24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T493,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample 594fe5e2274a… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 594fe5e2274a…. Malware family: Trojan.Agent. Threat score 100/100. 24/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b"],"about":{"@type":"SoftwareApplication","name":"275b7af66726950a895fbd74c6227cab","applicationCategory":["peexe","executable"],"identifier":"594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":24,"total":29},"behavioralIndicators":{"malicious":5,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T468,The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: 6C:07:45:3F:FD:DA:08:B8:37:07:C0:9B:82:FB:3D:15:F3:53:36:B1, see report for more information) The input sample is signed with a certificate issued by "CN=Symantec Time Stamping Services CA - G2, O=Symantec Corporation, C=US" (SHA1: 65:43:99:29:B6:79:73:EB:19:2D:6F:F2:43:E6:76:7A:DF:08:34:E4, see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 80:82:E7:FB:AA:99:C2:0E:74:DF:C7:C5:0F:FD:51:52:DA:60:55:3A, see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="c 2006 VeriSign Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F, see report for more information)26:Ta30,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsMAAA7DAcdvqGQAAAc5SURBVFhHvZcJUJT3Gca/5YYVlpuCYNYqwYMMaURNUfACm44YdKOkMWQ9logVKd5R1yPG6GhWx6iIdMSI8W6cGG+TAqIImLgFqQgaFTy4FIIS2FSx/X79Lx6pRsui034zz+zszLfv+3uffd7/fJ8ktX0hbnkRtd3hv92RmJhIzFw9nh/okWYLzdKjmKnHaroe66l6bJL02E7WYzdJj/37ehzH63HS6ukQp0f5ZqIZ/LkvtFotpaWlfNZkotstE1K9CcVNE9a1JmwqTdhfMeHwvQlliQnnMyZU35lwzzXhlWXiV0dM+KSX4hilfehe+0ASEhKYv3MXy2vrGXPmHD5pm5CWGlB8bMBqidBiAzaLhPQG7OYYsJ9lwGG6Aac/GXCeswnv9HP47a7HY/YuXKIS2uUEOp2OsrIy0hqbeKX5Hsqtu7EK7YOkcn1cLuL7Qzm7ojCrgyu2QX3wmLObgH336LSziYBPy3AeHG+xE0yePJnq6mrSz5agTs9AencskrePxUG0cvVBOWQsHlMz6Li6hJc2VOMytDUPFjnxM8D27ahDe4upVRb98MGfjGRljUKpwq5rb7yniBrrBUDU8wCkp6NWqy0mfwTwYG1tPNV4x6fTOaUaVeT/D+Bh2mkF0AmAde0EiIyMJCUlhfj4eDw9PdvrwCMAqw6euAyIx0ubgmPPyDbrPAqZm5sbgYGB+Pr6Ymtra3H4fnFiWttirRI1fAKxcnJ7ss4vzoXWptHR0Wg0mqcqRtOXaI2K4WESIzwkNF5eaMLDn3n/k3XMtc09nrUNxMXFkZOTg9FofKoKjJ9wzBhEzlqJUyEKjH36YExLe+b9T9Yx1zb3eCbAjBkzaGhooOJfMn+9J3OwRebQXaE7Mof/IbPflMsXTVM4diKU6mlu3J0Ywj//vIxbOXkUXaglq0Ymq1omu1Lousyxa4/rQEkDsRNntA3whWgeLRqGNcv0/1Em/JZMRJ3MgJo6Iq4VMfX8SvJPB9O4RUWLNpjSdyby0caTjDwho8mWGfW1zOgjMrGHHuig+BQaubuBoJEWAKSIyX1NMlaNMjYNMnY3ZOzFVE4VMh0uCKDyAlbdTORk7qtUJ7tzVtOTpdOWEb3yW3ql19Jlu0zg5zIvb76voAxa1XV9A25vWAIgbPdtEgBictt6AVAr4yjsVF6ScSmVUZcIJ0pOM6twZStE5SYVhe+EsHVoArGLjtNlmwDY8gIA6wWAn7De2jy9sN6+6ufpVWdl3AtlPAtkBhadZvX1RE7lBVMpnCh7I4jlf1zKqEV5jF6Qx4gPjby+prb9DpgBOgr7W6cX9juIQDldlnEuk3EtlvE4LeOdJ6zNrWPoqQLm5hk48U1vKje6YIzrReZvhpH56jD+Ej6ecTO/bj9Aqki9/+3709uJVDteEfZfFPafk3ErEtOfkvERgfPNFKAibINyzrD24hSMp4JEJty400PBXQ8FVe4dWTNiIcOWFNN37Q3LM5AqNsD/YfgeTn9eRvV3Yb9RAIjpfY6J5iLt/iLdrxyqIyYrl4XZn3D8wOvc/lTipwgFPzp04EznXuyK0DFh+uF2APwkE/CDmF7stcPVB9OL8Pnm36b7V5fotucKnQ4347e/Bd9tzfh/1ox6awuRB0pYV5pEceGvqUlWcSdQOOGmoNrNj0XvpbQDQKxgJ3P4xOo5Plg9c/hCt3/LlPFziU9YwWubL+DzeSMuc8twnVaK/5pbvCYewUYdyeHDzBXkfBnG7dXCiYHPAbBBHEAvifB5VDbS5epVuhdfJjjzMtqlqewI78Ha3w1lwPIs3Fdcw250DnbDs/GeV0HnVBNdN7YQtfccWy+Noa5coln3PADiDFCL8IXfOM7iW7NYf3QCaYk6vpw8BOMqdzat6sdvZ27GIS4Pq6jDWA86hFPsSdyTSulkaHhxgC3NTYTW1JBUtZKiqgCxXo5c7uNNxTh3qs7YsCOvF6HvL0cK++ox2Udn47ew8sUBCu/mkNo0h33Zg7gy34XjSb3FUTuftIx4iq/7/+8AzG9B5eXlVDet4VJLINe3KKkPsWZn9GgiNxUw1riDo/X9yMjrR/+kj1AO3oF1/z2tLijC96PUZNPl4++J2VfArrOjuFlsRZ1OyQXfID54dw2dDeWohrTxbGiGmLZtPlMvLxeNYrmY5s5387qTPmE8yxbrWZC1DH3+PBbujUO7IgH1qFRsoo7iMu5vBC/JZ9KBdWTkjqNofXcqp7qzVxeLPnYFg99cgOv95m1e2Lw9EWVmOdqKVPIaO3F9s0RNdwU7wkYyZGU+o4/v5WBVX3ae7EnYpAXYD/8Gv/kV/H5PPtvKYqgslPjhDxLnvdTMHLvh/uQDW9+OLAJoJbTVJhOSPIwJc1RMi5GY4SnxVkA3Og/V0WPc24yZ3pG3JngREBqB9cvv4RyRTNdYHZrEIKYnSMwOlpji5EpYyDBco5Itb/wf/jz/w+jTX+efav2/AcSkwnysnW9zAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790793425059,"unified_at":"2026-09-30T18:37:05.059Z","metadata":{"hashes":{"sha256":"594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b","sha1":"0c8e52805ab98d27fb6b22dc8b6f5ada5e237435","md5":"275b7af66726950a895fbd74c6227cab","sha512":"bded8de1b025e797d68ddad07e7369b4a35e5f4cc56ca65f559063f0b6656b121562e9c66b4c78000789aba2da97976da7859a26825ec6bd9b21723c020cff47","ssdeep":"1536:nLNIW39SaZTbFARlq7jC1OZstZu0TS3gEdUJCkb0FG:nLlbZTZX3BAtTS3gEdUJCkb0FG","ssdeep_chunks":["1536:nLNIW39","1536:LNIW39S","1536:NIW39Sa","1536:IW39SaZ","1536:W39SaZT","1536:39SaZTb","1536:9SaZTbF","1536:SaZTbFA","1536:aZTbFAR","1536:ZTbFARl","1536:TbFARlq","1536:bFARlq7","1536:FARlq7j","1536:ARlq7jC","1536:Rlq7jC1","1536:lq7jC1O","1536:q7jC1OZ","1536:7jC1OZs","1536:jC1OZst","1536:C1OZstZ","1536:1OZstZu","1536:OZstZu0","1536:ZstZu0T","1536:stZu0TS","1536:tZu0TS3","1536:Zu0TS3g","1536:u0TS3gE","1536:0TS3gEd","1536:TS3gEdU","1536:S3gEdUJ","1536:3gEdUJC","1536:gEdUJCk","1536:EdUJCkb","1536:dUJCkb0","1536:UJCkb0F","1536:JCkb0FG","3072:nLNIW39","3072:LNIW39S","3072:NIW39Sa","3072:IW39SaZ","3072:W39SaZT","3072:39SaZTb","3072:9SaZTbF","3072:SaZTbFA","3072:aZTbFAR","3072:ZTbFARl","3072:TbFARlq","3072:bFARlq7","3072:FARlq7j","3072:ARlq7jC","3072:Rlq7jC1","3072:lq7jC1O","3072:q7jC1OZ","3072:7jC1OZs","3072:jC1OZst","3072:C1OZstZ","3072:1OZstZu","3072:OZstZu0","3072:ZstZu0T","3072:stZu0TS","3072:tZu0TS3","3072:Zu0TS3g","3072:u0TS3gE","3072:0TS3gEd","3072:TS3gEdU","3072:S3gEdUJ","3072:3gEdUJC","3072:gEdUJCk","3072:EdUJCkb","3072:dUJCkb0","3072:UJCkb0F","3072:JCkb0FG","1536:nLlbZTZ","1536:LlbZTZX","1536:lbZTZX3","1536:bZTZX3B","1536:ZTZX3BA","1536:TZX3BAt","1536:ZX3BAtT","1536:X3BAtTS","1536:3BAtTS3","1536:BAtTS3g","1536:AtTS3gE","1536:tTS3gEd"],"imphash":"0ba0085c58cf25b4ec20f5f8d8ade889"},"file_info":{"file_name":"275b7af66726950a895fbd74c6227cab","file_type":["peexe","executable"],"file_type_id":"exe","file_size":78592,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1499295771000,"last_seen":1661791991000,"last_multi_scan":1661791991000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":24,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":13,"suspicious_count":16,"malicious_count":5,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tqYv","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Win-Trojan/Rifdoor.78592","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Dropper]/Win32.Agent.sbni","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.fjnu","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BQRG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Rifbu.RTC","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/Rifdoor.A.