26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Exploit.MSOfficeWord.GenericS Sample f7481d98d947… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f7481d98d947…. Malware family: Trojan.Exploit.MSOfficeWord.GenericS. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151","keywords":["Malicious","Trojan.Exploit.MSOfficeWord.GenericS","malware analysis","sandbox report","threat intelligence","f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151"],"about":{"@type":"SoftwareApplication","name":"Scan_318566.pdf","applicationCategory":["pdf"],"identifier":"f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Exploit.MSOfficeWord.GenericS","antivirusDetections":{"malicious":13,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4f6,"AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AC76BA86-7AD7-1031-7B44-AB0000000001}") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\{AC76BA86-7AD7-1031-7B44-AB0000000001}"; Key: "VERSION"; Value: "0000000004000000040000000900000B") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE"; Key: "PATH"; Value: "00000000010000005800000043003A005C00500072006F006700720061006D002000460069006C00650073005C004D006900630072006F0073006F006600740020004F00660066006900630065005C004F0066006600690063006500310034005C000000") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REDCHIP2.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\REDCHIP2.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\WINWORD.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL")28:T8cc,"AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\PROTECTEDROOTS"; Key: "CERTIFICATES") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\18F7C1FCC3090203FD5BAA2F861A754976C8DD25"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\245C97DF7514E7CF2DF8BE72AE957B9E04741E85"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\3B1EFD3A66EA28B16697394703A72CA340A05BD5"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\7F88CD7223F3C813818C994614A89C99FA3B5247"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\8F43288AD272F3103B6FB1428485EA3014C0BCFE"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\A43489159A520F0D93D032CCAF37E7FE20A8B419"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\BE36A4562FB2EE05DBB3D32323ADF445084ED656"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES\CDD4EEAE6000AC7F40C3802C171E30148030C072"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\02FAF3E291435468607857694DF5E45B68851868"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\039EEDB80BE7A03C6953893B20D2D9323A4C2AFD"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\07E032E020B72C3F192F0628A2593A19A70F069E"; Key: "BLOB")29:T437,"\Sessions\1\BaseNamedObjects\IESQMMUTEX_0_208" "RasPbFile" "Local\c:!users!rrglkgc!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "IESQMMUTEX_0_208" "Local\_!MSFTHISTORY!_" "Local\Acrobat Instance Mutex" "DBWinMutex" "Local\c:!users!rrglkgc!appdata!roaming!microsoft!windows!cookies!" "Local\WininetConnectionMutex" "Local\WininetStartupMutex" "Local\WininetProxyRegistryMutex" "Local\c:!users!rrglkgc!appdata!local!microsoft!windows!history!history.ie5!" "{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCPEFGAFKAAAAA" "\Sessions\1\BaseNamedObjects\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCPEFGAFKAAAAA" "\Sessions\1\BaseNamedObjects\RasPbFile" "\Sessions\1\BaseNamedObjects\Local\Acrobat Instance Mutex" "\Sessions\1\BaseNamedObjects\DBWinMutex" "\Sessions\1\BaseNamedObjects\Local\_!MSFTHISTORY!_" "\Sessions\1\BaseNamedObjects\Local\c:!users!rrglkgc!appdata!local!microsoft!windows!temporary internet files!content.ie5!" "\Sessions\1\BaseNamedObjects\Local\c:!users!rrglkgc!appdata!roaming!microsoft!windows!cookies!"2a:T4e0,"WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.CreateObject" ... "WINWORD.EXE" called "ADODB.Stream.6.0.CreateObject" ... "WINWORD.EXE" called "Shell.Application.1.CreateObject" ... "WINWORD.EXE" called "WScript.Shell.1.Environment" with result: "IDispatch" ... "WINWORD.EXE" called "WScript.Shell.1("Environment").Item" with result: "%TEMP%\ ..., "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.open" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.setRequestHeader" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.send" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.status" with result: "200" ..., "WINWORD.EXE" called "ADODB.Stream.6.0.Type" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.Open" ... , "WINWORD.EXE" called "Microsoft.XMLHTTP.1.0.responseBody" with result: "Error

DotNetPanel IIS Modules Error

AuthName directive not found.

