24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49e,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f80103f2a3b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f80103f2a3b1…. Malware family: Trojan.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 7 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808"],"about":{"@type":"SoftwareApplication","name":"bounty-33263058226606156","applicationCategory":["peexe","assembly","executable"],"identifier":"f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9c2,Found reference to API "System.Runtime.InteropServices" (Indicator: "time"; Source: "sample.bin"), Found reference to API "get_CreationTime" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "get_CreationTime" (Indicator: "time"; Source: "sample.bin"), Found reference to API "MessageSecurityOverTcp" (Indicator: "security"; Source: "sample.bin"), Found reference to API "IRemoteEndpoint" (Indicator: "tee"; Source: "sample.bin"), Found reference to API "PaKillssAFileSystemntivFileSystemirusPrFileSystemoduFileSystemct|AntiFileSystemSpyWFileSystemareProFileSystemduct|FireFileSystemwallProdFileSystemuct" (Indicator: "kill"; Source: "sample.bin"), Found reference to API "set_Security" (Indicator: "security"; Source: "sample.bin"), Found reference to API "System.Runtime.Serialization" (Indicator: "time"; Source: "sample.bin"), Found reference to API "SecurityMode" (Indicator: "security"; Source: "sample.bin"), Found reference to API "AsyncCallback" (Indicator: "sync"; Source: "sample.bin"), Found reference to API "connector" (Indicator: "connect"; Source: "sample.bin"), Found reference to API "XmlTextReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "System.ServiceModel.Security" (Indicator: "security"; Source: "sample.bin"), Found reference to API "StreamReader" (Indicator: "read"; Source: "sample.bin"), Found reference to API "ReadContextValue" (Indicator: "read"; Source: "sample.bin"), Found reference to API "SelectMany" (Indicator: "select"; Source: "sample.bin"), Found reference to API "links" (Indicator: "link"; Source: "sample.bin"), Found reference to API "System.Security.Permissions.SecurityPermissionAttribute, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "security"; Source: "sample.bin"), Found reference to API "shell\open\command" (Indicator: "open"; Source: "sample.bin"), Found reference to API "__StaticArrayInitTypeSize=6" (Indicator: "stat"; Source: "sample.bin"), Found reference to API "CreateChannel" (Indicator: "creat"; Source: "sample.bin"), Found reference to API "set_SendTimeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "ReadAllBytes" (Indicator: "read"; Source: "sample.bin"), Found reference to API "RuntimeCompatibilityAttribute" (Indicator: "time"; Source: "sample.bin"), Found reference to API "set_Timeout" (Indicator: "time"; Source: "sample.bin"), Found reference to API "RuntimeTypeHandle" (Indicator: "time"; Source: "sample.bin")26:T46c,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin"27:T42c,"" (Indicator: "enumchildwindows"; Source: "00000000-00004652.00000000.173064.03460000.00000004.mdmp, 00000000-00004652.00000001.174986.03460000.00000004.mdmp, 00000000-00004652.00000002.176905.03460000.00000004.mdmp, 00000000-00004652.00000003.182410.03460000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00004652.00000000.173064.05850000.00000004.mdmp, 00000000-00004652.00000001.174986.05850000.00000004.mdmp, 00000000-00004652.00000002.176905.05850000.00000004.mdmp, 00000000-00004652.00000003.182410.05850000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00004652.00000000.173064.05850000.00000004.mdmp, 00000000-00004652.00000001.174986.05850000.00000004.mdmp, 00000000-00004652.00000002.176905.05850000.00000004.mdmp, 00000000-00004652.00000003.182410.05850000.00000004.mdmp")29:T9f2,"" (Indicator: "password"; Source: "00000000-00004652.00000000.173064.05850000.00000004.mdmp, 00000000-00004652.00000001.174986.05850000.00000004.mdmp, 00000000-00004652.00000002.176905.05850000.00000004.mdmp, 00000000-00004652.00000003.182410.05850000.00000004.mdmp")38:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004652.00000000.173064.03460000.00000004.mdmp, 00000000-00004652.00000001.174986.03460000.00000004.mdmp, 00000000-00004652.00000002.176905.03460000.00000004.mdmp, 00000000-00004652.00000003.182410.03460000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a99080bdb1bd039920272d6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004652.00000000.173064.05850000.00000004.mdmp, 00000000-00004652.00000001.174986.05850000.00000004.mdmp, 00000000-00004652.00000002.176905.05850000.00000004.mdmp, 00000000-00004652.00000003.182410.05850000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004652.00000000.173064.05850000.00000004.mdmp, 00000000-00004652.00000001.174986.05850000.00000004.mdmp, 00000000-00004652.00000002.176905.05850000.00000004.mdmp, 00000000-00004652.00000003.182410.05850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a99080bdb1bd039920272d6"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004652.00000000.173064.05850000.00000004.mdmp, 00000000-00004652.00000001.174986.05850000.00000004.mdmp, 00000000-00004652.00000002.176905.05850000.00000004.mdmp, 00000000-00004652.00000003.182410.05850000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a99080bdb1bd039920272d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"f80103f2a3b19dc0e0b26e84e4f259b5e07226527c06b253ea441c98eeb98808.bin\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00004652.00000001.174986.00EB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a99080bdb1bd039920272d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a99080bdb1bd039920272d6"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"