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.BQRG (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/Agent.RTC trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Backdoor.Win32.Rifdoor","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent.sbni","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Agent-FSC!275B7AF66726","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dwn.ealytx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Mauvaise.SL1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Agent-AQHL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Backdoor.Trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_RIFEL.AA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_RIFEL.AA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Dnldr19.BSZF","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"TrojanDropper.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKDCRTD.Win32.9160","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00128687-00002268-63359-157-013833C9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00128687-00002268-63359-219-0138788F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00128687-00002268-2752-157-013833C9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00128687-00002268-2752-219-0138788F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00131546-00002232-7214-157-000D33C9\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00131546-00002232-7214-219-000D788F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00131546-00002232-11656-219-000D788F\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00131546-00002232-11656-157-000D33C9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"165.194.123.67:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"E:\\Data\\My Projects\\Troy Source Code\\tcp1st\\rifle\\Release\\rifle.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"MUTEX394039_4830023\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"KERNEL32.DLL\" at base 76DA0000\n \"\" loaded module \"OLE32.DLL\" at base 769D0000\n \"\" loaded module \"CRYPTBASE.DLL\" at base 74F80000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 73DB0000\n \"\" loaded module \"PROPSYS.DLL\" at base 73DF0000\n \"\" loaded module \"COMCTL32.DLL\" at base 73EF0000\n \"\" loaded module \"OLEAUT32.DLL\" at base 75380000\n \"\" loaded module \"ADVAPI32.DLL\" at base 76C60000\n \"\" loaded module \"SHELL32.DLL\" at base 75B30000\n \"\" loaded module \"CLBCATQ.DLL\" at base 759C0000\n \"\" loaded module \"%WINDIR%\\SYSTEM32\\PROPSYS.DLL\" at base 73DF0000\n \"\" loaded module \"NTMARTA.DLL\" at base 745C0000\n \"\" loaded module \"API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL\" at base 77040000\n \"\" loaded module \"PROFAPI.DLL\" at base 75030000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"SystemFunction036@CRYPTBASE.dll\"\n \"PSCreateMemoryPropertyStore@PROPSYS.dll\"\n \"PSPropertyBag_WriteDWORD@PROPSYS.dll\"\n \"PSPropertyBag_ReadDWORD@PROPSYS.dll\"\n \"RegEnumKeyW@ADVAPI32.dll\"\n \"PSPropertyBag_ReadBSTR@PROPSYS.dll\"\n \"PSPropertyBag_ReadStrAlloc@PROPSYS.dll\"\n \"OpenThreadToken@ADVAPI32.dll\"\n \"GetCatalogObject@CLBCatQ.DLL\"\n \"GetCatalogObject2@CLBCatQ.DLL\"\n \"DllGetClassObject@PROPSYS.dll\"\n \"DllCanUnloadNow@PROPSYS.dll\"\n \"InitializeSecurityDescriptor@ADVAPI32.dll\"\n \"SetEntriesInAclW@ADVAPI32.dll\"\n \"GetMartaExtensionInterface@ntmarta.dll\"\n \"SetSecurityDescriptorDacl@ADVAPI32.dll\"\n \"IsTextUnicode@ADVAPI32.dll\"\n \"ConvertSidToStringSidW@sechost.dll\"\n \"RegOpenKeyExW@ADVAPI32.dll\"\n \"RegGetValueW@ADVAPI32.