File: E:\HostingSpaces\webengr\super-marv.com\wwwroot\.htaccess

" ..., "WINWORD.EXE" called "ADODB.Stream.6.0.Write" ... , "WINWORD.EXE" called "ADODB.Stream.6.0.SaveToFile" ... , "WINWORD.EXE" called "Shell.Application.1.Open" ...2b:T59f,"scs268C.tmp" has type "DOS batch file ASCII text with CRLF line terminators" "assets-170410205927Z-119920" has type "PNG image data 48 x 48 8-bit/color RGBA non-interlaced" "A9R31AE.tmp" has type "data" "ScanData155328.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Read-Only ctime=Mon Apr 10 20:59:00 2017 mtime=Mon Apr 10 20:59:00 2017 atime=Mon Apr 10 20:59:00 2017 length=80242 window=hide" "index.dat" has type "data" "A9B8213768ADC68AF64FCC6409E8BE414726687F.crl" has type "data" "ferbys2" has type "HTML document ASCII text with no line terminators" "redchip2.exe" has type "data" "A9R31AB.tmp" has type "data" "A9R31B0.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)" "scs2677.tmp" has type "ASCII text with CRLF line terminators" "A9R31B2.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)" "ScanData155328.docm" has type "Microsoft Word 2007+" "~WRS{C5969FC3-EBC9-45BA-9074-706962769004}.tmp" has type "data" "A9R31B1.tmp" has type "Zip data (MIME type "application/vnd.adobe.air-ucf-package+zip"?)" "874hv[1]" has type "HTML document ASCII text with no line terminators" "MSForms.exd" has type "data" "48B76449F3D5FEFA1133AA805E420F0FCA643651.crl" has type "data" "A9R31AD.tmp" has type "data" "assets-170410205927Z-119911" has type "PNG image data 46 x 46 8-bit/color RGB non-interlaced"2c:T618,"WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C5969FC3-EBC9-45BA-9074-706962769004}.tmp" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui"2d:T846,"WINWORD.EXE" wrote bytes "baa0553600b98b7b2f67ffe1" to virtual address "0x0408FADA" "WINWORD.EXE" wrote bytes "e99e480eec" to virtual address "0x756C3D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "bab0d1a706b98b7b2f67ffe1" to virtual address "0x04090842" "WINWORD.EXE" wrote bytes "bad4b63400b98b7b2f67ffe1" to virtual address "0x04090806" "WINWORD.EXE" wrote bytes "ba702c0f04b98b7b2f67ffe1" to virtual address "0x0408F462" "WINWORD.EXE" wrote bytes "e92399f4eb" to virtual address "0x758C5DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "b811110000663d33c0ba04a0320068dcf52f67c3" to virtual address "0x00300024" "WINWORD.EXE" wrote bytes "4053257758582677186a2677653c27770000000000bf6b750000000056cc6b75000000007cca6b750000000037683f756a2c2777d62d27770000000020693f750000000029a66b7500000000a48d3f7500000000f70e6b7500000000" to virtual address "0x77411000" (part of module "NSI.DLL") "WINWORD.EXE" wrote bytes "e96033f2eb" to virtual address "0x758C4731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "96bbc1f4" to virtual address "0x2F8E1B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "8a32b7c9" to virtual address "0x63F0F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "b811110000663d33c0ba9053360068dcf52f67c3" to virtual address "0x003024AC" "WINWORD.EXE" wrote bytes "b800000000663d33c0baa49c2b0068dcf52f67c3" to virtual address "0x003024EC" "WINWORD.EXE" wrote bytes "e99a54f1eb" to virtual address "0x758C3E59" ("SysFreeString@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "2a5947c9" to virtual address "0x68BB9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "bae429a606b98b7b2f67ffe1" to virtual address "0x040907F2" "WINWORD.EXE" wrote bytes "e93655f2eb" to virtual address "0x758C3EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "bad487a706b98b7b2f67ffe1" to virtual address "0x040907CA" "WINWORD.EXE" wrote bytes "f3c033c9" to virtual address "0x61A00BA8" (part of module "MSO.DLL") "WINWORD.EXE" wrote bytes "badc540f04b98b7b2f67ffe1" to virtual address "0x04091B32"2e:T50b,"WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000401") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000040D") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000041E") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "0000042A") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000439") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000420") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000429") "WINWORD.EXE" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "NUMSHAPE") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000402") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000403") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000404") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000405") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000406") "WINWORD.EXE" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000407")2f:T580,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD50lEQVR42u2VX2hTVxzH7x5cCzMVBpv/Ft2YqJ1FfJgMR2Ev/nkdjO1hK2OD7WGMwlaFakVRoSBUTdgWS60b6/ZgF+ymsxtrWpTF1eSmrcVq09iypK35K02Ttun/P1/P78iJ597m1l7Fl7EffLg5ufeez/f8zs2Novxfy6xYLIZoNIpIJMIJh8NZaEznCLouHo/zz/39/XjsxJde3Y5nwcDAAPx+Pz+WlpYaB6nfWITf39qtofWL/Rx53PLuR4uuM4LmDIVC8Hg8oKJOGIaos76BCxuKNIhK+QNoKNqVHQcvXtacp9LfS9CcwWAwG4CKOpEzwLlXtuLnDds0UNFx0HUVt2xn+dj1wSfIhCO4UVaRPW8EzSl3QFRvb+/iEN+s24wfWGIZKueuPUiyDqjHT/Ixfd9pc3Dk0t9L0JwUwOv1Ql/0XGgCVK3dhBqWWEbU7e9/yo7pGPX4cO3rQ3x85f2POfp7CZqT9r2jowNOpxN2ux0OhwMulwsjIyPo6el5FKJyzetwrN+igUo/prp1vi7neT00J+05tbyxsRG1tbU8RGVlJWw2G/+pZgMcWf0a7KxlS3HxvRJUb33zsdcJaE4KkEgk+FYEAgF0dXVBVVW43W7tNpS/tBHPgsHBQQwPDyOVSnHS6TSSySR/adGLKhsgPz8fFotlSfLy8uDz+Ti0CvFZ0NbWBvdzK3B9cyE8ZQfQ3d3N34SynPZ+dHSUMzY2BtOvYmqpEbTaTmUFAl/tR9/ph3s8NDTExbnkmUzGfABqnxHU6juWF9GzbQdiV/7QiHPJx8fHzQcgiRHU5ttvvwOVdSFx/Z+cYln+RAHEfuoRq71bXgG38ryhWMgnJiY4pgMIkR6xWn/5YbiUPPxbfS6nWMgnJyc5pgMIkYxYKfGX5WU0WzehiZFmPzW9WJZPTU2ZDyDL9C3uPHgEv1lWI3rDi1/ZsfXDTw3FxPT0tPkAQqZvb4qt9hfLGrQfOsalEY+KC2x8qWgn+pwNHPXwCdyssiPma+fymZkZ8wGEUG4toTJxvXULIl4fvBXHcbl4D2qUFzjVjLPKSvxoLURTyWfsn7IQoeZrmJ2dNR9AlorWhpnUwQREQ/FetFacQLCpBaPxBG91qPkq/iz5HDXsL7pKscBesB6R9puYm5szH0Dez3QsjpYvy3CGTVpfvC+7t2J/BdRqglZMZIaSXD4/P28+gHiI7qnt+I618jRbDXH/bl9OqSwmqRATCwsL5gMIwRnWzqNKAaettk4jlKVGYoLKdAAhOFZgRbmyCn+f+naRUJYaiUWZDqAXLSWUpXrxEweQRbmEy5E+VYClZMuVPlWA/2w9ABLzyQHF53sTAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790266778196,"unified_at":"2026-09-24T16:19:38.196Z","metadata":{"hashes":{"sha256":"f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151","sha1":"f3acf89c263a7ce1e74912eb829c8a1e6da894a0","md5":"8009ae9232ae700f52bfa06d241b8f27","sha512":"d2eeabb64b0f96041256c42e28b67fec6673fd89bc39a13b9ec54c90a766b2626ceee54dcbbf7925fe25f21bb3acc3e65c4ef777542c1c57c34d4866cddeda1a","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Scan_318566.pdf","file_type":["pdf"],"file_type_id":"pdf","file_size":75289,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499287267000,"last_seen":1658597280000,"last_multi_scan":1658597280000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["locky","ransomware"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":18,"suspicious_count":12,"malicious_count":5,"total":35},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"PDF/Dropper","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HTML/Malicious.PDF.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Exploit.MSOfficeWord.GenericKDS.32203978","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"pdf/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Exploit.MSOfficeWord.GenericKDS.32203978 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"PDF/TrojanDropper.Agent.I trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader.VBA.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.Script.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"PDF/Dropper.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Script.Agent.enoluj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/PDFDl-J","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Exploit.MSOfficeWord.GenericS","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$27","origin":"Registry Access","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"super-marv.