23:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 22:T443,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample fdbc89d95c00… — Score 39/100 — Hybrid Analysis","description":"Suspicious verdict for sample fdbc89d95c00…. Threat score 39/100. 0/27 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/fdbc89d95c002985f71ef3a8471bded05e71559874f36dd12186def8eef73e81","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","fdbc89d95c002985f71ef3a8471bded05e71559874f36dd12186def8eef73e81"],"about":{"@type":"SoftwareApplication","name":"2018-08-15-Hancitor-malspam-infection-traffic.pcap","applicationCategory":["doc","office"],"identifier":"fdbc89d95c002985f71ef3a8471bded05e71559874f36dd12186def8eef73e81","additionalType":"Suspicious sample"},"threatScore":39,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}24:T429,"\Sessions\1\BaseNamedObjects\Local\10MU_ACBPIDS_S-1-5-5-0-57987" "\Sessions\1\BaseNamedObjects\Local\10MU_ACB10_S-1-5-5-0-57987" "\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\ZonesCacheCounterMutex" "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\ZoneAttributeCacheCounterMutex" "Local\ZonesCounterMutex" "Local\ZonesLockedCacheCounterMutex" "Local\10MU_ACB10_S-1-5-5-0-57987" "Local\10MU_ACBPIDS_S-1-5-5-0-57987"25:T672,"WINWORD.EXE" touched file "C:\Windows\AppPatch\sysmain.sdb" "WINWORD.EXE" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "WINWORD.EXE" touched file "C:\Windows\Fonts\StaticCache.dat" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\user32.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\setupapi.dll.mui" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "C:\Windows\System32\rsaenh.dll" "WINWORD.EXE" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "WINWORD.EXE" touched file "C:\Windows\System32\msxml6r.dll" "WINWORD.EXE" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3D7A577D-C96F-485A-9F7A-259227220BAD}.tmp"26:T513,Heuristic match: "Host: thegymnaststore.com" Heuristic match: "ePsPz&,w$G=(t*F9&&d=g1Tg3#2L1k*2Z6xqb>6\\(O0>Nc*iV.cf" Pattern match: "http://schemas.openxmlformats.org/officeDocument/2006/bibliography" Pattern match: "http://schemas.openxmlformats.org/officeDocument/2006/customXml" Pattern match: "http://schemas.openxmlformats.org/drawingml/2006/main" Heuristic match: "Host: api.ipify.org" Heuristic match: "Host: notmesparly.com" Heuristic match: "Host: mikaelraad.com" Pattern match: "http://mikaelraad.com/cgi-sys/suspendedpage.cgi" Pattern match: "http://fwdssp.com/?dn=referer_detect&pid=5POL4F2O4" Heuristic match: "Host: tmpressio.org" Heuristic match: "TTQ=LVXpU=.UK" Pattern match: "IB.uU/w*5qa#kcZ@x].xsf" Pattern match: "m.SJu/9Tec?aU|}\sn|6cCHuPqS" Pattern match: "T.TQ/io;LnYvTRsKcU" Heuristic match: "'KTn\`CjJ`XWsiYv6aV+L.0p`jNT|Xt88*.gPm2Tt5;@9W|yPt0]UsV_;Su0x#\n~Q=BaWQ|Q)j}0*CWTiWkmctk's.TN" Pattern match: "j.ZQXk/sPXrEnS.wsDoGcQz" Pattern match: "p2KCXP1OPLT.VWQ/|w6cQ&ojS}-Pziw{R]Tx8W:TK" Heuristic match: "3L.MR" Pattern match: "82mR.mQ/wTBVT&TA" Heuristic match: "lyletening.ru" Pattern match: "d.awm/uca{A1GL#=uTd`Cd}4z=g+M" Heuristic match: "_;H~Ds)yJ\GVq$qw9$./M<*l>cbta(?$vUg.vG" Heuristic match: "TTQS=L VX p U=.UK" Pattern match: "IBa.uUa/w*"27:T891,"WINWORD.EXE" wrote bytes "f300f300" to virtual address "0x671863DC" (part of module "WPFT532.CNV") "WINWORD.EXE" wrote bytes "893faf3f" to virtual address "0x6FA216CC" (part of module "WINSCARD.DLL") "WINWORD.EXE" wrote bytes "03186069" to virtual address "0x2F7B1B94" (part of module "WINWORD.EXE") "WINWORD.EXE" wrote bytes "e9365582f2" to virtual address "0x75693EAE" ("VariantClear@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "2825226a" to virtual address "0x6A40CA70" (part of module "GFX.DLL") "WINWORD.EXE" wrote bytes "1ac064fd" to virtual address "0x6719BE64" (part of module "WPFT532.CNV") "WINWORD.EXE" wrote bytes "e9c532c9f2" to virtual address "0x757C6143" ("OleLoadFromStream@OLE32.DLL") "WINWORD.EXE" wrote bytes "0b4f3743" to virtual address "0x6F5A42C4" (part of module "MSPROOF7.DLL") "WINWORD.EXE" wrote bytes "c4ca577580bb5775aa6e58759fbb577508bb577546ce577561385875de2f5875d0d95775000000001779ce764f91ce767f6fce76f4f7ce7611f7ce76f283ce76857ece7600000000" to virtual address "0x6BB51000" (part of module "MSIMG32.DLL") "WINWORD.EXE" wrote bytes "e51f226a" to virtual address "0x6A78F530" (part of module "WWLIB.DLL") "WINWORD.EXE" wrote bytes "e9603382f2" to virtual address "0x75694731" ("SysAllocStringByteLen@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "293c483c" to virtual address "0x6FA21524" (part of module "WINSCARD.DLL") "WINWORD.EXE" wrote bytes "844c36b5" to virtual address "0x66EB2A00" (part of module "CSS7DATA0009.DLL") "WINWORD.EXE" wrote bytes "311a226a" to virtual address "0x690D78E4" (part of module "OART.DLL") "WINWORD.EXE" wrote bytes "e99e488ff2" to virtual address "0x75583D01" ("SetUnhandledExceptionFilter@KERNEL32.DLL") "WINWORD.EXE" wrote bytes "e9239984f2" to virtual address "0x75695DEE" ("VariantChangeType@OLEAUT32.DLL") "WINWORD.EXE" wrote bytes "0c352235" to virtual address "0x6FA225E0" (part of module "WINSCARD.DLL") "WINWORD.EXE" wrote bytes "00000000" to virtual address "0x67177FA4" (part of module "WPFT632.CNV") "WINWORD.EXE" wrote bytes "fccf316a" to virtual address "0x671F9904" (part of module "RICHED20.DLL") "WINWORD.EXE" wrote bytes "e99a5481f2" to virtual address "0x75693E59" ("SysFreeString@OLEAUT32.DLL")28:T6e48,Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)Rt[P<P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)]Zt[IB" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)Zt[<P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)N[t[&" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)[t[<*P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)?\t[L<3P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)\t[$<GP" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)]t[<RP" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)"^t[<\P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)^t[<eP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)_t[<nP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)_t[w<wP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)`t[<P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)|`t[`%", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)`t[<~P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)mat[7<uP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)at[<kP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)^bt[o<bP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)bt[<YP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)Oct[<PP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)ct[|<GP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)@dt[U^", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)dt[%7<1P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)1et[<'P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)et[}<P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)"ft[<P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)ft[<" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)t[R< P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)Zt[< P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)[t[ <* P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)?\t[L9 <3 P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)\t[$<< P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)1]t[@<G P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)]t[<R P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)"^t[<\ P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)a^t[<e P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)_t[ 9 <n P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)9 _t[w<w SP" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)`t[< P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)`t[<" ~P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)mat[7<~ uP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)at[< kP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)^bt[o< bP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)bt[! < YP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)Oct[< PP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)ct[|< GP", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)dt[%7< 1P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)1et[< 'P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)et[}< P", Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64)"ft[< P" Heuristic match: "GUID=15568065842790665216&BUILD=15fwe08&INFO=MARIGOLDS-PC @ MARIGOLDS-PC\mary2&IP=173.66.46.112&TYPE=1&WIN=6.1(x64): ft[<