24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4cb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 142f8cd20af1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 142f8cd20af1…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 16/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32"],"about":{"@type":"SoftwareApplication","name":"bounty-86587591847718551","applicationCategory":["peexe","executable"],"identifier":"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":16,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta1a,".exe" wrote bytes "b8c015966dffe0" to virtual address "0x74DA11F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "e7390277e1a606772e710677ee29067785e201776da00677906405773ad50c7726e40177d16d0677003d0477804b047700000000ad37d6758b2dd675b641d67500000000" to virtual address "0x74A51000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74DA139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x74DA12DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812da74" to virtual address "0x74DB83DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "6012966d" to virtual address "0x754BE324" (part of module "WININET.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74DA1408" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b84013966dffe0" to virtual address "0x74DA1248" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812da74" to virtual address "0x74DB8348" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811da74" to virtual address "0x74DB8368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x74DA12CC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x75D61680" (part of module "WS2_32.DLL") ".exe" wrote bytes "f811da74" to virtual address "0x74DB834C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c04e047720540577e0650577b53806770000000000d0607500000000c5ea60750000000088ea607500000000e968f47482280677ee29067700000000d269f474000000007dbb60750000000009bef47400000000ba18607500000000" to virtual address "0x77181000" (part of module "NSI.DLL") ".exe" wrote bytes "fae60177e1a606772e710677ee29067785e201776da0067726e40177d16d0677003d0477804b047700000000ad37d6758b2dd675b641d67500000000" to virtual address "0x743A1000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "4812da74" to virtual address "0x74DB83C0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811da74" to virtual address "0x74DB83E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b83012966dffe0" to virtual address "0x75D61368" (part of module "WS2_32.DLL") ".exe" wrote bytes "f811da74" to virtual address "0x74DB83C4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812da74" to virtual address "0x74DB8364" (part of module "SSPICLI.DLL")26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791645251343,"unified_at":"2026-10-10T15:14:11.343Z","metadata":{"hashes":{"sha256":"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32","sha1":"bf1687c0613ca288dbf201ebd6121d1385c23a6a","md5":"6725f16038c054b28556f41a612b3e21","sha512":"1a893758cbd15413bb7be0f23c7068cd9094c71cfe20aab8de3eb1684aeca74e928c72dc9c5c883d4e4ce1ae4f199c530c83a23c1410a6441c6fa8527867083a","ssdeep":"768:cuestkX1VC9reaYD2r4dJfnKjKHyKe1BSWjRPjJn7:y3C9nYirclTHgTSW1Pln7","ssdeep_chunks":["768:cuestkX","768:uestkX1","768:estkX1V","768:stkX1VC","768:tkX1VC9","768:kX1VC9r","768:X1VC9re","768:1VC9rea","768:VC9reaY","768:C9reaYD","768:9reaYD2","768:reaYD2r","768:eaYD2r4","768:aYD2r4d","768:YD2r4dJ","768:D2r4dJf","768:2r4dJfn","768:r4dJfnK","768:4dJfnKj","768:dJfnKjK","768:JfnKjKH","768:fnKjKHy","768:nKjKHyK","768:KjKHyKe","768:jKHyKe1","768:KHyKe1B","768:HyKe1BS","768:yKe1BSW","768:Ke1BSWj","768:e1BSWjR","768:1BSWjRP","768:BSWjRPj","768:SWjRPjJ","768:WjRPjJn","768:jRPjJn7","1536:cuestkX","1536:uestkX1","1536:estkX1V","1536:stkX1VC","1536:tkX1VC9","1536:kX1VC9r","1536:X1VC9re","1536:1VC9rea","1536:VC9reaY","1536:C9reaYD","1536:9reaYD2","1536:reaYD2r","1536:eaYD2r4","1536:aYD2r4d","1536:YD2r4dJ","1536:D2r4dJf","1536:2r4dJfn","1536:r4dJfnK","1536:4dJfnKj","1536:dJfnKjK","1536:JfnKjKH","1536:fnKjKHy","1536:nKjKHyK","1536:KjKHyKe","1536:jKHyKe1","1536:KHyKe1B","1536:HyKe1BS","1536:yKe1BSW","1536:Ke1BSWj","1536:e1BSWjR","1536:1BSWjRP","1536:BSWjRPj","1536:SWjRPjJ","1536:WjRPjJn","1536:jRPjJn7","768:y3C9nYi","768:3C9nYir","768:C9nYirc","768:9nYircl","768:nYirclT","768:YirclTH","768:irclTHg","768:rclTHgT","768:clTHgTS","768:lTHgTSW","768:THgTSW1","768:HgTSW1P","768:gTSW1Pl","768:TSW1Pln","768:SW1Pln7"],"imphash":"f8c23464dbff65d17896308ce854dd02"},"file_info":{"file_name":"bounty-86587591847718551","file_type":["peexe","executable"],"file_type_id":"exe","file_size":40448,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1560022872000,"last_seen":1682667348000,"last_multi_scan":1682667348000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["ricochetchollima","targeted"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":8,"suspicious_count":12,"malicious_count":4,"total":24},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/PSW.Agent.mrsrx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Mikey.116580","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Mikey.116580 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.RQD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004db40a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-PSW.MSIL.Agent.agbt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.RP.exdquv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanPSW.MSIL.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.1039819","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_90%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"xpm6\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ub-farm.com\"\n \"ub-farm.com:80\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"218.145.31.249:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Meetoo(funny)_920\"\n \"Meetoo(funny)_920\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ub-farm.