24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T497,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 09d152aa2b62… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 09d152aa2b62…. Malware family: Trojan.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 1 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38"],"about":{"@type":"SoftwareApplication","name":"NVUnityPlugin.dll.exe","applicationCategory":["pedll","64bits","executable"],"identifier":"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":15,"total":26},"behavioralIndicators":{"malicious":1,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tf45,Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor rax rcx in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor eax ecx in Stream UID: 1552-2348-0000000180008A01 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1222-000000018001E786 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1222-000000018001E786 Assembly shows XOR instruction xor r8 rdx in Stream UID: 1552-1093-000000018001720B Assembly shows XOR instruction xor eax edx in Stream UID: 1552-1093-000000018001720B Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-884-00000001800094E8 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-884-00000001800094E8 Assembly shows XOR instruction xor rax rsp in Stream UID: 1552-1028-0000000180019C38 Assembly shows XOR instruction xor eax esp in Stream UID: 1552-1028-0000000180019C38 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1028-0000000180019C38 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1028-0000000180019C38 Assembly shows XOR instruction xor rax rsp in Stream UID: 1552-925-000000018000B79E Assembly shows XOR instruction xor eax esp in Stream UID: 1552-925-000000018000B79E Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-925-000000018000B79E Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-925-000000018000B79E Assembly shows XOR instruction xor rax rbp in Stream UID: 1552-859-0000000180007A9D Assembly shows XOR instruction xor eax ebp in Stream UID: 1552-859-0000000180007A9D Assembly shows XOR instruction xor rcx rbp in Stream UID: 1552-859-0000000180007A9D Assembly shows XOR instruction xor ecx ebp in Stream UID: 1552-859-0000000180007A9D Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1118-000000018001809C Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1118-000000018001809C Assembly shows XOR instruction xor rax rsp in Stream UID: 1552-1230-000000018001EF06 Assembly shows XOR instruction xor eax esp in Stream UID: 1552-1230-000000018001EF06 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1230-000000018001EF06 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1230-000000018001EF06 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1225-000000018001E9D5 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1225-000000018001E9D5 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1027-0000000180011B02 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1027-0000000180011B02 Assembly shows XOR instruction xor rax rsp in Stream UID: 1552-1149-00000001800196C6 Assembly shows XOR instruction xor eax esp in Stream UID: 1552-1149-00000001800196C6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1149-00000001800196C6 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1149-00000001800196C6 Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-886-00000001800095EC Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-886-00000001800095EC Assembly shows XOR instruction xor rcx rsp in Stream UID: 1552-1228-000000018001EC19 Assembly shows XOR instruction xor ecx esp in Stream UID: 1552-1228-000000018001EC1926:T608e," Console $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\bin\x86\$(TargetName).pdb LIBCMT.lib;LIBCPMT.lib;%(IgnoreSpecificDefaultLibraries) true true /IGNORE:4006,4221,4049,4217,4197,4099 %(AdditionalOptions) 6.1 $(IntDir)\$(TargetName).lib 4113;%(TreatSpecificWarningsAsErrors) 4244;4267;4018;4146;4028;4996;4090;4114;4308;4305;4005;4101;4554;4307;4273;4133;4544;4334;4293;4047;%(DisableSpecificWarnings) Console $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\bin\x64\$(TargetName).pdb LIBCMT.lib;LIBCPMT.lib;%(IgnoreSpecificDefaultLibraries) true /IGNORE:4006,4221,4049,4217,4197,4099 %(AdditionalOpt", "ame).pdb LIBCMT.lib;LIBCPMT.lib;%(IgnoreSpecificDefaultLibraries) true true /IGNORE:4006,4221,4049,4217,4197,4099 %(AdditionalOptions) 6.1 $(IntDir)\$(TargetName).lib Level3 WIN32;_WINDOWS;_USE_MATH_DEFINES;_CRT_SECURE_NO_WARNINGS;_WIN32_WINNT=0x0601;_DEBUG;DEBUG;%(PreprocessorDefinitions) .\;..\;$(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories)$(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\bin\x64\$(TargetName).pdb LIBCMT.lib;LIBCPMT.lib;%(IgnoreSpecificDefaultLibraries) true /IGNORE:4006,4221,4049,4217,4197,4099 %(AdditionalOptions) 6.1 $(IntDir)\$(TargetName).lib Level3 true true /Qvec- /Qsimd- %(AdditionalOptions) /utf-8 %(AdditionalOptions) true true Console $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\bin\x86\$(TargetName).pdb true", "ences> Console $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\bin\x64\$(TargetName).pdb /IGNORE:4006,4221,4049,4217,4197,4099 %(AdditionalOptions) 6.1 $(IntDir)\$(TargetName).lib Level3 true true WIN3", "Warnings> /Qvec- /Qsimd- %(AdditionalOptions) /utf-8 %(AdditionalOptions) true true Console $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\bin\x86\$(TargetName).pdb true /IGNORE:4006,4221,4049,4217,4197,4099 %(Additiona", "ase>$(IntDir)\$(TargetName).pgd $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\bin\x64\$(TargetName).pdb /IGNORE:4006,4221,4049,4217,4197,4099 %(AdditionalOptions) 6.1 $(IntDir)\$(TargetName).lib ", "ir> $(ProjectDir)obj\$(Configuration)\$(Platform)\$(ProjectName)\ $(ProjectDir)obj\Generated Clean MSB8012 Level3 Disabled true _WINDOWS;WIN32;_WIN32_WINNT=0x0601;_DEBUG;_LIB;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(OutDir)\lib\x86\$(TargetName).pdb", "IncludeDirectories> $(OutDir)\lib\x64\$(TargetName).pdb false $(OutDir)\lib\x64\$(TargetName)$(TargetExt) MachineX64 Console $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) Level3 Disabled true _WINDOWS;WIN32;_WIN32_WINNT=0x0601;_DEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) true $(IntDir)$(TargetName).pdb false $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\lib\x86\$(TargetName).pdb Console $(OutDir)\lib\x86\$(TargetName).lib $(IntDir)\$(TargetName).pgd true $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) true 6.", "1 Level3 Disabled true _WINDOWS;WIN32;_WIN32_WINNT=0x0601;_DEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(IntDir)$(TargetName).pdb false $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\lib\x64\$(TargetName).pdb true true true _WINDOWS;WIN32;_WIN32_WINNT=0x0601;NDEBUG;_LIB;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) SingleFile $(OutDir)\lib\x86\$(TargetName).pdb $(OutDir)\lib\x86\$(TargetName)$(TargetExt) MachineX86 Console $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) ", "ludeDirectories> SingleFile $(OutDir)\lib\x64\$(TargetName).pdb $(OutDir)\lib\x64\$(TargetName)$(TargetExt) MachineX64 Console $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) Level3 MaxSpeed true true true AnySuitable Speed true true true _WINDOWS;WIN32;_WIN32_WINNT=0x0601;NDEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(IntDir)$(TargetName).pdb true true $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\lib\x86\$(TargetName).pdb Console $(OutD", ">true true true _WINDOWS;WIN32;_WIN32_WINNT=0x0601;NDEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(IntDir)$(TargetName).pdb