d8c0b96f9418457215eb6d29c1f5587f.xml" Content-Type: application/octet-stream 4b3c1f8d5a6c9801b58e162329cec865d8c0b96f9418457215eb6d29c1f5587f 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httFF5D.tmp 1 0 -----------------------------3D1E5F121DD808BB-- -----------------------------711A01C319C308CF Content-Disposition: form-data; name="metadata"; filename="0981622ece4e264d1f35845312fa361c398e05ca265cf4eba09e0b56e960974b.xml" Content-Type: application/octet-stream 0981622ece4e264d1f35845312fa361c398e05ca265cf4eba09e0b56e960974b 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt2738.tm"; Source: "sample.bin"), Found string "8350c125f1ba12a56190 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httD4CF.tmp 1 0 -----------------------------5CEB77671144002C-- -----------------------------10E71A180D2E003F Content-Disposition: form-data; name="metadata"; filename="66302e6143a2500354cffb63f5835f4d8e16348d128514f250f3184c41aae32b.xml" Content-Type: application/octet-stream 66302e6143a2500354cffb63f5835f4d8e16348d128514f250f3184c41aae32b 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httEA43.tmp 1 0 -----------------------------10E71A180D2E003F-- -----------------------------44E23CC909190053 Content-Disposition: form-data; "; Source: "sample.bin"), Found string "1a050ad5e03ae609a77bf642bb2 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt2C3F.tmp 1 0 -----------------------------4F45558144A50801-- -----------------------------7B3E0F5268810821 Content-Disposition: form-data; name="metadata"; filename="94afad9d6e9a7f3b5a9e0fe3f6220814072e519d2b3b628db73e7479c001ccdf.xml" Content-Type: application/octet-stream 94afad9d6e9a7f3b5a9e0fe3f6220814072e519d2b3b628db73e7479c001ccdf 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt4867.tmp 1 0 -----------------------------7B3E0F5268810821-- -----------------------------2F3A3203646C0835 Content-Disposition: form"; Source: "sample.bin"), Found string "nerfile> 0 -----------------------------6E0A1A1732AD0458-- -----------------------------4C0A5FDF5CA9045B Content-Disposition: form-data; name="metadata"; filename="e642526b7266dbc110345e02b00625b96ec9d3512b04b3b6e954918abf75abcf.xml" Content-Type: application/octet-stream e642526b7266dbc110345e02b00625b96ec9d3512b04b3b6e954918abf75abcf 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httE944.tmp 1 0 -----------------------------4C0A5FDF5CA9045B-- -----------------------------000502915893046E Content-Disposition: form-data; name="metadata"; filename="2f874d99eb42c230cf10cb0548085b186ba7231a00ecce2cde090cc9054a8137.xml" Content-Type: application/octet-stream 2f874d99eb42c"; Source: "sample.bin"), Found string ":53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httD327.tmp 1 0 -----------------------------5D17055C122A7F5B-- -----------------------------3313624564187F6B Content-Disposition: form-data; name="metadata"; filename="ac13166d7edbd01a9094c7a7adf7af38a74093ec3212e40e059d9a07d482fefb.xml" Content-Type: application/octet-stream ac13166d7edbd01a9094c7a7adf7af38a74093ec3212e40e059d9a07d482fefb 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httEEC3.tmp 1 0 -----------------------------3313624564187F6B-- -----------------------------09103F2E36067F7B Content-Disposition: form-data; name="metadata"; filename="5abcd2b7ad78488393e9e37a5fd0"; Source: "sample.bin"), Found string "dc801882cfa.xml" Content-Type: application/octet-stream 1cbbf1607a6b98e52b3f3633dd7f41c1d1709d1ea30c923d56ffadc801882cfa 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt3FAB.tmp 1 0 -----------------------------7A504C56781B030B-- -----------------------------2E4C6F077406031E Content-Disposition: form-data; name="metadata"; filename="18491a27392ba46b534994c56d032a32676b4b55954bd818291d48a967f37ec1.xml" Content-Type: application/octet-stream 18491a27392ba46b534994c56d032a32676b4b55954bd818291d48a967f37ec1 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt5AAB.tmp 1 0 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt4909.tmp 1 0 -----------------------------60D624DC7CD8008E-- -----------------------------14D2478D78C200A1 Content-Disposition: form-data; name="metadata"; filename="a6e9e39c43c4beb9b7d39a0732c0925954d29ae1035ef0ef2df970747a13ec63.xml" Content-Type: application/octet-stream a6e9e39c43c4beb9b7d39a0732c0925954d29ae1035ef0ef2df970747a13ec63 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt6052.tmp 1 0 -----------------------------14D2478D78C200A1-- -----------------------------6ACF24764AB000B2 Conte"; Source: "sample.bin"), Found string "4f35fb7333a2789.xml" Content-Type: application/octet-stream 7201c9d18b6fb307c0ac987f859d525bdc72c44cfbc4248a14f35fb7333a2789 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt483A.tmp 1 0 -----------------------------259A4E53185F066F-- -----------------------------7394425D123F068D Content-Disposition: form-data; name="metadata"; filename="b549a5a0e18768a60873356c6e3b92308ec08a678048d6eb64eea310ad15fcaa.xml" Content-Type: application/octet-stream b549a5a0e18768a60873356c6e3b92308ec08a678048d6eb64eea310ad15fcaa 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt675F.tmp 1 0 df7307ad5d9168329ab07385206e235f5d256d190ac00901d9da38ea01368616 