26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Trojan/ShellLoader.gx Sample f604247eb445… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample f604247eb445…. Malware family: Trojan/ShellLoader.gx. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f604247eb4451df9fa780cf9f88f7cb48e26b64e17b1a404798416a714237476","keywords":["Suspicious","Trojan/ShellLoader.gx","malware analysis","sandbox report","threat intelligence","f604247eb4451df9fa780cf9f88f7cb48e26b64e17b1a404798416a714237476"],"about":{"@type":"SoftwareApplication","name":"f604247eb4451df9fa780cf9f88f7cb48e26b64e17b1a404798416a714237476","applicationCategory":["peexe","64bits","assembly","executable"],"identifier":"f604247eb4451df9fa780cf9f88f7cb48e26b64e17b1a404798416a714237476","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"Trojan/ShellLoader.gx","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Tb2c,Found reference to API "duplicate_sequence" (Indicator: "dup"; Source: "sample.bin"), Found reference to API "I usually read after dinner." (Indicator: "read"; Source: "sample.bin"), Found reference to API ", WasTruncated = " (Indicator: "truncate"; Source: "sample.bin"), Found reference to API ", SerialOpen = " (Indicator: "open"; Source: "sample.bin"), Found reference to API ", Timeline = " (Indicator: "time"; Source: "sample.bin"), Found reference to API "SELECT Version FROM LearningSchemaVersions WHERE Name='vocabulary'" (Indicator: "select"; Source: "sample.bin"), Found reference to API "WebSocket " (Indicator: "socket"; Source: "sample.bin"), Found reference to API "SELECT Payload FROM LearningEvents WHERE UserId=$user ORDER BY OccurredAt DESC,EventId LIMIT $limit" (Indicator: "select"; Source: "sample.bin"), Found reference to API "New adult dual-slot numeric statistics: one user-started window <=8s, no raw audio persistence, ASR/model/TTS/playback disabled" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "Content-Security-Policy" (Indicator: "security"; Source: "sample.bin"), Found reference to API "I enjoy reading because stories give me new ideas." (Indicator: "read"; Source: "sample.bin"), Found reference to API "CaptureTimeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API ", LatestAttemptId = " (Indicator: "stat"; Source: "sample.bin"), Found reference to API "\AXIAOZHI_UI_PROFILE_ACK=GEN:(?[1-9][0-9]{0,9});ID:(?Guest|P[0-9]{1,6});Q:(?[0-9A-F]{16});REV:(?[1-9][0-9]{0,9});HASH:(?[0-9A-F]{8});STATE:(?APPLIED|REJECTED);REASON:(?[A-Z]{2,12})\z" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "SELECT COUNT(*) FROM ConversationSessions WHERE SessionId=$session AND UserId=$user" (Indicator: "select"; Source: "sample.bin"), Found reference to API ", NodeStates = " (Indicator: "stat"; Source: "sample.bin"), Found reference to API "^XIAOZHI_PERIPHERAL_STATE=([A-Za-z0-9_-]+);STATE=(ONLINE|OFFLINE|RECOVERING|FAULT)(?:;SOURCE=([^;\r\n]+))?(?:;REASON=([^\r\n]+))?$" (Indicator: "stat"; Source: "sample.bin"), Found reference to API ", SeedReservedUpperCny = " (Indicator: "dup"; Source: "sample.bin"), Found reference to API "XIAOZHI_GATEWAY_WS=READY;" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ClientTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "XIAOZHI_GATEWAY_BIND_ACK=OK;" (Indicator: "bind"; Source: "sample.bin"), file/memory contains long string with (Indicator: "dup"; Source: "sample.bin"), Found reference to API "RESTRICTED_FEEDBACK_ACCEPTED" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "acceptance-adult-70-b" (Indicator: "accept"; Source: "sample.bin"), Found reference to API "acceptance-adult-70-a" (Indicator: "accept"; Source: "sample.bin")28:T1d7c,"SELECT Version FROM LearningSchemaVersions WHERE Name='vocabulary'" (Source: sample.bin, Indicator: "select version from learningschemaversions where name='vocabulary'"), "SELECT Payload FROM LearningEvents WHERE UserId=$user ORDER BY OccurredAt DESC,EventId LIMIT $limit" (Source: sample.bin, Indicator: "select payload from learningevents where userid=$user order by occurredat desc,eventid limit $limit"), "SELECT COUNT(*) FROM ConversationSessions WHERE SessionId=$session AND UserId=$user" (Source: sample.bin, Indicator: "select count(*) from conversationsessions where sessionid=$session and userid=$user"), "SELECT UserId FROM ConversationSessions WHERE SessionId=$session" (Source: sample.bin, Indicator: "select userid from conversationsessions where sessionid=$session"), "INSERT INTO LearningAttempts(AttemptId,UserId,SessionId,CourseId,ContentId,ContentVersion,Word,StartedAt,AnsweredAt,Assessment,Status,Payload) VALUES($id,$user,$session,$course,$content,$version,$word,$time,NULL,0,0,$payload)" (Source: sample.bin, Indicator: "insert into learningattempts(attemptid,userid,sessionid,courseid,contentid,contentversion,word,startedat,answeredat,assessment,status,payload) values($id,$user,$session,$course,$content,$version,$word,$time,null,0,0,$payload)"), "SELECT Payload FROM LearningReviews WHERE ReviewId=$id" (Source: sample.bin, Indicator: "select payload from learningreviews where reviewid=$id"), "SELECT Payload FROM LearningEvents WHERE EventId=$id" (Source: sample.bin, Indicator: "select payload from learningevents where eventid=$id"), "SELECT MemoryId,UserId,SessionId,Category,Content,CreatedAt,UpdatedAt,LastRecalledAt FROM LongTermMemories WHERE UserId=$user ORDER BY UpdatedAt DESC LIMIT $limit" (Source: sample.bin, Indicator: "select memoryid,userid,sessionid,category,content,createdat,updatedat,lastrecalledat from longtermmemories where userid=$user order by updatedat desc limit $limit"), "SELECT COUNT(*) FROM DailyChatSources WHERE SourceId=$id" (Source: sample.bin, Indicator: "select count(*) from dailychatsources where sourceid=$id"), "SELECT UserId,SessionId,FromStage,ToStage,Reason,OccurredAt FROM ParentPlacementReviews WHERE UserId=$user ORDER BY OccurredAt DESC LIMIT 20" (Source: sample.bin, Indicator: "select userid,sessionid,fromstage,tostage,reason,occurredat from parentplacementreviews where userid=$user order by occurredat desc limit 20"), "SELECT Name, PNPDeviceID, Present, ConfigManagerErrorCode FROM Win32_PnPEntity WHERE PNPClass = 'Ports'" (Source: sample.bin, Indicator: "select name, pnpdeviceid, present, configmanagererrorcode from win32_pnpentity where pnpclass = 'ports'"), "INSERT INTO UserPreferences(PreferenceId, UserId, PreferenceKey, PreferenceValue, UpdatedAt) VALUES ($id,$user,$key,$value,$now) ON CONFLICT(UserId,PreferenceKey) DO UPDATE SET PreferenceId=$id, PreferenceValue=$value, UpdatedAt=$now" (Source: sample.bin, Indicator: "insert into userpreferences(preferenceid, userid, preferencekey, preferencevalue, updatedat) values ($id,$user,$key,$value,$now) on conflict(userid,preferencekey) do update set preferenceid=$id, preferencevalue=$value, updatedat=$now"), "SELECT COUNT(*),COALESCE(SUM(State=$completed),0) FROM AutonomousLearningSessions WHERE UserId=$user AND StartedAt>=$from AND StartedAt<$to" (Source: sample.bin, Indicator: "select count(*),coalesce(sum(state=$completed),0) from autonomouslearningsessions where userid=$user and startedat>=$from and startedat<$to"), "INSERT OR IGNORE INTO LearningCourses(CourseId,Name,Language) VALUES($id,$name,'en')" (Source: sample.bin, Indicator: "insert or ignore into learningcourses(courseid,name,language) values($id,$name,'en')"), "DELETE FROM ConversationSessions WHERE UserId=$user" (Source: sample.bin, Indicator: "delete from conversationsessions where userid=$user"), "SELECT Payload FROM