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"194.9.25.17:80\"\n \"143.95.251.11:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Contains object with compressed stream data","description":"Object ID 8 contains compressed stream data: No filters","origin":"Static Parser","relevance":10,"id":"static-66","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"WINWORD.EXE\" created file \"%TEMP%\\A9R31B3.tmp\\ScanData155328.docm\"\n \"WINWORD.EXE\" created file \"%TEMP%\\~DFA08F1DE10878A6C7.TMP\"\n \"WINWORD.EXE\" created file \"%TEMP%\\VBE\\MSForms.exd\"\n \"WINWORD.EXE\" created file \"%TEMP%\\ferbys2\"\n \"WINWORD.EXE\" created file \"%TEMP%\\redchip2.exe\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$29","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 68B70000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$2a","origin":"API Call","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"PDF contains only a single page","description":"Tag \"pages\" has a value of \"1\"","origin":"Static Parser","relevance":5,"id":"static-58","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R11\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"\n \"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"\n \"WINWORD.EXE\" searching for class \"MSOBALLOON\"\n \"WINWORD.EXE\" searching for class \"MsoHelp10\"\n \"WINWORD.EXE\" searching for class \"AgentAnim\"\n \"WINWORD.EXE\" searching for class \"mspim_wnd32\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Sent a control code to a service","description":"\"AcroRd32.exe\" called \"ControlService\" and sent control code \"0X24\" to the service \"gpsvc\"\n \"AcroRd32.exe\" called \"ControlService\" and sent control code \"0XFC\" to the service \"gpsvc\"","origin":"API Call","relevance":10,"id":"api-75","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"WINWORD.EXE\" with commandline \"/n \"%TEMP%\\A9R31B3.tmp\\ScanData155328.docm\"\" (UID: 00026035-00000200)\n Spawned process \"ntvdm.exe\" with commandline \"-i1\" (UID: 00027140-00002968)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"$2b","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$2c","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"eneJ7ZqX.mU\"\n Pattern match: \"o.zRHV/.(A:7%pkqC}&x\\k[kMB]ucsg_^Eofrtue&,)Tl8/V\\+&M\"\n Heuristic match: \"super-marv.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains embedded objects that might be interesting to investigate","description":"Embedded object type \"/EmbeddedFile\" (ID: 11, References: 13 0 R,12 0 R)","origin":"Static Parser","relevance":5,"id":"static-10","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"WINWORD.EXE\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WINWORD.EXE\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"AcroRd32.exe\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)\n \"WINWORD.EXE\" called \"OpenSCManager\" requesting access rights \"SC_MANAGER_CONNECT\" (0x1)","origin":"API Call","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"AcroRd32.exe\" called \"OpenService\" to access the \"PcaSvc\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"AcroRd32.exe\" called \"OpenService\" to access the \"rasman\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"ServicesActive\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"AcroRd32.exe\" called \"OpenService\" to access the \"gpsvc\" service\n \"AcroRd32.exe\" called \"OpenService\" to access the \"RASMAN\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"RASMAN\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"rasman\" service\n \"WINWORD.EXE\" called \"OpenService\" to access the \"Sens\" service requesting \"SERVICE_QUERY_STATUS\" (0X4) access rights\n \"WINWORD.EXE\" called \"OpenService\" to access the \"PcaSvc\" service","origin":"API Call","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"WINWORD.EXE\" opened \"MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Network Related","name":"Contacts Random Domain Names","description":"\"super-marv.com\" seems to be random","origin":"Network Traffic","relevance":5,"id":"network-6","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"VariantChangeType@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysAllocStringByteLen@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"SysFreeString@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"VariantClear@OLEAUT32.DLL\" in \"WINWORD.EXE\"\n \"OleLoadFromStream@OLE32.DLL\" in \"WINWORD.EXE\"","origin":"Hook Detection","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WINWORD.EXE\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2e","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"malicious","category":"External Systems","name":"Detected Emerging Threats Alert","description":"Detected alert \"ET TROJAN Possible Locky JS Downloading Payload Dec 06 2016\" (SID: 2023583, Rev: 3, Severity: 1) categorized as \"A Network Trojan was detected\" (Backdoor, ransomware, trojans, etc.)