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt3A52.tmp 1 0 -----------------------------14E544C164AB09CD-- -----------------------------6CD738642C630A0F Content-Disposition: form-data; name="metadata"; filename="c2c93dba58f7a20e7abc90c42f4e36db59375906ad568c2304ffa5a9907e8ba4.xml" Content-Type: application/octet-stream c2c93dba58f7a20e7abc90c42f4e36db59375906ad568c2304ffa5a9907e8ba4 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt6EFA.tmp 1 0 -----------------------------6CD738642C"; Source: "sample.bin"), Found string " -----------------------------751F3FFA1A557F34-- -----------------------------4B1B1CE36C437F44 Content-Disposition: form-data; name="metadata"; filename="aed565aa7dc9fbc7136286f3883a037ce5d3a82f5fb78570c9fb8a2af3c61f2c.xml" Content-Type: application/octet-stream aed565aa7dc9fbc7136286f3883a037ce5d3a82f5fb78570c9fb8a2af3c61f2c 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httBEBC.tmp 1 0 -----------------------------4B1B1CE36C437F44-- -----------------------------5D17055C122A7F5B Content-Disposition: form-data; name="metadata"; filename="2e8d3e9e4610613f493812901e92f37187aae07a02c67591c5c660f56500a41e.xml" Content-Type: application/octet-stream 2e8d3e9e4610613f493812901e92f37187aae07a02c67591c5c660f56500a41e 02/21/13 10"; Source: "sample.bin"), Found string "ame>\\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt68AD.tmp 1 0 -----------------------------372B1DAF50927EFC-- -----------------------------6B2640604C7C7F10 Content-Disposition: form-data; name="metadata"; filename="bf0c2e31406c7c136704b9d94553814c41fbaf6837a31fd183ac0de26d5ce5f7.xml" Content-Type: application/octet-stream bf0c2e31406c7c136704b9d94553814c41fbaf6837a31fd183ac0de26d5ce5f7 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt7CF9.tmp 1 0 -----------------------------6B2640604C7C7F10-- -----------------------------41231D491E6A7F20 Content-Disposition: form-data; name="metadata"; filename="fb70425cd26e8c74c2cfaaed610861ef98259b92129e1f47d2b75fce"; Source: "sample.bin"), Found string "----0B3163DE2CB67EDB-- -----------------------------612E40C67EA47EEC Content-Disposition: form-data; name="metadata"; filename="2625c9868f173a57f2edfb69e614ca059be454533bb653ee60579b737372393c.xml" Content-Type: application/octet-stream 2625c9868f173a57f2edfb69e614ca059be454533bb653ee60579b737372393c 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt55B8.tmp 1 0 -----------------------------612E40C67EA47EEC-- -----------------------------372B1DAF50927EFC Content-Disposition: form-data; name="metadata"; filename="52efea82bca9bbb0d905fc5036f8924387097a1542f753486de783025981cda4.xml" Content-Type: application/octet-stream 52efea82bca9bbb0d905fc5036f8924387097a1542f753486de783025981cda4 02/21/13 10:53:11 ba2b1890d5f2ef21797e47ee0f557cae6fa50444d2bafd43ff2bd3764dfe815e 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt6AE7.tmp 1 0 -----------------------------0CA350B91FCE017F-- -----------------------------108F7E2E0B6201E1 Content-Disposition: form-data; name="metadata"; filename="0bea82cce2865a943b102adc1914252b62e6d1b26ea979d0aac23571a4951ac0.xml" Content-Type: application/octet-stream 0bea82cce2865a943b102adc1914252b62e6d1b26ea979d0aac23571a4951ac0 02/21/13 10:53:11 \\?\C:\Program File"; Source: "sample.bin"), Found string "re> 0 -----------------------------52F277CD436B0008-- -----------------------------28EF54B615590018 Content-Disposition: form-data; name="metadata"; filename="b0049d57e18032bdc65ba66ae01f1a47a089ef769eefa4770dde52995a5a53e1.xml" Content-Type: application/octet-stream b0049d57e18032bdc65ba66ae01f1a47a089ef769eefa4770dde52995a5a53e1 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httBE42.tmp 1 0 -----------------------------28EF54B615590018-- -----------------------------5CEB77671144002C Content-Disposition: form-data; name="metadata"; filename="ffb9171f2a6eaa88d77be8cf4cfed824f752c98c76ca8350c125f1ba12a56190.xml" Content-Type: application/octet-stream ffb9171f2a6eaa88d77be8cf4cfed824f752c98c76ca"; Source: "sample.bin"), Found string "256> 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt1856.tmp 1 0 -----------------------------2C2B4A577D5503BE-- -----------------------------7A243E61773503DC Content-Disposition: form-data; name="metadata"; filename="b5b303cde45d8998dfc7c8acf11efc190123eedf161ecf7c828363de7d665390.xml" Content-Type: application/octet-stream b5b303cde45d8998dfc7c8acf11efc190123eedf161ecf7c828363de7d665390 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt30A7.tmp 1 0 -----------------------------7A243E61773503DC-- -----------------------------0C2026DA1D1C03F2 Content-Disposition: form-data; name="metadata"; filename"; Source: "sample.bin"), Found string "--------29DD17B305BF052F Content-Disposition: form-data; name="metadata"; filename="41beb201297a7b7135d3bca6865e64adb4a8abc41b6301a90a358821ea37e8ea.xml" Content-Type: application/octet-stream 41beb201297a7b7135d3bca6865e64adb4a8abc41b6301a90a358821ea37e8ea 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httB467.tmp 1 0 -----------------------------29DD17B305BF052F-- -----------------------------77D70BBC7F9F054D Content-Disposition: