26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T503,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Msoffice/malicious_confidence_100% Sample af5fb99d3ff1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample af5fb99d3ff1…. Malware family: Msoffice/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf","keywords":["Malicious","Msoffice/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf"],"about":{"@type":"SoftwareApplication","name":"21031 ★서울 용산 이태원사고 대처상황(18시).docx","applicationCategory":["docx","office"],"identifier":"af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Msoffice/malicious_confidence_100%","antivirusDetections":{"malicious":11,"total":28},"behavioralIndicators":{"malicious":2,"suspicious":4},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4a8,"\Sessions\1\BaseNamedObjects\Local\SM0:3168:304:WilStaging_02" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\CSI_WDW:{89BA7625-A8B1-459B-B530-E1E9BC04E7CE}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5821B369" "Local\SM0:3168:304:WilStaging_02" "Local\CSI_WDW:{7C0128AA-5086-48F7-A31E-FDF61890F38A}" "Local\SM0:3168:120:WilError_01" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-525A4CCD" "Local\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CC8C5001" "Local\x64_10MU_ACB10_S-1-5-5-0-155713" "Global\MsoCsi:GC:C:/Users/oHPAcSC/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF" "Local\CSI_WDW:{E27C2E80-E9FD-440D-BBDC-4961A4E5EC05}" "Local\CSI_WDW:{BCCBB001-AC1E-47C3-BB40-E5F47F711218}" "Global\MsoCsi:GC:C:/Users/oHPAcSC/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF" "{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A1EF00DF" "Local\CSI_OMTX:{BCCBB001-AC1E-47C3-BB40-E5F47F711218}" "Global\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001" "Local\CSI_WDW:{207801F2-FEEE-499B-B4D0-97C923D4D688}" "Local\ZonesCacheCounterMutex"28:Tdd0,"21031____18_.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Wed Nov 2 08:07:17 2022 mtime=Wed Nov 2 08:07:17 2022 atime=Wed Nov 2 08:07:33 2022 length=109188 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\21031____18_.LNK]- [targetUID: 00000000-00003168] "~_031____18_.docx" has type "data"- [targetUID: 00000000-00003168] "~WRS_A7B6D753-68FA-496A-8044-1C8865412E30_.tmp" has type "data"- [targetUID: 00000000-00003168] "F345BF02.png" has type "PNG image data 203 x 148 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\F345BF02.png]- [targetUID: 00000000-00003168] "18F2CC69.png" has type "PNG image data 446 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\18F2CC69.png]- [targetUID: 00000000-00003168] "~WRS_0976F56C-4D0E-4972-87CB-164077386C39_.tmp" has type "dBase III DBT version number 0 next free block index 13"- [targetUID: 00000000-00003168] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00003168] "FSF-_0E1EEE64-E8C6-4E2A-9759-63CF07FD8988_.FSF" has type "data"- [targetUID: 00000000-00003168] "82A075BD.jpeg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 144x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\82A075BD.jpeg]- [targetUID: 00000000-00003168] "A2AF0BD3.jpeg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 204x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\A2AF0BD3.jpeg]- [targetUID: 00000000-00003168] "B41B0C08.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\B41B0C08.png]- [targetUID: 00000000-00003168] "7B56086A.png" has type "PNG image data 446 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\7B56086A.png]- [targetUID: 00000000-00003168] "A0393660.jpeg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 96x96 segment length 16 baseline precision 8 206x159 components 3"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\A0393660.jpeg]- [targetUID: 00000000-00003168] "~WRS_7108B9C8-FB15-4BBF-98F2-4010DB287F38_.tmp" has type "data"- [targetUID: 00000000-00003168] "F8073756.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\F8073756.png]- [targetUID: 00000000-00003168] "4D3453C5.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\4D3453C5.png]- [targetUID: 00000000-00003168] "_FDF7311B-C6FF-4977-8A1C-4809CDE24B51_" has type "data"- [targetUID: 00000000-00003168] "AEEBC63E.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\AEEBC63E.png]- [targetUID: 00000000-00003168] "5F890CD.png" has type "PNG image data 52 x 87 8-bit/color RGBA non-interlaced"- Location: [%LOCALAPPDATA%\Microsoft\Windows\INetCache\Content.MSO\5F890CD.png]- [targetUID: 00000000-00003168] "~WRD0001.tmp" has type "Microsoft Word 2007+"- Location: [C:\~WRD0001.tmp]- [targetUID: 00000000-00003168]29:T941,"OPTIONS /templates-for-word/ HTTP/1.1 User-Agent: Microsoft Office Protocol Discovery Host: ms-offices.com Content-Length: 0 Connection: Keep-Alive" "HTTP/1.1 302 Found Date: Wed, 02 Nov 2022 08:08:45 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://templates.office.com Content-Length: 293 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 302 Found

Found

The document has moved here.

