23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f6772412e720… — Score 82/100 — Hybrid Analysis","description":"Malicious verdict for sample f6772412e720…. Malware family: Trojan.Generic. Threat score 82/100. 23/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c"],"about":{"@type":"SoftwareApplication","name":"Dostawa_Visual FoxPro_118.pdf.exe","applicationCategory":["peexe","executable"],"identifier":"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c","additionalType":"Malicious sample"},"threatScore":82,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T5b7,".exe" wrote 32 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 52 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 4 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 102400 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 1024 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 27136 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 6656 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 1536 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 2048 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536) ".exe" wrote 512 bytes to a foreign process "f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe" (PID: 00003536)25:T84c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAXNSURBVFhHxVdZTJRXFPalLhEcFVxQWRU3FFBcI4riVnhw3wXiCgYJUB6MJk1QEo1GjW2NUSxGoUBsHwhRpEwQy8AwVFpBh+pYiNQ2Jm1KTLoYiz749X4n3uk//DPwoukkX+69Z/nO+c899/7/DBjg+welIv6Xnw7+PsY+HwjDhw9HeXk5nE4nOjs73wnIRU5y91VVuFwuvHnzxo3Xr1/jXcDIyRjekoDFYnEHvnHjBvbu3Yu1a9f6xLp160TXezT6aB25yKkTYazeSUiJaFBVVYXc3FwcPHiwXzx+/Bjd3d0edpmZmV79cnJyhJsxGMuUQFtbmygPHDiA/fv3Iz09XcbeMMrr6+tx8eJFn7baV/tkZGRIDMZ6m4D7lEmzvXr1CmvWrMGOHTu8Ii0tDbt378bOnTuxbds25OXl4dChQ2JL2Z49e0Ab7b99+3YPHm4PYzCWzwSSkpKwadMmbNiwAevXr5enO3z4MDZv3oytW7di48aNgoKCAuzbtw+nT58WO8roQxuOWVlZHvbUk7unp6fvBJYsWYLVq1cLTp48iVOnTsHhcIDl03KOq1atkjVHPdfr8+fPS0WWL18Ou93utiN3vwksXLgQy5YtE/CpuV9WqxUsJ2VLFRKWLnXbiOztmiODpKSkSEXYeDU1NW5bcvebQExMDObNmycoKirCkSNHsGvXLqmElmdGx7nnWmYcq6urUVhYiObmZvHVOnL3m0BUVBRmz54tmDVrFrZs2SJ7PXPmTLf8bHgUomJjPOxoq0EObsH8+fMFmovyfhOIjIzE9OnT+8SHQcH4LMRsN23aNBDe/Cknt88EOtTR6FFHJCIiApMnTxZjjt4QHhqKO5YxPvVGH/JoLnL7TMD1Yyde/tMDf39/BAQEIDAwEGwaOoWHh3sgNCwMGX4WhKhEeuuMa94RR48exaVLl6Qpyc0YjGW6B35wdeDvlz2wDBsmDcQb0WazSROOGjUKQUFBCA4ORkhICEJV4MUBgUgMDUOYSoagjLoJEyaI7dixYyUo19x7Xk5+fn4S46GKZUrgfvsjPP/jBUaOHCkBCe4bq+ENFvVqvVtaiuKSEowYMcJkQ54TJ07g1q1bqKiowLlz5+R1/PzPF2hzPjQn8P39dvz+/C8pPYPHx8cLqU7GONKGt2VZWRm6urrkjtB+Rjs+vU6OVaENYzCWqQJNd1vx7NduKd24ceP6BIMcP34ctbW1ctbPnDkjiXrzGz9+vFtObsZwqFimBBoc3+HnZ7+BDtzrCNV4c+bMEfAO4P5q8Gmys7OltE+ePJEXEmVGmxkzZmDu3LniTy7qyP1UxWhwtJgTuP2NHR1dv0hXs6k+GDgQkX7+GDRoEAaqOUeS6SM1adIk9w3HuT66tDH6kIP+5CQ3YzCWqQLWOhtcnU/l5hoyZAiGDh2K9MAxMmpQFx0dLc1JTJ06VaDX1NGG9ux4zcE5Oalzdf4E622bOYGbX9fC+agDfBru5+jRo5ETMRG5qakyp4wNlZCQgNjYWPBe52icU6dPEX1yU9OQM/E/PnI/eNiBm9W15gQqb9agtd0l+8/uJcquX0dTU5PsL9dsMj5FXFycV/Clo205NjY2oqKy0s1H7lanC5VVNeYESsq+Qktru/poSHaXdOXKlTh27BimTJkipeb+r1ixQm5IjQULFkCD9uwFbgl98vPz5VtAb1VScrLEKC770pzAx/kFsDW14PMrV+WtxhKz+/li4ZzgnF8/ixYt8grqjPZMhBz0JedlxV1vvwvGMjXh4MGDcaehGbfrm3C1+AukpqTKx4UGLyZ+ByYmJsqXjglKTh1tFi+OR4LBlx8o10pKUWdzSAzG8vrf4Mq1UpWAHda6Rti/vYeWew8UnKpsCnrOtYbItV7PlQ/lBh25rHUNqFXHr0jF8PXvSBQ8s1nZeTj76QUUXinxwGW1JoxyvfYciz1szn5yQXF+JNy9S9/7j+L7+DPqjbPff9zvMxGP4P8CxQQqscxssPsAAAAASUVORK5CYII=1a:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$22"}}],["$","$L23",null,{"initialData":{"schema_version":"1.0.15","sha256":"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":82,"unified_at_epoch_ms":1790534090521,"unified_at":"2026-09-27T18:34:50.521Z","metadata":{"hashes":{"sha256":"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c","sha1":"9db1dd29f33b3e1b7a4937aa4e3c5c76c197d4bf","md5":"9c1fddcb61ede177771cac678cb8b6e1","sha512":"56e8acac369afa4c6f9fa4c3350be2302871e275b17cac34263522f118460fe2096bca3c01e86a7e384933c06cb0f9ac52c7e6fb01fd3d547017d903ed1d4f16","ssdeep":"6144:5ot5pE1dB3k0DYBxqm5tAeoDNhQAgj/CzGcyRbB6hF8/vsCFQYo:UpGzxDYuxyAgj6zCbW+/vsV","ssdeep_chunks":["6144:5ot5pE1","6144:ot5pE1d","6144:t5pE1dB","6144:5pE1dB3","6144:pE1dB3k","6144:E1