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/56 Antivirus vendors marked sample as malicious (14% detection rate)\n 2/40 Antivirus vendors marked sample as malicious (5% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /874hv HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"\nAccept-Encoding: gzip, deflate\nHost: super-marv.com\nConnection: Keep-Alive\"","origin":"Network Traffic","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"194.9.25.17\" (ASN: 24724, Owner: ATM S.A.): ...\nFile SHA256: 79ad2f86e345314436c0a2125de307cf2490e7ed73f34ec942d41897af7042f7 (AV positives: 42/62 scanned on 04/09/2017 18:53:01)\n File SHA256: 52e1a00e10dbbb218d543476eaf5068afde6ec8ffc228b28f7069bf6c84d172e (AV positives: 42/61 scanned on 04/09/2017 18:42:27)\n File SHA256: 3882aeb18f23fcfacaed836a3bf7152b877b457029b9dbcce65e351e8d5a1d81 (AV positives: 41/62 scanned on 03/31/2017 14:23:53)\n File SHA256: df6782ef745026659389317e3aea152d1989c112a7821fd73622eedaf2a24930 (AV positives: 33/62 scanned on 03/24/2017 10:53:49)\n File SHA256: 14961222ee4651c89ff1c4fb669c1c189b40f855b46955670bb813fa76dcfe81 (AV positives: 42/62 scanned on 03/24/2017 09:38:30)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Document analysis contacts a domain","description":"Often seen on documents with macro droppers\n embedded files or exploits","origin":"Indicator Combinations","relevance":3,"id":"summary-1","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}],"incidents":[{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":48,"imported_dlls_count":152,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":145,"files_deleted_count":0,"registry_keys_created_count":7,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":11,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["locky","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"58eb8111aac2edb95081f64e","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Virus.office.obfuscated","contacted_countries":["POL","USA"],"submit_name":"Scan_318566.pdf","analysis_start_time":"2017-04-10T13:57:06+00:00","indicators_count":{"informative":18,"suspicious":13,"malicious":6},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"194.9.25.17","port":80,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"address":"143.95.251.11","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}],"dns_resolutions":[{"domain":"super-marv.com","address":"143.95.251.11","country":"United States","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}],"http_requests":[{"host":"super-marv.com","host_ip":"143.95.251.11:80","url":"/874hv","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /874hv HTTP/1.1\nAccept: */*\nAccept-Language: en-us\nUser-Agent: \"Mozilla/5.2 (Windows NT 6.2; rv:50.2) Gecko/20200103 Firefox/50.2\"\nAccept-Encoding: gzip, deflate\nHost: super-marv.com\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}],"processes":[{"pid":2640,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\Scan_318566.pdf\"","sha256":"e67a01f0d47be82ed631fe93f0b2f8c6276b4ce89b46b51d178e66f976b324bd","normalized_path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","uid":"00014755-00002640","icon":"$2f"},{"pid":200,"ppid":2640,"name":"WINWORD.EXE","command_line":"/n \"%TEMP%\\A9R31B3.tmp\\ScanData155328.docm\"","sha256":"8cfb55087fa8e4c1e7bcc580d767cf2c884c1b8c890ad240c1e7009810af6736","normalized_path":"%PROGRAMFILES%\\MICROS~3\\Office14\\WINWORD.EXE","parent_uid":"00014755-00002640","uid":"00026035-00000200"},{"pid":2968,"ppid":200,"name":"ntvdm.exe","command_line":"-i1","sha256":"7790fd858e5fe32d98a85d143cb656f8cce39395b2e5a0401242b1382d8733f6","normalized_path":"%WINDIR%\\System32\\ntvdm.exe","parent_uid":"00026035-00000200","uid":"00027140-00002968"}],"all_imported_dlls":["shdocvw.dll","mxdwdrv.dll","devobj.dll","wininet.dll","GFX.DLL","netapi32.dll","rpcrt4.dll","uxtheme.dll","msvcr90.dll","winmm.dll","vfprint.dll","WinSCard.dll","msctf.dll","CoolType.dll","RpcRtRemote.dll","SensApi.dll","wsock32.dll","ccme_ecc.dll","MSORES.DLL","OSPPC.DLL","rsaenh.dll","clbcatq.dll","nlaapi.dll","powrprof.dll","