26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 47:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f82d272a52c5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample f82d272a52c5…. Malware family: Trojan.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 4 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f"],"about":{"@type":"SoftwareApplication","name":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":6,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":26},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T7d2,"http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4m" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vqhua2l7lrafelqd0q2sehtro5%2bghf%2bux73yoaf%2bbc0ghhr0fitgjkzswshq9s7zavr6jy8axnj174rqmyjrxtm0%2bz6j8lqqzejvt0fx%2bmqbmnx80qxooevpzyhttpyzzz3bwi8hk0hmcg%3d%3d" - Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4m" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vqhua2l7lrafelqd0q2sehtro5%2bghf%2bux73yoaf%2bbc0ghhr0fitgjkzswshq9s7zavr6jy8axnj174rqmyjrxtm0%2bz6j8lqqzejvt0fx%2bmqbmnx80qxooevpzyhttpyzzz3bwi8hk0hmcg%3d%3d" - Source: "00000000-00007552.00000002.189712.9E460000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found URL "https://bsc-dataseed.bnbchain.org/ahwvkwevy%see" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vqhua2l7lrafelqd0q2sehtro5%2bghf%2bux73yoaf%2bbc0ghhr0fitgjkzswshq9s7zavr6jy8axnj174rqmyjrxtm0%2bz6j8lqqzejvt0fx%2bmqbmnx80qxooevpzyhttpyzzz3bwi8hk0hmcg%3d%3d" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czc2.5.29.1bhv*8tpathawte," - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3il" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4m" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vqhua2l7lrafelqd0q2sehtro5%2bghf%2bux73yoaf%2bbc0ghhr0fitgjkzswshq9s7zavr6jy8axnj174rqmyjrxtm0%2bz6j8lqqzejvt0fx%2bmqbmnx80qxooevpzyhttpyzzz3bwi8hk0hmcg%3d%3d" - Source: "00000000-00007552.00000003.195214.9E460000.00000004.mdmp")3c:T435,Found string "+ncalrpc:[OLEA362E7B799B26A52CDF092E20CDC]" (Indicator: "ncalrpc"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "B+ncalrpc:[OLEFEA97226C6679D24F5494825BEEE]" (Indicator: "ncalrpc"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "+ncalrpc:[OLEFEA97226C6679D24F5494825BEEE]" (Indicator: "ncalrpc"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp")3d:T820,Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000001.187791.9E460000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9E460000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C74C000.00000004.mdmp, 00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found string "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" (Indicator: "aes"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found string "\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found string "AES" (Indicator: "aes"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C74C000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000001.187791.9E460000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9E460000.00000004.mdmp, 00000000-00007552.00000003.195214.9C74C000.00000004.mdmp, 00000000-00007552.00000003.195214.9E460000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007552.00000001.187791.9E460000.00000004.mdmp, 00000000-00007552.00000002.189712.9E460000.00000004.mdmp, 00000000-00007552.00000003.195214.9E460000.00000004.mdmp")3e:T653,Found reference to API "ProcessListSafe" (Indicator: "ProcessList"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007552.00000001.187791.9CAC0000.00000004.mdmp, 00000000-00007552.00000002.189712.40024000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007552.00000001.187791.9CAC0000.00000004.mdmp, 00000000-00007552.00000002.189712.40024000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007552.00000001.187791.9CAC0000.00000004.mdmp, 00000000-00007552.00000002.189712.40024000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007552.00000001.187791.9CAC0000.00000004.mdmp, 00000000-00007552.00000002.189712.40024000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007552.00000001.187791.9CAC0000.00000004.mdmp, 00000000-00007552.00000002.189712.40024000.00000002.mdmp") Found reference to API "ProcessListSafe" (Indicator: "ProcessList"; Source: "00000000-00007552.00000002.189712.18359000.00000002.mdmp")3f:T4fc,Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin") Found reference to API "NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00007552.00000001.187791.9CAC0000.00000004.mdmp, 00000000-00007552.00000002.189712.40024000.00000002.mdmp")40:T7ec," "{"id":1,"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF","data":"0x70a0823100000000000000000000000063b460f92e81a9859672476524a5e353dd33f0a8"},"latest"]}" HTTP/1.1 200 OK Date: Fri 24 Apr 2026 23:18:10 GMT Content-Type: application/json; charset=utf-8 Content-Length: 230 Connection: keep-alive Vary: Accept-Encoding Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: POST GET OPTIONS Access-Control-Allow-Origin: * Access-Control-Max-Age: 600 X-Nr-Trace-Id: 12069ab0168b12c7d5b433fc323b2060 X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubdomains with response body ==>7B226A736F6E727063223A22322E30222C226964223A312C22726573756C74223A22307830303030303030303030303030303030303030303030303030303030....... "POST / HTTP/1.1 Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480 Content-Type: application/x-www-form-urlencoded Host: celebration-internet.cc Content-Length: 52 Cache-Control: no-cache" with payload::==> "method=refresh&guid=E2380A777F973D8D7FDCC9472D611AF3" HTTP/1.1 200 OK Date: Fri 24 Apr 2026 23:18:10 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Alt-Svc: h3=":443"; ma=86400 cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=VQHua2l7LrAfELQD0Q2SEhtrO5%2BghF%2BUX73YOaf%2BBC0Ghhr0FITgjkzSwsHQ9s7ZAvr6JY8AXnJ174rQMyJrxtM0%2Bz6j8LQQZeJvT0FX%2BMqbmnx80qXOOeVpZYhtTpYZzZ3BWi8hK0hMCg%3D%3D"}]} CF-RAY: 9f18d35b29b09913-SJC with response body ==>6F6B....... "POST / HTTP/1.1 Content-Type: application/json Host: bsc-dataseed.bnbchain.org Content-Length: 200 Cache-Control: no-cache" with payload::==> "{"id":1,"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0x77c08D8A4Eab268fd5728ae8fE41b1FDE52967dF","data":"0x70a08231000000000000000000000000393a7ea666562dea0b47c983c2435bf5f31c987f"},"latest"]}" HTTP/1.1 200 OK Date: Fri 24 Apr 2026 23:20:40 GMT Content-Type: application/json; charset=utf-8 Content-Length: 230 Connection: keep-alive Vary: Accept-Encoding Access-Control-Allow-Credentials: true Access-Control-Allow-Headers: * Access-Control-Allow-Methods: POST GET OPTIONS Access-Control-Allow-Origin: * Access-Control-Max-Age: 600 X-Nr-Trace-Id: 95b090b323bd9b9c6ac859550cfd4dc5 X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block X-Content-Type-Options: nosniff Referrer-Policy: origin-when-cross-origin Strict-Transport-Security: max-age=31536000; includeSubdomains with response body ==>7B226A736F6E727063223A22322E30222C226964223A312C22726573756C74223A22307830303030303030303030303030303030303030303030303030303030....... "POST / HTTP/1.1 Authorization: 824c6b4d-4f01-4e22-a500-c7d239e10480 Content-Type: application/x-www-form-urlencoded Host: celebration-internet.cc Content-Length: 52 Cache-Control: no-cache" with payload::==> "method=refresh&guid=E2380A777F973D8D7FDCC9472D611AF3" HTTP/1.1 200 OK Date: Fri 24 Apr 2026 23:20:41 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 2 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} Alt-Svc: h3=":443"; ma=86400 cf-cache-status: DYNAMIC Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YjZnS5HJP%2Big8GSU3F7hGMBVdwdq3QMToeHw1ijwUp%2BBywyY4PiZopMqj7riUtUGZascqnY%2F%2Fk7Uh5GRdq67TaaPUbgWb4QUguc%2BaiZeFJ6A3Lc1kTPmGs7%2B%2F9cSi1B5w2100jkrSf29Ig%3D%3D"}]} CF-RAY: 9f18d7072ab21576-SJC with response body ==>6F6B.......43:T6d7,Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "\hapubws\appdata\local\microsoft\windows\inetcookies" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "sers\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "INetCookies" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string "icrosoft\Windows\INetCookies" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C6E0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\DNTException\" (Source: "00000000-00007552.00000001.187791.9C6E0000.00000004.mdmp, 00000000-00007552.00000002.189712.9C6E0000.00000004.mdmp, 