dB3k0","6144:1dB3k0D","6144:dB3k0DY","6144:B3k0DYB","6144:3k0DYBx","6144:k0DYBxq","6144:0DYBxqm","6144:DYBxqm5","6144:YBxqm5t","6144:Bxqm5tA","6144:xqm5tAe","6144:qm5tAeo","6144:m5tAeoD","6144:5tAeoDN","6144:tAeoDNh","6144:AeoDNhQ","6144:eoDNhQA","6144:oDNhQAg","6144:DNhQAgj","6144:NhQAgj/","6144:hQAgj/C","6144:QAgj/Cz","6144:Agj/CzG","6144:gj/CzGc","6144:j/CzGcy","6144:/CzGcyR","6144:CzGcyRb","6144:zGcyRbB","6144:GcyRbB6","6144:cyRbB6h","6144:yRbB6hF","6144:RbB6hF8","6144:bB6hF8/","6144:B6hF8/v","6144:6hF8/vs","6144:hF8/vsC","6144:F8/vsCF","6144:8/vsCFQ","6144:/vsCFQY","6144:vsCFQYo","12288:5ot5pE1","12288:ot5pE1d","12288:t5pE1dB","12288:5pE1dB3","12288:pE1dB3k","12288:E1dB3k0","12288:1dB3k0D","12288:dB3k0DY","12288:B3k0DYB","12288:3k0DYBx","12288:k0DYBxq","12288:0DYBxqm","12288:DYBxqm5","12288:YBxqm5t","12288:Bxqm5tA","12288:xqm5tAe","12288:qm5tAeo","12288:m5tAeoD","12288:5tAeoDN","12288:tAeoDNh","12288:AeoDNhQ","12288:eoDNhQA","12288:oDNhQAg","12288:DNhQAgj","12288:NhQAgj/","12288:hQAgj/C","12288:QAgj/Cz","12288:Agj/CzG","12288:gj/CzGc","12288:j/CzGcy","12288:/CzGcyR","12288:CzGcyRb","12288:zGcyRbB","12288:GcyRbB6","12288:cyRbB6h","12288:yRbB6hF","12288:RbB6hF8","12288:bB6hF8/","12288:B6hF8/v","12288:6hF8/vs","12288:hF8/vsC","12288:F8/vsCF","12288:8/vsCFQ","12288:/vsCFQY","12288:vsCFQYo","6144:UpGzxDY","6144:pGzxDYu","6144:GzxDYux","6144:zxDYuxy","6144:xDYuxyA","6144:DYuxyAg","6144:YuxyAgj","6144:uxyAgj6","6144:xyAgj6z","6144:yAgj6zC","6144:Agj6zCb","6144:gj6zCbW","6144:j6zCbW+","6144:6zCbW+/","6144:zCbW+/v","6144:CbW+/vs","6144:bW+/vsV"],"imphash":"a8afd794c3ac7e9b7c3cead97cc32224"},"file_info":{"file_name":"Dostawa_Visual FoxPro_118.pdf.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":356352,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499297394000,"last_seen":1678315202000,"last_multi_scan":1678315202000}},"detections":{"summary":{"verdict":"malicious","score":82,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":4,"suspicious_count":10,"malicious_count":5,"total":19},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.tn42","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Ransomlock","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Inject","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Crypt.XPACK.285815","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2760374","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Dropper.Ursnif-7435808-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Trojan.NKYI-8580","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.2760374 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Spy.Ursnif.AO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004d2bec1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agentb.brtc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic.ys","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Inject.efgzlp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Mal/Zbot-UE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Inject.356352.S","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_IN.058C37CB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_IN.058C37CB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Generic.FXO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Hoax.Blocker","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Zbot.Win32.187906","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Sandboxie_SingleInstanceMutex_Control\"\n \"\\Sessions\\1\\BaseNamedObjects\\MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \".exe\" (UID: 00039100-00003036)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.crt\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\".exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.95632429358","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\".exe\" created file \"C:\\Windows\\system32\\en-US\\odbcint.dll.mui\"\n \".exe\" created file \"C:\\Windows\\system32\\en-US\\MFC42u.DLL.mui\"\n \".exe\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \".exe\" created file \"C:\\Windows\\explorer.exe\\\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Installation/Persistance","name":"The input sample dropped/contains a certificate file","description":"The input sample dropped/contains a certificate file","origin":"Binary File","relevance":10,"id":"binary-12","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"Amailto:thecct@netease.com\"\n \"http://thecct.go.163.com\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"Claimed CRC 148479 does not match actual CRC 359606","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n GetStartupInfoW\n GetModuleFileNameW\n GetModuleHandleW\n GetTickCount\n CreateFileW\n GetUpdateRect","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\", Key: \"EN-US\")\n \".exe\" (Path: \"\\REGISTRY\\MACHINE\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\", Key: \"EN-US\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/56 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":10,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\".exe\" allocated memory in \"C:\\f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe\"","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.61.75.27:80\"\n \"23.61.69.163:80\"\n \"23.3.96.234:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 23.61.75.27 on port 80 is sent without HTTP header\n TCP traffic to 23.61.69.163 on port 80 is sent without HTTP header\n TCP traffic to 23.3.96.234 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":10,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"\"VMWare VMM\" (Indicator: \"vmware\")\n \"vmmemctl\" (Indicator: \"vmmemctl\")\n \"VBoxGuest\" (Indicator: \"vbox\")\n \"VBoxGuest\" (Indicator: \"vboxguest\")\n \"VMware\" (Indicator: \"vmware\")\n \"VMware, Inc.\" (Indicator: \"vmware\")","origin":"File/Memory","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"Wrote 85 instructions to foreign process \"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe\" (UID: 00546406-00003536)\n Wrote 176 instructions to foreign process \"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe\" (UID: 00546406-00003536)\n Wrote 133 instructions to foreign process \"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe\" (UID: 00546406-00003536)\n Wrote 136 instructions to foreign process \"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe\" (UID: 00546406-00003536)\n Wrote 112 instructions to foreign process \"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe\" (UID: 00546406-00003536)","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$24","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"41/57 Antivirus vendors marked sample as malicious (71% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files","Sample Crashed","Network Traffic","Simulated analysis"],"sandbox_reports":[{"id":"561250cf0e316d137db5a210","environment_id":5,"environment_description":"W7 32 bit 'Stealthy Mode' with 'DNS Spoof'","state":"SUCCESS","verdict":"malicious","threat_score":82,"malware_family":"Trojan.GenericKD","submit_name":"Dostawa_Visual FoxPro_118.pdf.exe","analysis_start_time":"2015-10-05T05:29:54+00:00","indicators_count":{"informative":3,"suspicious":9,"malicious":3},"tags":["Extracted Files","Simulated analysis"],"is_in_unified_schema":true},{"id":"560aa6fb0e316df47ab924a9","environment_id":4,"environment_description":"W7 32 bit 'Stealthy Mode'","state":"SUCCESS","verdict":"suspicious","threat_score":39,"malware_family":"QVM20.1.Malware","submit_name":"VTDLF6772412E72084A5597108A550C842B8F0416D22EB2595AF2974700E203B280C.danger","analysis_start_time":"2015-09-29T10:10:48+00:00","indicators_count":{"informative":3,"suspicious":9,"malicious":2},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"560a52ab0e316d680d0d0ff0","environment_id":2,"environment_description":"Windows 7 64 bit (DE)","state":"SUCCESS","verdict":"suspicious","threat_score":26,"malware_family":"QVM20.1.Malware","contacted_countries":["USA"],"submit_name":"Dostawa_Visual FoxPro_118.pdf.exe","analysis_start_time":"2015-09-29T03:59:27+00:00","indicators_count":{"informative":2,"suspicious":6,"malicious":1},"tags":["Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"560a52ab0e316d680d0d0fee","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":40,"malware_family":"QVM20.1.Malware","submit_name":"Dostawa_Visual