LearningAttempts WHERE AttemptId=$id AND UserId=$user" (Source: sample.bin, Indicator: "select payload from learningattempts where attemptid=$id and userid=$user"), "SELECT SessionId, UserId, StartedAt, LastActiveAt, Summary FROM ConversationSessions WHERE UserId=$user ORDER BY LastActiveAt DESC" (Source: sample.bin, Indicator: "select sessionid, userid, startedat, lastactiveat, summary from conversationsessions where userid=$user order by lastactiveat desc"), "SELECT a.Word,COUNT(*),SUM((COALESCE((SELECT r.Assessment FROM LearningReviews r WHERE r.AttemptId=a.AttemptId AND r.UserId=a.UserId ORDER BY r.OccurredAt DESC,r.ReviewId DESC LIMIT 1),a.Assessment))=1),SUM((COALESCE((SELECT r.Assessment FROM LearningReviews r WHERE r.AttemptId=a.AttemptId AND r.UserId=a.UserId ORDER BY r.OccurredAt DESC,r.ReviewId DESC LIMIT 1),a.Assessment))=2),MAX(a.AnsweredAt) FROM LearningAttempts a WHERE a.UserId=$user AND a.AnsweredAt IS NOT NULL AND a.Status<>5 AND a.CourseId<>$intro GROUP BY a.Word ORDER BY SUM((COALESCE((SELECT r.Assessment FROM LearningReviews r WHERE r.AttemptId=a.AttemptId AND r.UserId=a.UserId ORDER BY r.OccurredAt DESC,r.ReviewId DESC LIMIT 1),a.Assessment))=2) DESC,MAX(a.AnsweredAt) DESC,a.Word LIMIT 200" (Source: sample.bin, Indicator: "select a.word,count(*),sum((coalesce((select r.assessment from learningreviews r where r.attemptid=a.attemptid and r.userid=a.userid order by r.occurredat desc,r.reviewid desc limit 1),a.assessment))=1),sum((coalesce((select r.assessment from learningreviews r where r.attemptid=a.attemptid and r.userid=a.userid order by r.occurredat desc,r.reviewid desc limit 1),a.assessment))=2),max(a.answeredat) from learningattempts a where a.userid=$user and a.answeredat is not null and a.status<>5 and a.courseid<>$intro group by a.word order by sum((coalesce((select r.assessment from learningreviews r where r.attemptid=a.attemptid and r.userid=a.userid order by r.occurredat desc,r.reviewid desc limit 1),a.assessment))=2) desc,max(a.answeredat) desc,a.word limit 200"), "SELECT NodeId,ParentId,Kind,Name,CourseId,Version,IsPublished,SourceFingerprint FROM LearningCatalogNodes WHERE ParentId IS $parent ORDER BY Kind,Name,NodeId" (Source: sample.bin, Indicator: "select nodeid,parentid,kind,name,courseid,version,ispublished,sourcefingerprint from learningcatalognodes where parentid is $parent order by kind,name,nodeid"), "INSERT INTO Users(UserId,CreatedAt,UpdatedAt) VALUES($user,$now,$now) ON CONFLICT(UserId) DO NOTHING" (Source: sample.bin, Indicator: "insert into users(userid,createdat,updatedat) values($user,$now,$now) on conflict(userid) do nothing"), "SELECT COUNT(*) FROM LearningCatalogNodes" (Source: sample.bin, Indicator: "select count(*) from learningcatalognodes"), "SELECT PreferenceId, UserId, PreferenceKey, PreferenceValue, UpdatedAt FROM UserPreferences WHERE UserId=$user ORDER BY PreferenceKey" (Source: sample.bin, Indicator: "select preferenceid, userid, preferencekey, preferencevalue, updatedat from userpreferences where userid=$user order by preferencekey"), "SELECT Payload FROM AutonomousLearningSessions WHERE StudySessionId=$id" (Source: sample.bin, Indicator: "select payload from autonomouslearningsessions where studysessionid=$id"), "SELECT Payload FROM EnglishPracticeCheckpoints WHERE UserId=$user ORDER BY UpdatedAt DESC,RunId DESC LIMIT $limit" (Source: sample.bin, Indicator: "select payload from englishpracticecheckpoints where userid=$user order by updatedat desc,runid desc limit $limit"), "UPDATE LongTermMemories SET LastRecalledAt=$now WHERE MemoryId=$id AND UserId=$user" (Source: sample.bin, Indicator: "update longtermmemories set lastrecalledat=$now where memoryid=$id and userid=$user")29:T44a,Found reference to API "};