form-data; name="metadata"; filename="d01658879eaf1b8ebebeb87c449313613d73cc0553ec9e26f44e36cfe0f38ba7.xml" Content-Type: application/octet-stream d01658879eaf1b8ebebeb87c449313613d73cc0553ec9e26f44e36cfe0f38ba7 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\modul"; Source: "sample.bin"), Found string "\Program Files\Trend Micro\AMSP\module\20004\temp\htt51D2.tmp 1 0 -----------------------------61AB571758400FA2-- -----------------------------37A834002A2E0FB2 Content-Disposition: form-data; name="metadata"; filename="86da2d9eebb010f82f1d8b299f664d212c50e474ec460ef6550e326b80cc3afb.xml" Content-Type: application/octet-stream 86da2d9eebb010f82f1d8b299f664d212c50e474ec460ef6550e326b80cc3afb 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt67A4.tmp 1 0 -----------------------------37A834002A2E0FB2-- -----------------------------27A262417A120FCC Content-Disposition: form-data; name="metadata"; filename="64aa2fdc139fa53963b7e77f9393aab2fbdba8cbaede4a7bdf5e5c1ee8aabb3e.x"; Source: "sample.bin"), Found string "f50c661fef83e0c08b85a27a7504c35a2b889efbbcc9e8acd83e4c35273589f.xml" Content-Type: application/octet-stream 5f50c661fef83e0c08b85a27a7504c35a2b889efbbcc9e8acd83e4c35273589f 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt8739.tmp 1 0 -----------------------------04F803C4498C7FEA-- -----------------------------52F277CD436B0008 Content-Disposition: form-data; name="metadata"; filename="f94609f046a4b797e312c8db1a0657ceb189365a15695f8659e984e8bbb00596.xml" Content-Type: application/octet-stream f94609f046a4b797e312c8db1a0657ceb189365a15695f8659e984e8bbb00596 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt9E14.tmp 1 3a0cf473e6781b4ee55257e581586d1b16deee5835277c3a200f2fd9b8b30075 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt17C.tmp 1 0 -----------------------------44E23CC909190053-- -----------------------------78DE5F7A05030067 Content-Disposition: form-data; name="metadata"; filename="18315f0fed6ca8ad99064ea842d1e024acb16912e2aef84bb352e4d88a8d94d1.xml" Content-Type: application/octet-stream 18315f0fed6ca8ad99064ea842d1e024acb16912e2aef84bb352e4d88a8d94d1 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt1970.tmp 1 6e0d787e3264c77eadbf5c4e0e6800ea5d1a2bc8122f8c45084c6ff6283c5b65 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt5904.tmp 1 0 -----------------------------0D0E69D60D820909-- -----------------------------5CFD749B7D2C0958 Content-Disposition: form-data; name="metadata"; filename="585ddaf53550b5ceb60e025ef0a60c06838ec89fb33c9ea6d10d8598aa34c9d6.xml" Content-Type: application/octet-stream 585ddaf53550b5ceb60e025ef0a60c06838ec89fb33c9ea6d10d8598aa34c9d6 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\htt8707.tmp 1 0 -----------------------------5CFD749B7D2C0958-- ----------------"; Source: "sample.bin"), Found string "MSP\module\20004\temp\httB30F.tmp 1 0 -----------------------------31C66FD048D00F1F-- -----------------------------65C2128144BA0F33 Content-Disposition: form-data; name="metadata"; filename="cb171c78aed25a28b88e667e6807979387a90e5bcf5b7a6b4509becf6b0391ce.xml" Content-Type: application/octet-stream cb171c78aed25a28b88e667e6807979387a90e5bcf5b7a6b4509becf6b0391ce 02/21/13 10:53:11 \\?\C:\Program Files\Trend Micro\AMSP\module\20004\temp\httCBFC.tmp 1 0 -----------------------------65C2128144BA0F33-- -----------------------------6FBB121B12930F57 Content-Disposition: form-data; name="metadata"; filename="d574a7a3eca9bf56cb3e1e4eac75f207f8408841a0669ca9123d861aeff6f4bd.xml" Content-Type: applicati"; Source: "sample.bin")28:T3c3c,Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetNameStringW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "CopySid"; Source: "sample.bin"), Found reference to API (Indicator: "GetLocaleInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "RtlUnwind"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "sample.bin"), Found reference to API (Indicator: "FlushFileBuffers"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileSizeEx"; Source: "sample.bin"), Found reference to API (Indicator: "CertGetNameString"; Source: "sample.bin"), Found reference to API (Indicator: "Process32FirstW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "sample.bin"), Found reference to API (Indicator: "SetEndOfFile"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "ConvertSecurityDescriptorToStringSecurityDescriptorW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleA"; Source: "sample.bin"), Found reference to API (Indicator: "CloseServiceHandle"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "SetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesW"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "FlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "HeapFree"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFindAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleMode"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessHeap"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "RaiseException"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "FlsGetValue"; Source: "sample.bin"), Found reference to API (Indicator: "LocalSize"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API (Indicator: "WTSQueryUserToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsWow64Process"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "EncodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathW"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "LeaveCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "EnterCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAddAtomW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "WideCharToMultiByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastActivePopup"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgClose"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "sample.bin"), Found reference to API (Indicator: "CoInitialize"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedExchange"; Source: "sample.bin"), Found reference to API (Indicator: "OpenMutexW"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountNameW"; Source: "sample.bin"), Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualQuery"; Source: "sample.bin"), Found reference to API (Indicator: "CertCloseStore"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenA"; Source: "sample.bin"), Found reference to API (Indicator: "lstrlenW"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidLocale"; Source: "sample.bin"), Found reference to API (Indicator: "GetACP"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "sample.bin"), Found reference to API (Indicator: "DuplicateHandle"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsValidCodePage"; Source: "sample.bin"), Found reference to API (Indicator: "EnumWindows"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpW"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "HeapDestroy"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSize"; Source: "sample.bin"), Found reference to API (Indicator: "RegEnumKeyExW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "SetEntriesInAclW"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxW"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileType"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCPInfo"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "IsDebuggerPresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "CopyFileW"; Source: "sample.bin"), Found reference to API (Indicator: "TlsAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "EnumSystemLocalesA"; Source: "sample.bin"), Found reference to API (Indicator: "GetActiveWindow"; Source: "sample.bin"), Found reference to API (Indicator: "OpenServiceW"; Source: "sample.bin"), Found reference to API (Indicator: "InitializeCriticalSection"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetSpecialFolderPathW"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "sample.bin"), Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcess"; Source: "sample.bin"), Found reference to API (Indicator: "ShellExecuteW"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpiW"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedDecrement"; Source: "sample.bin"), Found reference to API (Indicator: "GetConsoleCP"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "CoCreateInstance"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcessWindowStation"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "TlsFree"; Source: "sample.bin"), Found reference to API (Indicator: "GetStdHandle"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExW"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCommandLineA"; Source: "sample.bin"), Found reference to API (Indicator: "SetHandleCount"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "DecodePointer"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessW"; Source: "sample.bin"), Found reference to API (Indicator: "FlsSetValue"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "sample.bin"), Found reference to API (Indicator: "GetOEMCP"; Source: "sample.bin"), Found reference to API (Indicator: "CryptQueryObject"; Source: "sample.bin"), Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "sample.bin"), Found reference to API (Indicator: "HeapCreate"; Source: "sample.bin"), Found reference to API (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "PathFileExistsW"; Source: "sample.bin"), Found reference to API (Indicator: "VirtualFree"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "LCMapStringW"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileW"; Source: "sample.bin"), Found reference to API (Indicator: "CreatePipe"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), Found reference to API (Indicator: "Process32NextW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleW"; Source: "sample.bin"), Found reference to API (Indicator: "WriteConsoleA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPriorityClass"; Source: "sample.bin"), Found reference to API (Indicator: "CLSIDFromString"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "sample.bin"), Found reference to API (Indicator: "CoUninitialize"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "InterlockedIncrement"; Source: "sample.bin"), Found reference to API (Indicator: "CryptMsgGetParam"; Source: "sample.bin"), Found reference to API (Indicator: "LookupAccountSidW"; Source: "sample.bin"), Found reference to API (Indicator: "MultiByteToWideChar"; Source: "sample.bin"), Found reference to API (Indicator: "HeapReAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeW"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "sample.bin"), Found reference to API (Indicator: "GetStringTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "SetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameW"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "OpenSCManagerW"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "sample.bin")29:Ta07,"Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION" in Source: sample.bin, "Software\Classes\skype.callto" in Source: sample.bin, "SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{830690FC-BF2F-47A6-AC2D-330BCB402664}" in Source: sample.bin, "Software\Classes\skype\shell\open\command" in Source: sample.bin, "Software\Clients\Internet Call\Skype\Protocols\callto\DefaultIcon" in Source: sample.bin, "Software\Classes\skype" in Source: sample.bin, "Software\Classes\skype\DefaultIcon" in Source: sample.bin, "Software\Clients\Internet Call\Skype\Protocols\callto\shell\open\command" in Source: sample.bin, "Software\Clients\Internet Call\Skype\Protocols\callto" in Source: sample.bin, "Software\Classes\skype.callto\shell\open\command" in Source: sample.bin, "SOFTWARE\RegisteredApplications" in Source: sample.bin, "Software\Skype" in Source: sample.bin, "Software\Classes\skype.callto\DefaultIcon" in Source: sample.bin, "Software\Classes\MIME\Database\Content Type\application/x-skype" in Source: sample.bin, "Software\Skype\Updater" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Uninstall\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" in Source: sample.bin, "Software\Clients\Internet Call\Skype\shell\open\command" in Source: sample.bin, "Software\Classes\.skype" in Source: sample.bin, "Software\Skype\Phone\UI" in Source: sample.bin, "Software\Clients\Internet Call\Skype" in Source: sample.bin, "SOFTWARE\Clients\StartMenuInternet" in Source: sample.bin, "Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPERSERVER" in Source: sample.bin, "SOFTWARE\Clients\Internet Call\Skype\Capabilities$" in Source: sample.bin, "Software\IM Providers\Skype" in Source: sample.bin, "Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MAXCONNECTIONSPER1_0SERVER" in Source: sample.bin, "Software\Skype\Phone" in Source: sample.bin, "SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CC957078-B838-47C4-A7CF-626E7A82FC58}" in Source: sample.bin, "Software\Classes\Skype.Content" in Source: sample.bin, "Software\Clients\Internet Call\Skype\Capabilities\URLAssociations" in Source: sample.bin, "Software\Skype\Phone\UI\General" in Source: sample.bin, "Software\Microsoft\Internet Explorer\Version Vector" in Source: sample.bin, "SYSTEM\CurrentControlSet\Services\EventLog\Application\SkypeUpdate" in Source: sample.bin, "Software\Microsoft\Windows\CurrentVersion\Run" in Source: sample.bin, "Software\Clients\Internet Call\Skype\Capabilities" in Source: sample.bin2a:T448,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "sample.bin"), Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "sample.bin"), Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "sample.bin"), Found reference to API "EnumProcesses" (Indicator: "EnumProcesses"; Source: "sample.bin"), Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "sample.bin"), Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "sample.bin"), Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "sample.bin")1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"NOT_AVAILABLE","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1793637011360,"unified_at":"2026-11-02T16:30:11.360Z","metadata":{"hashes":{"sha256":"f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55","sha1":"3c5588e7c171474d474b6970e04e09146541846e","md5":"a2d4cd14cbf3fbf839975356c755ee79"},"file_info":{"file_name":"f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1025361,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1793636998000,"last_seen":1793636998000,"last_multi_scan":1793636998000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":42},"sandbox_signatures":{"informative_count":75,"suspicious_count":3,"malicious_count":2,"total":80},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Wacatac.oa!s2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Stealth","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to identify Internet Explorer version from registry"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry key string for installed applications"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains reference to licensed c/c++ library"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to modify system service (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"qsp","report_id":""}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid file alignment of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with low confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"low\" confidence","origin":"Static Analysis","id":"mlmodel-18","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$27","origin":"sample.bin","mitre_attack_id":"T1041","id":"string-511","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"b\ncontent-disposition: form-data; name=metadata; filename=4b3c1f8d5a6c9801b58e162329cec865d8c0b96f9418457215eb6d29c1f5587f.xml\ncontent-type: application/octet-stream\n\n \n \n 4b3c1f8d5a6c9801b58e162329cec865d8c0b96f941845721\", Pattern match: \"http://ui.skype.com/ui/0/6.1.0.129/ja/help\", Pattern match: \"http://ui.skype.com/ui/0/6.1.0.129/ja/latestversion\", Pattern match: \"http://www.skype.com3\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Failed to get shutdown privilege LUID.