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"7nAY with unusual entropies 7.74209824665","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"00300000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/70 reputation engines marked \"http://ub-farm.com\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /together/skin_1/data/progma.php HTTP/1.1\nHost: ub-farm.com:80\nContent-type: multipart/form-data;boundary=-----------------------------0004397000b8f\nContent-Length: 1057\" with no payload\n \"POST /together/skin_1/data/progma.php HTTP/1.1\nHost: ub-farm.com:80\nContent-type: application/x-www-form-urlencoded\nContent-Length: 22\" with no payload\n \"POST /together/skin_1/data/progma.php HTTP/1.1\nHost: ub-farm.com:80\nContent-type: multipart/form-data;boundary=-----------------------------0002369000f5c\nContent-Length: 1057\" with no payload\n \"POST /together/skin_1/data/progma.php HTTP/1.1\nHost: ub-farm.com:80\nContent-type: multipart/form-data;boundary=-----------------------------0002425001424\nContent-Length: 1057\" with no payload\n \"POST /together/skin_1/data/progma.php HTTP/1.1\nHost: ub-farm.com:80\nContent-type: multipart/form-data;boundary=-----------------------------000080c0017de\nContent-Length: 1057\" with no payload","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"3.3.3.3\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 218.145.31.249 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32.bin\" has an entrypoint in section \"7nAY\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameW\n GetProcAddress\n LoadLibraryA\n InternetOpenW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$25","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"50/69 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"50/69 Antivirus vendors marked sample as malicious (72% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"218.145.31.249\": ...\n\n URL: http://ub-farm.com/admin (AV positives: 1/70 scanned on 06/08/2019 19:43:15)\n URL: http://ub-farm.com/admin/tmp/banner.gif (AV positives: 3/66 scanned on 05/14/2019 21:29:52)\n URL: http://ub-farm.com/ (AV positives: 2/70 scanned on 05/14/2019 00:16:13)\n URL: http://ub-farm.com/together/skin_1/data/progma.php (AV positives: 1/67 scanned on 05/02/2018 12:14:31)\n URL: http://ub-farm.com/together/index.php?hno=10 (AV positives: 1/67 scanned on 03/11/2018 15:18:22)\n File SHA256: 73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8 (AV positives: 29/70 scanned on 04/29/2019 01:26:25)\n File SHA256: f5e1ced1f2c52980ce54a50212b5bc89eaa5870078a5b12e1c738857052c8978 (AV positives: 53/69 scanned on 01/09/2019 05:39:16)\n File SHA256: 142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32 (AV positives: 15/66 scanned on 01/19/2018 13:05:32)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":51,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["ricochetchollima","targeted"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"5cfc0f530288383644f401bd","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Graftor","contacted_countries":["KOR"],"submit_name":"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32","analysis_start_time":"2019-06-08T19:40:14+00:00","indicators_count":{"informative":8,"suspicious":15,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"218.145.31.249","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}],"dns_resolutions":[{"domain":"ub-farm.com","address":"218.145.31.249","ttl":21599,"country":"Korea, Republic of","registrar_name":"Gabia, Inc.","registrar_name_servers":"JRENG.UB-FARM.COM","registrar_creation_date":"2008-08-27T03:05:37+00:00","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"domain":"ub-farm.com:80","address":"218.145.31.249","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}],"http_requests":[{"host":"ub-farm.com","host_ip":"218.145.31.249:80","url":"/together/skin_1/data/progma.php","method":"POST","header":"POST /together/skin_1/data/progma.php HTTP/1.1\nHost: ub-farm.com:80\nContent-type: multipart/form-data;boundary=-----------------------------0004397000b8f\nContent-Length: 1057","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}],"processes":[{"pid":2512,"ppid":0,"name":"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32.exe","command_line":"","sha256":"142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32","normalized_path":"C:\\142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32.exe","uid":"00021645-00002512","icon":"$26"}],"all_imported_dlls":["pnrpnsp.dll","ntdll.dll","KernelBase.dll","profapi.dll","dhcpcsvc.dll","nlaapi.dll","winrnr.dll","secur32.dll","WSHTCPIP.DLL","rpcrt4.dll","winnsi.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","normaliz.dll","shell32.dll","ole32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","sechost.dll","psapi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winhttp.dll","advapi32.dll","wininet.dll","shlwapi.dll","ws2_32.dll","msvcr100.dll","NapiNSP.dll","mswsock.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","msvcrt.dll","gdi32.dll","lpk.dll","msctf.dll","webio.dll","wship6.dll","api-ms-win-downlevel-user32-l1-1-0.dll","iertutil.dll","userenv.dll","imm32.dll","dnsapi.dll","FWPUCLNT.DLL","oleaut32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rasadhlp.dll","kernel32.dll","user32.dll","usp10.dll","IPHLPAPI.DLL","nsi.dll","version.dll","sspicli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Meetoo(funny)_920","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]},{"name":"Meetoo(funny)_920","sources":[{"report_type":"sandbox","report_id":"5cfc0f530288383644f401bd"}]}]}},"report_ids":{"sandbox_job_ids":["5cfc0f530288383644f401bd"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_90% Sample 142f8cd20af1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 142f8cd20af1…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 16/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_90% Sample 142f8cd20af1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 142f8cd20af1…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 16/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/142f8cd20af1065eed8685056977b16f3e3b3c6da877abdd244f1519cd4b3b32"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_90% Sample 142f8cd20af1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 142f8cd20af1…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 16/28 AV engines flagged this file. 4 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]