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c del /q \"Z:\\275b7af66726950a895fbd74c6227cab.exe\" >> NUL\" on 2016-03-10.21:21:19","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c del /q \"Z:\\275b7af66726950a895fbd74c6227cab.exe\" >> NUL\" (UID: 00174421-00002620)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$25","origin":"Certificate Data","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Contains ability to lookup the windows account name","description":"GetUserNameExW@SSPICLI.DLL at 00128687-00002268-76F4228D-172018\n LookupAccountNameLocalW@SECHOST.DLL at 00128687-00002268-76F4228D-174017\n GetUserNameA@ADVAPI32.DLL at 00128687-00002268-63359-162-013819A0\n GetUserNameA@ADVAPI32.DLL at 00128687-00002268-2752-162-013819A0\n GetUserNameA@ADVAPI32.DLL at 00131546-00002232-7214-162-000D19A0\n GetUserNameA@ADVAPI32.DLL at 00131546-00002232-11656-162-000D19A0","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"guifx.exe.131312\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://ocsp.thawte.com0\"\n Pattern match: \"http://crl.thawte.com/ThawteTimestampingCA.crl0\"\n Pattern match: \"http://ts-ocsp.ws.symantec.com07\"\n Pattern match: \"http://ts-aia.ws.symantec.com/tss-ca-g2.cer0\"\n Pattern match: \"http://ts-crl.ws.symantec.com/tss-ca-g2.crl0\"\n Pattern match: \"https://www.verisign.com/rpa\"\n Pattern match: \"http://sf.symcb.com/sf.crl0f\"\n Pattern match: \"https://d.symcb.com/cps0%\"\n Pattern match: \"https://d.symcb.com/rpa0\"\n Pattern match: \"http://sf.symcd.com0&\"\n Pattern match: \"http://sf.symcb.com/sf.crt0\"\n Pattern match: \"https://www.verisign.com/cps0*\"\n Pattern match: \"https://www.verisign.com/rpa0\"\n Pattern match: \"http://logo.verisign.com/vslogo.gif04\"\n Pattern match: \"http://crl.verisign.com/pca3-g5.crl04\"\n Pattern match: \"http://ocsp.verisign.com0\"\n Pattern match: \"http://www.initech.com0\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Sets the process error mode to suppress error box","description":"\"\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","relevance":8,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00128687-00002268-63359-12-01382D39\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00128687-00002268-63359-33-01384555\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00128687-00002268-63359-385-01386E85\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00128687-00002268-2752-12-01382D39\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00128687-00002268-2752-33-01384555\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00128687-00002268-2752-385-01386E85\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00131546-00002232-7214-12-000D2D39\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00131546-00002232-7214-33-000D4555\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00131546-00002232-7214-385-000D6E85\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00131546-00002232-11656-12-000D2D39\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00131546-00002232-11656-33-000D4555\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00131546-00002232-11656-385-000D6E85","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"guifx.exe\" sleeping for \"10800000\" milliseconds","origin":"API Call","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates/touches files in windows