true true $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\lib\x64\$(TargetName).pdb Console $(OutDir)\lib\x64\$(TargetName).lib $", "StringPooling> _WINDOWS;WIN32;_WIN32_WINNT=0x0601;NDEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(IntDir)$(TargetName).pdb true true $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\lib\x86\$(TargetName).pdb Console $(OutDir)\lib\x86\$(TargetName).lib $(IntDir)\$(TargetName).pgd true $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(IntDir)$(TargetName).pdb true true $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\lib\x64\$(TargetName).pdb Console $(OutDir)\lib\x64\$(TargetName).lib $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) WIN32;_WINDOWS;_DEBUG;_LIB;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(OutDir)\lib\x86\$(TargetName).pdb false NotUsing false $(OutDir)\lib\x86\$(TargetName)$(TargetExt) MachineX86 Console $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) Level3 Disabled true WIN32;_WINDOWS;_DEBUG;_LIB;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(OutDir)\lib\x64\$(TargetName).pdb false NotUsing false $(OutDir)\lib\x64\$(TargetName)$(TargetExt) MachineX64 Console $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) Level3 Disabled true WIN32;_WINDOWS;_DEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) true $(IntDir)$(TargetName).pdb false NotUsing", "false $(OutDir)\bin\x86\$(TargetName)$(TargetExt) $(OutDir)\lib\x86\$(TargetName).pdb Console $(OutDir)\lib\x86\$(TargetName).lib $(IntDir)\$(TargetName).pgd true $(OutDir)\lib\x86\;$(ProjectDir)\..\..\prebuilt\lib\x86\;%(AdditionalLibraryDirectories) true 10.0 8.1 $(OutDir)\lib\x86\$(RootNamespace).winmd Level3 Disabled true WIN32;_WINDOWS;_DEBUG;_USRDLL;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) $(IntDir)$(TargetName).pdb false NotUsing false $(OutDir)\bin\x64\$(TargetName)$(TargetExt) $(OutDir)\lib\x64\$(Tar", "getName).pdb Console $(OutDir)\lib\x64\$(TargetName).lib $(IntDir)\$(TargetName).pgd $(OutDir)\lib\x64\;$(ProjectDir)\..\..\prebuilt\lib\x64\;%(AdditionalLibraryDirectories) true 10.0 8.1 $(OutDir)\lib\x64\$(RootNamespace).winmd Level3 MaxSpeed true true true AnySuitable Speed true true true WIN32;_WINDOWS;NDEBUG;_LIB;_CRT_SECURE_NO_DEPRECATE;_CRT_NONSTDC_NO_DEPRECATE;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) $(OutDir)\include;$(ProjectDir)\..\..\prebuilt\include;%(AdditionalIncludeDirectories) SingleFile $(OutDir)\lib\x86\$(TargetName).pdb NotUsing nul 2>&1IF errorlevel 1 CALL :GetWin10SdkVerHelper HKCU\SOFTWARE\Wow6432Node > nul 2>&1IF errorlevel 1 CALL :GetWin10SdkVerHelper HKLM\SOFTWARE > nul 2>&1IF errorlevel 1 CALL :GetWin10SdkVerHelper HKCU\SOFTWARE > nul 2>&1IF errorlevel 1 EXIT /B 1EXIT /B 0:GetWin10SdkVerHelper@REM Get Windows 10 SDK installed folderFOR /F "tokens=1 2*" %%i IN ('reg query "%1\Microsoft\Microsoft SDKs\Windows\v10.0" /v "InstallationFolder"') DO ( IF "%%i"=="InstallationFolder" ( SET WindowsSdkDir=%%~k ))@REM get windows 10 sdk version numberSETLOCAL enableDelayed" in Source: 09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38 "@ECHO OFFSET PROJECT=template_in@REM Detect the newest available Windows SDKCALL :GetWindowsSdkVer@REM Open the project%PROJECT%.slnEXIT /B 0:GetWindowsSdkVerSET WindowsTargetPlatformVersion=IF "%WindowsTargetPlatformVersion%"=="" CALL :GetWin10SdkVerIF "%WindowsTargetPlatformVersion%"=="" CALL :GetWin81SdkVerEXIT /B 0:GetWin10SdkVerCALL :GetWin10SdkVerHelper HKLM\SOFTWARE\Wow6432Node > nul 2>&1IF errorlevel 1 CALL :GetWin10SdkVerHelper HKCU\SOFTWARE\Wow6432Node > nul 2>&1IF errorlevel 1 CALL :GetWin10SdkVerHelper HKLM\SOFTWARE > nul 2>&1IF errorlevel 1 CALL :GetWin10SdkVerHelper HKCU\SOFTWARE > nul 2>&1IF errorlevel 1 EXIT /B 1EXIT /B 0:GetWin10SdkVerHelper@REM Get Windows 10 SDK