\" (Indicator: \" shutdown \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-899","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Potential IP \"6.1.0.129\" found in string \"http://ui.skype.com/ui/0/6.1.0.129/ja/help\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1559","id":"string-210","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$29","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-242","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"failed to OpenSCManager\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\"), Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-191","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains reference to licensed c/c++ library","description":"Found string \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\" (Indicator: \"Copyright (c) 1992-2004 by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-462","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\Users\\andresk\\Documents\\Skype\\trunk\\ms_installer\\Components\\Custom\\Release\\Custom.pdb\", \"C:\\delivery\\Dev\\wix30_public\\build\\ship\\x86\\wixca.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"sample.bin\"), Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-272","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT `Data` FROM `Binary` WHERE `Name`='SkypeShutdown'\" (Source: sample.bin, Indicator: \"select `data` from `binary` where `name`='skypeshutdown'\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"sample.bin\"), Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"failed to CreateProcessAsUser\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-240","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1059.003","id":"string-206","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\"), Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"sample.bin\"), Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; Source: \"sample.bin\"), Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; Source: \"sample.bin\"), Found reference to API \"GetSecurityDescriptorControl\" (Indicator: \"GetSecurityDescriptorControl\"; Source: \"sample.bin\"), Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"SetEntriesInAclW\" (Indicator: \"SetEntriesInAcl\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"sample.bin\"), Found reference to API \"GetSecurityDescriptorDacl\" (Indicator: \"GetSecurityDescriptorDacl\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyExW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"sample.bin\", Found registry deletion API: \"RegDeleteValueW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"failed to WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"failed to CreateProcessAsUser\" (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\"), Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.002","id":"string-168","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown executable has invalid signature\" (Indicator: \"shutdown \") in Source: sample.bin, Observed string: \"Shutdown executable path is missing\" (Indicator: \"shutdown \") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeTcbPrivilege\" (Indicator: \"SeTcbPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeChangeNotifyPrivilege\" (Indicator: \"SeChangeNotifyPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeIncreaseWorkingSetPrivilege\" (Indicator: \"SeIncreaseWorkingSetPrivilege\"; Source: \"sample.bin\"), Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1548","id":"string-97","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertGetNameStringW\" (Indicator: \"CertGetNameString\"; Source: \"sample.bin\"), Found reference to API \"CertGetNameString\" (Indicator: \"CertGetNameString\"; Source: \"sample.bin\"), Found reference to API \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"sample.bin\"), Found reference to API \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; Source: \"sample.bin\"), Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; Source: \"sample.bin\"), Found reference to API \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CertGetNameStringW\" (Indicator: \"CertGetNameStringW\"; Source: \"sample.bin\"), Found api reference \"CertFreeCertificateContext\" (Indicator: \"CertFreeCertificateContext\"; Source: \"sample.bin\"), Found api reference \"CryptMsgClose\" (Indicator: \"CryptMsgClose\"; Source: \"sample.bin\"), Found api reference \"CertCloseStore\" (Indicator: \"CertCloseStore\"; Source: \"sample.bin\"), Found api reference \"CertFindCertificateInStore\" (Indicator: \"CertFindCertificateInStore\"; Source: \"sample.bin\"), Found api reference \"CryptQueryObject\" (Indicator: \"CryptQueryObject\"; Source: \"sample.bin\"), Found api reference \"CryptMsgGetParam\" (Indicator: \"CryptMsgGetParam\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeW\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoW\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$2a","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExW\" in \"sample.bin\", Found registry query API: \"RegEnumKeyExW\" in \"sample.bin\", Found registry query API: \"RegOpenKeyTransactedW\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"failed to WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"sample.bin\"), Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"sample.bin\"), Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"sample.bin\"), Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-115","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1087","id":"string-452","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\"), Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"http://ui.skype.com/ui/0/6.1.0.129/ja/help\" (Indicator: \"skype.com\"), \"http://ui.skype.com/ui/0/6.1.0.129/ja/latestversion\" (Indicator: \"skype.com\"), \"http://www.skype.com3\" (Indicator: \"skype.com\")","origin":"sample.bin","id":"string-61","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"sample.bin\"), Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"sample.bin\"), Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1614","id":"string-201","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\"), Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-450","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationW\" in \"sample.bin\", Found system information discovery API: \"GetUserObjectInformationA\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStringsW\" in \"sample.bin\", Found system information discovery API: \"GetEnvironmentStrings\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-663","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; Source: \"sample.bin\"), Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"sample.bin\"), Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"sample.bin\"), Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"sample.bin\"), Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-141","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.002","id":"string-661","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfig2W\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1007","id":"string-910","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-140","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify Internet Explorer version from registry","description":"Found string \"Software\\Microsoft\\Internet Explorer\\Version Vector\" (Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-898","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1010","id":"string-413","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"failed to OpenService\" (Indicator: \"OpenService\"; Source: \"sample.bin\"), Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1569.002","id":"string-544","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"Found reference to API \"failed to ChangeServiceConfig2\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\"), Found reference to API \"ChangeServiceConfig2W\" (Indicator: \"ChangeServiceConfig\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543.003","id":"string-192","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\"), Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"sample.bin\"), Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Found Wow64 API, but unable to link to Wow64DisableWow64FsRedirection function in kernel32.dll\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"sample.bin\"), Found reference to API \"Found Wow64 API, but unable to link to Wow64RevertWow64FsRedirection function in kernel32.dll\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070","id":"string-553","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"failed to WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\"), Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1018","id":"string-546","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":0,"spawned_processes_count":0,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":null,"processes":null,"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample f595cfe5c8d9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f595cfe5c8d9…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample f595cfe5c8d9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f595cfe5c8d9…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f595cfe5c8d93fd69300dd0609102cc9a9dedfb34462ea1408390a7fde24bc55"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample f595cfe5c8d9… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f595cfe5c8d9…. Malware family: Win/malicious_confidence_70%. Threat score 100/100. 2/25 AV engines flagged this file. 2 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]