slc.dll","cfgmgr32.dll","mswsock.dll","rasapi32.dll","rtutils.dll","msxml6r.dll","cscapi.dll","VBE7INTL.DLL","sechost.dll","ccme_asym.dll","AdobeXMP.dll","msiltcfg.dll","msproof7.dll","wship6.dll","lpk.dll","nsi.dll","FWPUCLNT.DLL","psapi.dll","cryptbase.dll","oleacc.dll","msi.dll","tzres.dll","winnsi.dll","winrnr.dll","sfc_os.dll","OART.DLL","WindowsCodecs.dll","AXE8SharedExpat.dll","ieframe.dll","RICHED20.DLL","ntshrui.dll","BIBUtils.dll","comdlg32.dll","ntvdmd.dll","mscms.dll","unidrvui.dll","MSGR3EN.DLL","msvcrt.dll","ntmarta.dll","mscoree.dll","wkscli.dll","comctl32.dll","propsys.dll","apphelp.dll","USP10.DLL","KernelBase.dll","oleaut32.dll","ccme_base.dll","sxs.dll","mscoreei.dll","msxml6.dll","VBE7.DLL","gdi32.dll","msasn1.dll","sfc.dll","linkinfo.dll","Wldap32.dll","urlmon.dll","dnsapi.dll","rasman.dll","ccme_ecdrbg.dll","scrrun.dll","netutils.dll","ACE.dll","GdiPlus.dll","sspicli.dll","MSO.DLL","fontsub.dll","rpcss.dll","rasadhlp.dll","msxml3r.dll","version.dll","WSHTCPIP.DLL","NapiNSP.dll","msxml3.dll","normaliz.dll","webio.dll","AGM.dll","WSDApi.dll","wtsapi32.dll","MSPTLS.DLL","msado15.dll","sqlite.dll","SendToOneNoteUI.dll","user32.dll","msftedit.dll","oleaccrc.dll","mpr.dll","mlang.dll","OSPPCEXT.DLL","winhttp.dll","ole32.dll","dwmapi.dll","userenv.dll","MSOINTL.DLL","FM20.DLL","FM20ENU.DLL","advapi32.dll","shlwapi.dll","iertutil.dll","ccme_base_non_fips.dll","crypt32.dll","IPHLPAPI.DLL","srvcli.dll","msdart.dll","ntdll.dll","usp10.dll","msvcp100.dll","pnrpnsp.dll","devrtl.dll","msimg32.dll","kernel32.dll","imm32.dll","AcroRd32.dll","BIB.dll","profapi.dll","AXSLE.dll","gpapi.dll","vdmredir.dll","cryptsp.dll","cryptocme.dll","WWINTL.DLL","prntvpt.dll","shell32.dll","msvcr100.dll","setupapi.dll","ws2_32.dll","WWLIB.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ScanData155328.docm","sha256":"b0c9d7430608595b6927553cb7d4d342d5f1f823db7a8885636707dc0ba1de7c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"ScanData155328.LNK","sha256":"c083e886dbc67ca2f2797fe23770502b03c5878f0d6de752105e08221215d1f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"index.dat","sha256":"5052a8cbaca3857162380e3068aa8767dfe4e81816d92b09a740b300c8e99356","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"~$Normal.dotm","sha256":"23b2bede014c4dde583a5b3775c1857909a1356914c7cf22418b00160d3ba860","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"874hv[1]","sha256":"04b93a946b2c69970d2cc370bbd60fd28cf7df3c3b0b81c8dea3579d85469659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"~WRS{5A342E8C-8345-4A31-AA77-540DAC9F958C}.tmp","sha256":"64de688544571cd4bc8adc391f67e0819eab76906fe985537feedfbe776de5d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"~WRS{C5969FC3-EBC9-45BA-9074-706962769004}.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9R31AB.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9R31AC.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9R31AD.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9R31AE.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9R31B0.tmp","sha256":"bf72788ed14afbfda4b92f5166620544d637fc0abb5d45b3738a437424acf0c9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"MSForms.exd","sha256":"bf8b5429980baecf65da60fde37b6c53f90073036067940c1ab839c4754d12d1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"ferbys2","sha256":"04b93a946b2c69970d2cc370bbd60fd28cf7df3c3b0b81c8dea3579d85469659","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"redchip2.exe","sha256":"d06823623674a3a4567f04a90e877b58e5131b8ebb35e18a74290837da8c159e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"scs2677.tmp","sha256":"ee06792197c3e025b84860a72460eaf628c66637685f8c52c5a08a9cc35d376c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"scs268C.tmp","sha256":"06d61c23e6ca59b9ddad1796eccc42c032cd8f6f424af6cfee5d085d36ff7dfd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"assets-170410205927Z-119920","sha256":"5ae4a147bf8d36fc0c8fc945616475810f1b87e5b8c101d6761a5fe54608f270","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sha256":"2fe5938687f3363c8f00564c1fcd26c64640bee1dd2549184fc55a83728806a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"A9R31B2.tmp","sha256":"3184ca2a7ef723d242309f3770e6f60ac57e436ee3eb2b434112d0df848e5c60","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}],"files_written":[{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\Scan_318566.pdf","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\EScript.DEU","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_EScript.DEU","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\JavaScripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\Annots.DEU","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_Annots.DEU","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdr.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdri.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdrk.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXEchoSign.spi","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXShare.spi","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\files.acx","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\files.asfx","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXEchoSign.asfx","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeComFnt11.lst","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeCMapFnt11.lst","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeSysFnt11.lst","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\AcroFnt11.lst","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\A9R31B0.tmp","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\office14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE.config","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\USER32.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\SETUPAPI.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Templates","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\Normal.dotm","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{C5969FC3-EBC9-45BA-9074-706962769004}.tmp","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\MSCTF.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{25594F64-F035-4A32-9F4B-4CD5058B283B}.tmp","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{5A342E8C-8345-4A31-AA77-540DAC9F958C}.tmp","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Office\\review.rcd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Office\\adhoc.rcd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.MSO\\A94700F9.png","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\Users\\RRGLkgc","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Office","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\OLEACCRC.DLL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"PIPE\\srvsvc","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ScanData155328","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\A9R31B3.tmp\\ScanData155328.docm","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\ScanData155328.LNK","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\MSWORD.OLB","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\stdole2.tlb","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OFFICE14\\MSO.DLL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\~DFA08F1DE10878A6C7.TMP","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL\\3","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%PROGRAMFILES%\\COMMON~1\\MICROS~1\\VBA\\VBA7\\VBE7.DLL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\VBE","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\VBE\\MSForms.exd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\VBA\\VBA6\\VBE6EXT.OLB","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\FM20.DLL\\2","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\FM20.DLL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\System32\\msxml3.dll\\1","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\System32\\msxml3.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\urlmon.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IETldCache\\index.dat","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\7N5LGTOO\\874hv[1]","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%COMMONPROGRAMFILES%\\System\\ado\\msado15.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\ferbys2","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\redchip2.exe","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\shell32.dll","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\SHELL32.DLL.