26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 45:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c5,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample f96575db91db… — Score 88/100 — Hybrid Analysis","description":"Malicious verdict for sample f96575db91db…. Malware family: Trojan.Generic. Threat score 88/100. 10/27 AV engines flagged this file. 3 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0"],"about":{"@type":"SoftwareApplication","name":"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0","additionalType":"Malicious sample"},"threatScore":88,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":10,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T687,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007228.00000000.241987.00053000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007228.00000000.241987.00053000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00007228.00000000.241987.00053000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007228.00000000.241987.0007B000.00000004.mdmp")28:T772,"\" (Source: \"00000000-00007228.00000000.241987.09FE0000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00007228.00000000.241987.09FE0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007228.00000000.241987.00053000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007228.00000000.241987.0007B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002664-00000C2B-2748126225\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatus\" (File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found string \"EnumServicesStatusExW\" (File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00007228.00000000.241987.00053000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExA\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00007228.00000000.241987.00053000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsA\" in file \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in file \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00007228.00000000.241987.00053000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00007228.00000000.241987.0007B000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\": No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00007228.00000000.241987.09FE0000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00007228.00000000.241987.09FE0000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00007228.00000000.241987.09FE0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"f96575db91db3fc3f49101dbc1d31ff9a596d8d2aa51c5d0951db941623f9ba0.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007228.00000000.241987.0007B000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00007228.00000000.241987.0007B000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a43121ff030bcf9e5023355"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"