directory","description":"\"\" created file \"C:\\Windows\\Globalization\\Sorting\\sortdefault.nls\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db\"\n \"\" created file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db\"\n \"\" created file \"C:\\windows\\system32\\cmd.exe\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"guifx.exe.131312\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"\" (Access type: \"CREATE\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"\" (Access type: \"SETVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\", Key: \"GRAPHICS\", Value: \"\"%ALLUSERSPROFILE%\\Graphics\\guifx.exe\" /run\")","origin":"Registry Access","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"165.194.123.67\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to elevate privileges","description":"SetEntriesInAclW@ADVAPI32.DLL at 00128687-00002268-76F4228D-168751\n SetSecurityDescriptorDacl@ADVAPI32.DLL at 00128687-00002268-76F4228D-169017","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-44","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"\" (Access type: \"DELETEVAL\", Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"\" (Access type: \"DELETEVAL\", Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\", Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"ALWAYSSHOWEXT\")\n \"\" (Access type: \"QUERYVAL\", Path: \"HKCR\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\", Key: \"NEVERSHOWEXT\")","origin":"Registry Access","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"guifx.exe\" claimed CRC 84102 while the actual is CRC 79939","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"connect (Ordinal #4)\n WSAStartup (Ordinal #115)\n recv (Ordinal #16)\n socket (Ordinal #23)\n closesocket (Ordinal #3)\n send (Ordinal #19)\n RegCloseKey\n GetUserNameA\n RegOpenKeyExA\n RegCreateKeyA\n ShellExecuteA\n LoadLibraryW\n CreateFileW\n GetComputerNameA\n CreateFileA\n GetFileSize\n GetTickCount\n WriteFile\n GetCommandLineA\n Sleep\n CreateProcessA\n TerminateProcess\n CreateDirectoryA\n GetModuleFileNameA\n GetVersionExA\n WinExec\n GetTempPathA\n GetStartupInfoW\n UnhandledExceptionFilter\n IsDebuggerPresent\n GetProcAddress\n GetModuleHandleW\n GetModuleFileNameW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\", Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"37/56 Antivirus vendors marked sample as malicious (66% detection rate)\n 17/43 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"37/56 Antivirus vendors marked sample as malicious (66% detection rate)\n 17/43 Antivirus vendors marked sample as malicious (39% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00000088 bytes of memory in \"cmd.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 78592 bytes starting with PE header signature to file \"%ALLUSERSPROFILE%\\Graphics\\guifx.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"guifx.exe\" (PID: 00002232)\n \"\" wrote 52 bytes to a foreign process \"guifx.exe\" (PID: 00002232)\n \"\" wrote 4 bytes to a foreign process \"guifx.exe\" (PID: 00002232)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":15,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Sample not shared"],"sandbox_reports":[{"id":"56e2550faac2ed347f9a275e","environment_id":1,"environment_description":"Windows 7 32 bit - Usermode