installed folderFOR /F "tokens=1 2*" %%i IN ('reg query "%1\Microsoft\Microsoft SDKs\Windows\v10.0" /v "InstallationFolder"') DO ( IF "%%i"=="InstallationFolder" ( SET WindowsSdkDir=%%~k ))@REM get windows 10 sdk version numberSETLOCAL enableDelaye" in Source: 09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc381b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790553147886,"unified_at":"2026-09-27T23:52:27.886Z","metadata":{"hashes":{"sha256":"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38","sha1":"dd8b8c4de92d9b6d1d04f0e995f4cc7e746d0a64","md5":"39898007146d7b436d013924db58ebc6","sha512":"3cf3ad3c1ca426bba0631f9ef50a9245ea1f0aeb30e0fb865ed7c85fd627f45c45ddd1a6e1fc34fdbde04552d68961dcc88889e1e9cee64fccbeeb287749667a","ssdeep":"12288:qlvYd7I3sUQneNlE/vvyzhKV71vCuw/xIp09:qRLNS/nN7GpIW","ssdeep_chunks":["12288:qlvYd7I","12288:lvYd7I3","12288:vYd7I3s","12288:Yd7I3sU","12288:d7I3sUQ","12288:7I3sUQn","12288:I3sUQne","12288:3sUQneN","12288:sUQneNl","12288:UQneNlE","12288:QneNlE/","12288:neNlE/v","12288:eNlE/vv","12288:NlE/vvy","12288:lE/vvyz","12288:E/vvyzh","12288:/vvyzhK","12288:vvyzhKV","12288:vyzhKV7","12288:yzhKV71","12288:zhKV71v","12288:hKV71vC","12288:KV71vCu","12288:V71vCuw","12288:71vCuw/","12288:1vCuw/x","12288:vCuw/xI","12288:Cuw/xIp","12288:uw/xIp0","12288:w/xIp09","24576:qlvYd7I","24576:lvYd7I3","24576:vYd7I3s","24576:Yd7I3sU","24576:d7I3sUQ","24576:7I3sUQn","24576:I3sUQne","24576:3sUQneN","24576:sUQneNl","24576:UQneNlE","24576:QneNlE/","24576:neNlE/v","24576:eNlE/vv","24576:NlE/vvy","24576:lE/vvyz","24576:E/vvyzh","24576:/vvyzhK","24576:vvyzhKV","24576:vyzhKV7","24576:yzhKV71","24576:zhKV71v","24576:hKV71vC","24576:KV71vCu","24576:V71vCuw","24576:71vCuw/","24576:1vCuw/x","24576:vCuw/xI","24576:Cuw/xIp","24576:uw/xIp0","24576:w/xIp09","12288:qRLNS/n","12288:RLNS/nN","12288:LNS/nN7","12288:NS/nN7G","12288:S/nN7Gp","12288:/nN7GpI","12288:nN7GpIW"],"imphash":"3b21eea11c8393dc357eb2ad9fc4b106"},"file_info":{"file_name":"NVUnityPlugin.dll.exe","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":494592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1710844215000,"last_seen":1712833172000,"last_multi_scan":1712833172000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["labyrinthchollima","loader","npmloader","targeted"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":24},"sandbox_signatures":{"informative_count":48,"suspicious_count":3,"malicious_count":1,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win64.NukeSped","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/NukeSped.pfzww","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.72021484","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bkavpro":{"name":"Bkav Pro","success":true,"verdict":"malicious","threat_name":"W32.Common.F9F0709C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Phonzy_A_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.72021484 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/NukeSped.RJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005b309b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.LAHJ-0715","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.NukeSpeed","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.NukeSped.Win64.413","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.145701688494692","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 1552-2348-0000000180008A01","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 1552-2348-0000000180008A01","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoW@KERNEL32.dll at 1552-1029-0000000180017570\n GetLocaleInfoW@KERNEL32.dll at 1552-1222-000000018001E786\n EnumSystemLocalesW@KERNEL32.dll at 1552-1093-000000018001720B\n GetLocaleInfoW@KERNEL32.dll at 1552-1229-000000018001ED98\n EnumSystemLocalesW@KERNEL32.dll at 1552-1236-000000018001E818\n