00000000-00007552.00000003.195214.9C74C000.00000004.mdmp")44:Tbac," \"method=refresh&guid=E2380A777F973D8D7FDCC9472D611AF3\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":64,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":8,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["evasive","malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69ebf9f98583c1667906b8df","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["USA"],"submit_name":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin","analysis_start_time":"2026-04-24T23:17:14+00:00","indicators_count":{"informative":146,"suspicious":38,"malicious":4},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"54.167.29.115","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"address":"104.21.4.73","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"address":"54.205.242.99","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}],"dns_resolutions":[{"domain":"bsc-dataseed.bnbchain.org","address":"54.205.242.99","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"domain":"celebration-internet.cc","address":"104.21.4.73","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}],"http_requests":[{"host":"bsc-dataseed.bnbchain.org","host_ip":"54.167.29.115:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nContent-Type: application/json\nHost: bsc-dataseed.bnbchain.org\nContent-Length: 200\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}],"processes":[{"pid":7552,"ppid":0,"name":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin.exe","command_line":"","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","normalized_path":"C:\\f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f.bin.exe","uid":"00000000-00007552","icon":"$45"},{"pid":1260,"ppid":0,"name":"0eWwfjJD.exe","command_line":"","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","normalized_path":"%APPDATA%\\raimh-vtfh9-34u\\0eWwfjJD.exe","uid":"00000000-00001260","icon":"$46"}],"all_imported_dlls":["wbemprox.dll","bcrypt.dll","urlmon.dll","gdi32.dll","wbemcomn.dll","mswsock.dll","ncryptsslp.dll","sspicli.dll","powrprof.dll","profapi.dll","msasn1.dll","apphelp.dll","win32u.dll","sechost.dll","FWPUCLNT.DLL","ncrypt.dll","msvcp_win.dll","dnsapi.dll","winhttp.dll","nsi.dll","oleaut32.dll","wininet.dll","combase.dll","rsaenh.dll","user32.dll","cryptsp.dll","SHCore.dll","OnDemandConnRouteHelper.dll","IPHLPAPI.DLL","ole32.dll","windows.storage.dll","ws2_32.dll","msvcrt.dll","ntmarta.dll","clbcatq.dll","winnsi.dll","mskeyprotect.dll","wintrust.dll","KernelBase.dll","gdi32full.dll","msIso.dll","bcryptprimitives.dll","crypt32.dll","ntasn1.dll","advapi32.dll","kernel.appcore.dll","wbemsvc.dll","imagehlp.dll","cryptbase.dll","dpapi.dll","kernel32.dll","VxSSL64.dll","fltLib.dll","imm32.dll","iertutil.dll","rasadhlp.dll","gpapi.dll","ntdll.dll","ucrtbase.dll","fastprox.dll","schannel.dll","cryptnet.dll","rpcrt4.dll","shlwapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"0eWwfjJD.exe","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"0eWwfjJD.exe.bin","sha256":"f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"0eWwfjJD.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"%APPDATA%\\raimh-vtfh9-34u\\0eWwfjJD.exe","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"%APPDATA%\\raimh-vtfh9-34u\\0eWwfjJD.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\update-S-1-5-21-14297136-4737252683-2816350604-2100","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7552:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"update-S-1-5-21-14297136-4737252683-2816350604-2100","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"SM0:7552:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Local\\SM0:7552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"SM0:7552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"69ebf9f98583c1667906b8df"}]}]}},"report_ids":{"sandbox_job_ids":["69ebf9f98583c1667906b8df"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample f82d272a52c5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample f82d272a52c5…. Malware family: Trojan.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 4 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample f82d272a52c5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample f82d272a52c5…. Malware family: Trojan.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 4 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/f82d272a52c56f65d66ac665f3074639b93b61c094d27c75e0c77b9baffe896f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample f82d272a52c5… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample f82d272a52c5…. Malware family: Trojan.Generic. Threat score 100/100. 6/27 AV engines flagged this file. 4 malicious and 26 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L47","11",{}]]