Monitor","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.GenericKD","contacted_countries":["KOR"],"submit_name":"275b7af66726950a895fbd74c6227cab","analysis_start_time":"2016-03-10T23:18:31+00:00","indicators_count":{"informative":13,"suspicious":17,"malicious":6},"tags":["Network Traffic","Extracted Files","Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"165.194.123.67","port":443,"protocol":"TCP","country":"Korea Republic of","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}],"processes":[{"pid":2268,"ppid":0,"name":"275b7af66726950a895fbd74c6227cab.exe","command_line":"","normalized_path":"","uid":"00128687-00002268","icon":"$26"},{"pid":2232,"ppid":0,"name":"guifx.exe","command_line":"/run","normalized_path":"","uid":"00131546-00002232"},{"pid":2620,"ppid":0,"name":"cmd.exe","command_line":"/c del /q \"Z:\\275b7af66726950a895fbd74c6227cab.exe\" >> NUL","normalized_path":"","uid":"00174421-00002620"}],"all_imported_dlls":["WS2_32.dll","profapi.dll","GDI32.dll","SHELL32.dll","CFGMGR32.dll","MSASN1.dll","IMM32.DLL","davclnt.dll","DNSAPI.dll","ADVAPI32.dll","OLEAUT32.dll","uxtheme.dll","pnrpnsp.dll","CRYPTBASE.dll","drprov.dll","WINBRAND.dll","NLAapi.dll","winrnr.dll","SspiCli.dll","LPK.dll","ntmarta.dll","rasadhlp.dll","MPR.dll","netutils.dll","mswsock.dll","ntdll.dll","MSCTF.dll","sechost.dll","DEVOBJ.dll","wshtcpip.dll","VERSION.dll","PROPSYS.dll","iertutil.dll","PSAPI.DLL","SETUPAPI.dll","apphelp.dll","fwpuclnt.dll","USP10.dll","ntlanman.dll","comctl32.dll","wkscli.dll","urlmon.dll","CRYPT32.dll","KERNELBASE.dll","CLBCatQ.DLL","NSI.dll","msvcrt.dll","ole32.dll","IPHLPAPI.DLL","USER32.dll","RPCRT4.dll","WININET.dll","cscapi.dll","WINNSI.DLL","kernel32.dll","napinsp.dll","SHLWAPI.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"guifx.exe","sha256":"27db539d948a50d5bfeeeb5ee99b7f42da28f5a3263e66ad60bcc3cee7442def","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}],"files_written":[{"path":"%ALLUSERSPROFILE%\\Graphics","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%SAMPLEDIR%\\275b7af66726950a895fbd74c6227cab.exe","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%ALLUSERSPROFILE%\\Graphics\\guifx.exe","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"%WINDIR%\\system32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"PIPE\\DAV RPC SERVICE","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"path":"NUL","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]},{"name":"MUTEX394039_4830023","sources":[{"report_type":"sandbox","report_id":"56e2550faac2ed347f9a275e"}]}]}},"report_ids":{"sandbox_job_ids":["56e2550faac2ed347f9a275e"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Agent Sample 594fe5e2274a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 594fe5e2274a…. Malware family: Trojan.Agent. Threat score 100/100. 24/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample 594fe5e2274a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 594fe5e2274a…. Malware family: Trojan.Agent. Threat score 100/100. 24/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/594fe5e2274a7944b461dae3919adb25b202488596f855932be1209cb0d9ca0b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample 594fe5e2274a… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 594fe5e2274a…. Malware family: Trojan.Agent. Threat score 100/100. 24/29 AV engines flagged this file. 5 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]