EnumSystemLocalesW@KERNEL32.dll at 1552-1230-000000018001EF06\n GetLocaleInfoW@KERNEL32.dll at 1552-1225-000000018001E9D5\n GetLocaleInfoW@KERNEL32.dll at 1552-1233-000000018001ED20\n GetLocaleInfoW@KERNEL32.dll at 1552-1227-000000018001EDD0\n GetUserDefaultLCID@KERNEL32.dll at 1552-1102-000000018001761D\n GetLocaleInfoW@KERNEL32.dll at 1552-1228-000000018001EC19\n EnumSystemLocalesW@KERNEL32.dll at 1552-1224-000000018001E91A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"file/memory contains long string with (Indicator: \"set \"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"$26","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$28","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"DLL with no export directory","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has no export directory \"IMAGE_DIRECTORY_ENTRY_EXPORT\"","origin":"Static Parser","relevance":1,"id":"static-91","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" file has an entrypoint instructions - \"mov\tqword ptr [rsp + 8], rbx,mov\tqword ptr [rsp + 0x10], rsi,push\trdi,sub\trsp, 0x20,mov\trdi, r8,mov\tebx, edx,mov\trsi, rcx,cmp\tedx, 1,jne\t0x180008579,call\t0x1800089e0,mov\tr8, rdi,mov\tedx, ebx,mov\trcx, rsi,mov\trbx, qword ptr [rsp + 0x30],mov\trsi, qword ptr [rsp + 0x38],add\trsp, 0x20,pop\trdi,jmp\t0x180008424,int3\t,int3\t,int3\t,sub\trsp, 0x28,mov\tr8, qword ptr [r9 + 0x38],mov\trcx, rdx,mov\trdx, r9,call\t0x1800085b8,mov\teax, 1,add\trsp, 0x28,ret\t,int3\t,int3\t,int3\t,push\trbx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has high imagebase \"0x180000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"?G.Gm\"\n Heuristic match: \"\\/.Gq\"\n Pattern match: \"http://schemas.microsoft.com/developer/msbuild/2003\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: bd0bf25947d4a37404f0424edf4db9ad\n Observed JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.93434292676","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n LoadLibraryA\n UnhandledExceptionFilter\n LoadLibraryExW\n TerminateProcess\n GetModuleHandleExW\n VirtualProtect\n GetStartupInfoW\n GetFileSizeEx\n FindNextFileW\n FindFirstFileExW\n GetProcAddress\n CreateFileW\n GetCommandLineW\n GetCommandLineA\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38\" has a section named \"_RDATA\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":0,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["labyrinthchollima","loader","npmloader","targeted"],"sandbox_reports":[{"id":"6617c294441d886b2904f0c0","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38","analysis_start_time":"2024-04-11T10:59:32+00:00","indicators_count":{"informative":48,"suspicious":3,"malicious":1},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6617c294441d886b2904f0c0"}],"processes":[{"pid":3352,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00003352"}],"all_imported_dlls":null},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6617c294441d886b2904f0c0"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 09d152aa2b62… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 09d152aa2b62…. Malware family: Trojan.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 1 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 09d152aa2b62… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 09d152aa2b62…. Malware family: Trojan.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 1 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/09d152aa2b6261e3b0a1d1c19fa8032f215932186829cfcca954cc5e84a6cc38"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 09d152aa2b62… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 09d152aa2b62…. Malware family: Trojan.Generic. Threat score 100/100. 15/26 AV engines flagged this file. 1 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]