FoxPro_118.pdf.exe","analysis_start_time":"2015-09-29T03:59:18+00:00","indicators_count":{"informative":3,"suspicious":8,"malicious":3},"tags":["Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.61.75.27","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"}]},{"address":"23.61.69.163","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"}]},{"address":"23.3.96.234","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"}],"processes":[{"pid":2848,"ppid":0,"name":"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe","command_line":"","normalized_path":"","uid":"00038664-00002848","icon":"$25"},{"pid":3036,"ppid":0,"name":"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe","command_line":"","normalized_path":"","uid":"00039100-00003036"}],"all_imported_dlls":["mfc42u.dll","msvcrt.dll","user32.dll","gdi32.dll","lpk.dll","rpcrt4.dll","cfgmgr32.dll","GdiPlus.dll","oleaut32.dll","advapi32.dll","odbcint.dll","shell32.dll","setupapi.dll","ntdll.dll","kernel32.dll","ole32.dll","sechost.dll","msctf.dll","shlwapi.dll","KernelBase.dll","usp10.dll","odbc32.dll","imm32.dll","apphelp.dll","devobj.dll","SspiCli.dll","MSCTF.dll","RPCRT4.dll","KERNELBASE.dll","OLEAUT32.dll","IMM32.DLL","USP10.dll","gdiplus.dll","SETUPAPI.dll","USER32.dll","VERSION.dll","MFC42u.DLL","PSAPI.DLL","DEVOBJ.dll","SHELL32.dll","ODBC32.dll","GDI32.dll","LPK.dll","CFGMGR32.dll","ADVAPI32.dll","SHLWAPI.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.crt","sha256":"afcaf58fed4c18c9887c35e4ce5da2976a770875e0e7f6a23b69fb68c32d1e3d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0ff0"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]}],"files_written":[{"path":"%WINDIR%\\system32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"%WINDIR%\\system32\\en-US\\MFC42u.DLL.mui","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"C:\\myapp.exe","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"%WINDIR%\\explorer.exe\\","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"C:\\f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.ex_","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"%LOCALAPPDATA%\\CSIDL_","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"C:\\f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c.exe","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"%LOCALAPPDATA%\\CSIDL_X","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"c:\\493294329.txt","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Sandboxie_SingleInstanceMutex_Control","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex","sources":[{"report_type":"sandbox","report_id":"560aa6fb0e316df47ab924a9"},{"report_type":"sandbox","report_id":"561250cf0e316d137db5a210"}]},{"name":"Sandboxie_SingleInstanceMutex_Control","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"}]},{"name":"MicrosoftVirtualPC7UserServiceMakeSureWe'reTheOnlyOneMutex","sources":[{"report_type":"sandbox","report_id":"560a52ab0e316d680d0d0fee"}]}]}},"report_ids":{"sandbox_job_ids":["561250cf0e316d137db5a210","560a52ab0e316d680d0d0fee","560aa6fb0e316df47ab924a9","560a52ab0e316d680d0d0ff0"]}}}]]}] 1d:null 21:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f6772412e720… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f6772412e720…. Malware family: Trojan.Generic. Threat score 82/100. 23/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f6772412e720… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f6772412e720…. Malware family: Trojan.Generic. Threat score 82/100. 23/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f6772412e72084a5597108a550c842b8f0416d22eb2595af2974700e203b280c"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f6772412e720… — Score 82/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f6772412e720…. Malware family: Trojan.Generic. Threat score 82/100. 23/28 AV engines flagged this file. 5 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L26","11",{}]]