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\ntvdm.exe","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\AppPatch\\pcamain.sdb","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\en-US\\KERNELBASE.dll.mui","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\_default.pif","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\MSDOS.SYS","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"C:\\IO.SYS","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\ntio.sys","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\ntdos.sys","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\CONFIG.NT","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\SCS2677.TMP","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\HIMEM.SYS","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\COUNTRY.SYS","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\COMMAND.COM","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\AUTOEXEC.NT","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\MSCDEXNT.EXE","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\REDIR.EXE","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.BUD","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\sendtoonenote.gpd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\SYSTEM32\\DOSX.EXE","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\StdNames.gpd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\SCS268C.TMP","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%TEMP%\\REDCHIP2.EXE","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteNames.gpd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNoteFilter.gpd","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"path":"%WINDIR%\\system32\\spool\\DRIVERS\\W32X86\\3\\SendToOneNote.ini","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKCU\\SOFTWARE\\ADOBE\\ACROBAT READER\\11.0\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\c:!users!rrglkgc!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\c:!users!rrglkgc!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\c:!users!rrglkgc!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCPEFGAFKAAAAA","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCPEFGAFKAAAAA","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\_!MSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!rrglkgc!appdata!local!microsoft!windows!temporary internet files!content.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!rrglkgc!appdata!roaming!microsoft!windows!cookies!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!rrglkgc!appdata!local!microsoft!windows!history!history.ie5!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-58021","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-58021","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\c:!users!rrglkgc!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-58021","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\!IETld!Mutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\c:!users!rrglkgc!appdata!roaming!microsoft!windows!ietldcache!","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-58021","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IESQMMUTEX_0_191","sources":[{"report_type":"sandbox","report_id":"58eb8111aac2edb95081f64e"}]}]}},"report_ids":{"sandbox_job_ids":["58eb8111aac2edb95081f64e"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Exploit.MSOfficeWord.GenericS Sample f7481d98d947… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f7481d98d947…. Malware family: Trojan.Exploit.MSOfficeWord.GenericS. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Exploit.MSOfficeWord.GenericS Sample f7481d98d947… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f7481d98d947…. Malware family: Trojan.Exploit.MSOfficeWord.GenericS. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f7481d98d9477e74473e47341e2b7a95ffe4807f8f58f8db42582e9f50c51151"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Exploit.MSOfficeWord.GenericS Sample f7481d98d947… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f7481d98d947…. Malware family: Trojan.Exploit.MSOfficeWord.GenericS. Threat score 100/100. 13/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L30","11",{}]]