Apache/2.4.41 (Ubuntu) Server at ms-offices.com Port 443

" "HEAD /templates-for-word/download?id=TYV6YAYWOPEKI61Y HTTP/1.1 Connection: Keep-Alive User-Agent: Microsoft Office Existence Discovery Host: ms-offices.com" "HTTP/1.0 500 Internal Server Error Date: Wed, 02 Nov 2022 08:08:46 GMT Server: Apache/2.4.41 (Ubuntu) Connection: close Content-Type: text/html; charset=UTF-8" "OPTIONS / HTTP/1.1 Connection: Keep-Alive User-Agent: DavClnt translate: f Host: ms-offices.com" "HTTP/1.1 302 Found Date: Wed, 02 Nov 2022 08:09:02 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://templates.office.com Content-Length: 293 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 302 Found

Found

The document has moved here.

Apache/2.4.41 (Ubuntu) Server at ms-offices.com Port 443

" "HTTP/1.1 302 Found Date: Wed, 02 Nov 2022 08:09:17 GMT Server: Apache/2.4.41 (Ubuntu) Location: https://templates.office.com Content-Length: 293 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 302 Found

Found

The document has moved here.

Apache/2.4.41 (Ubuntu) Server at ms-offices.com Port 443

" "HTTP/1.0 500 Internal Server Error Date: Wed, 02 Nov 2022 08:09:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8"2a:Ta60,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAHjUlEQVR42s2X+2+T5xXH+wc42TSp2gqsdBstLWtWrdLWaRvttlbrqhZUykoZo4ymIW0Yl3XpSi8SascGlADhUkjI/eYkjnOHOOROSCjEy/1CLk58iS+xncSxE4fE9uv3u/M8r21iRpWo2g99pa8SkOzv53vOc87z5oEHvqlPRVMPlqq8sRtlDV1cpfVdKKnrQDFTTQeUNe0ouvofKKrVKCQVqNpIt5BPP595NQ4bt8TiawGs9BFFUvAnye8HBJK86hbij6ZxiF9ujl4eIupgKaL2lyFqXymePkC/xynx5LtF2LBHgQ1vF+CJt+R4fFce1u/MwWM7svHo9kys25YeMubmSwDyrnwJkwPYvv/I8hA/IfNdZ5rR0GuBY85DXyauKP2Ptqbe19xHyq1s5QCjVh82/vGvXw0RFTCfml3Eog+Ymgd008BtK9BnBnpMQJcB6GDSS2L/Zs8PX70UDkC/BAGyyq+HALq18/jZppj7Q7CyN/SaufnoFGlSxLBVxACZdzIzvYhOLaDWAG0aEe1j9P86kff90S13AYrUc2HKLG1eAuBGS78DT734l/+FiNpXwsvOkss+vQ3Z0WHE19vhmPdjfaIGEYe6EV+sx8dKHSL+3IDI11T49suVWPQI+MWu7FB6ZsqeGbcPg0Y30kua0NQ7hbpOO6rUEyhtNUHRaAhB3AXYq+Q911PZY8utkH2uwRsVNswtilh7UgPZRz3YnDyMxoEZRO5sROTWahyTD8FLdX5qW1oYwB2Pn86BiLbBSaQXNyL6Hyfx5nvHsW3vZ9gU/RFe2PEefvVaHIcIAbCTzh7W8/Q2N2THRvBs9jjmPSJVZACyD7vx4PvtWPAKeP7Tbl6BvjEnBAFY98rFMACWXD00Bee8D0XXTShoNkLeNA55nTak3HpdOMCPYxUcoN8sHTDWhifPj6KZ+ib7pBcR73fge/FqaKzzeGh3EyK3qHj5mfHa358NA5A321DYYkVOowWny7S4dNWIz7I7MbcgwnXHjxlqa3bdPQAbYgo5ADvtbXTAZNRz2Yc9eO6LEcjiOyDb34ZvvdOKzSco/bYaRMU0YH5B4J9Z83xiGMBxxTDOVeqQWmPGuQo9LlWbOMDsHRFOAnDM+ZFZawgHeCI6n38ZG62bI8CvTwxB9jc1ZAfUeORQB1KaLPjO29cQ+adaXv4zyhGMmvz8M6t/e5qbs9FjACx5QcsE8pomcP7yOJJUEoCLAGbcfkwTQFrNvQC78/iXsfJ/OQx8UGBBRGwrIva04JnD7VQ+Aat2E8BWFSI3VWLYMIuqm9KiWvObU6Hlw4y+Ss55EQ4CmJr1I6V6PBxg/c5cCYAqcIMAUmpciHizkY/cu0n9sDkEPLS9DpGvVOK7BLBA/c9SSQCrnz0pLR5BhJfk8YlY9Io0DSLcNEVzC37ee2Y+TeZ2lx8Xq0zhAI/tyApVgAFUtfv4qLHEB5P6YLILWE9AkS+W4vE3quC+IyDtigSwamMCFOy0XxtHHs14Tr0eWbU6pF8dQ6pqFMlXNLh4eYSX3u4SYHUKOHfZHA7ALpXQGaBt19QHVHcAKrWI8hsi8mpFJFeATIEMFbh5ciVCACz10uTzS5IH+z5J6a1OPyxUzcSKewDWvZ6Or/swgGDyzFptePLKYXxRPoRzZYOwUfqJGT9M0wISyizhAOxGY5fKDzYn4RFaLGtfuoCH/3AeD9OMf/+FM1jzu0R+2lc/dwqrqOfMdKmCqaWeS/PupHmfdkvJJXOBm49PCThWag0HuN+TWXqdNp/IVdFmRdnNCZTcsEDZYkbhdSPyAz3PDiRPo+QpPPlIKPnZ0kEkltzGaeUAzFR6I5nr7D4cUdqWB8igm4yt4pAWw+WmHrO0TLOBfrPUjlDPhbvJHSy5D3oyH6Ob8bBicgUAxdfoMvLzwxRKTns9n/Z6boOBr9PMGkpeHZ78/JLkpyh5QlE/ThT2SeY2HzQTPnxcML08QJqyiW8vlmyp2EJhSZnYCWerlSWempXGzOaUUrOS855PsrILPPkImQ+ZvfhAvgKA1KJGfnEwk8LAjRZMnhFMXqVBEs34hYolyYsDyRX9+LywF8fze3FU3hMyv2304u+5M8sDpCgaeDKeLpBwMjDPduov22g2l58vFpbYEkhsJBkmpcPGSs7ehoYtXgyaJPO+cS8O5jiXB0gurJdK6hJCpWVihlaa56BpsNTshBtICYo+nvxYfg9P/q+8bhzJ7cIAmfcavOjWe7Evy7UCgII6bsKNZnwkgcs8LRkGTVmPDXapz1q7lJgdtBGWmko+YJJS9xg83LxT50VcxuzyAEn5dXx8TNM+yZDGyEhihuOTNFIkVmad7W6pRya83HiIlZvUP+5BH6XuIeMunQcdWg/Uox7Eps8tD3BRXst7GZQ+0FdmqA2ZejEaSDscSMyNA73u1XvojdpDb9QeepOWzG9pPIhJc68MgJW1tUOH6htjKG7QIueqli4hI87QbRbU6UozEsotOF42gX+X2PDPYjsOF03SrE/RuDn4iT+Q7cJe6vs7GXOIofTRqSsAuJBXg7hPzuLl3Yf4W+zPN+3BT196i3/w/6VvxF/h/wUEhERwDDVFQQAAAABJRU5ErkJggg==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790791012699,"unified_at":"2026-09-30T17:56:52.699Z","metadata":{"hashes":{"sha256":"af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf","sha1":"06f08afb839b200a6fd9647e555e19589bd042ce","md5":"efb436b430520d36a1796aebcc97664b","sha512":"83ffec51ef85eb1231bac15a359a53a6b3f3684ab5f3f395ff73f98641d0738adad661b3f155c41970752071838a4accae76730c89d943cd5bfda40465b37bf7","ssdeep":"1536:/4Xwex+UMWOFsCCGAIU/zkxTxzwA14n/pId0gt4ZTva4HIX2NVp2IwHJhZ49G:c50UXl8AzEzz4n/pilt44MIX2vp2I8J","ssdeep_chunks":["1536:/4Xwex+","1536:4Xwex+U","1536:Xwex+UM","1536:wex+UMW","1536:ex+UMWO","1536:x+UMWOF","1536:+UMWOFs","1536:UMWOFsC","1536:MWOFsCC","1536:WOFsCCG","1536:OFsCCGA","1536:FsCCGAI","1536:sCCGAIU","1536:CCGAIU/","1536:CGAIU/z","1536:GAIU/zk","1536:AIU/zkx","1536:IU/zkxT","1536:U/zkxTx","1536:/zkxTxz","1536:zkxTxzw","1536:kxTxzwA","1536:xTxzwA1","1536:TxzwA14","1536:xzwA14n","1536:zwA14n/","1536:wA14n/p","1536:A14n/pI","1536:14n/pId","1536:4n/pId0","1536:n/pId0g","1536:/pId0gt","1536:pId0gt4","1536:Id0gt4Z","1536:d0gt4ZT","1536:0gt4ZTv","1536:gt4ZTva","1536:t4ZTva4","1536:4ZTva4H","1536:ZTva4HI","1536:Tva4HIX","1536:va4HIX2","1536:a4HIX2N","1536:4HIX2NV","1536:HIX2NVp","1536:IX2NVp2","1536:X2NVp2I","1536:2NVp2Iw","1536:NVp2IwH","1536:Vp2IwHJ","1536:p2IwHJh","1536:2IwHJhZ","1536:IwHJhZ4","1536:wHJhZ49","1536:HJhZ49G","3072:/4Xwex+","3072:4Xwex+U","3072:Xwex+UM","3072:wex+UMW","3072:ex+UMWO","3072:x+UMWOF","3072:+UMWOFs","3072:UMWOFsC","3072:MWOFsCC","3072:WOFsCCG","3072:OFsCCGA","3072:FsCCGAI","3072:sCCGAIU","3072:CCGAIU/","3072:CGAIU/z","3072:GAIU/zk","3072:AIU/zkx","3072:IU/zkxT","3072:U/zkxTx","3072:/zkxTxz","3072:zkxTxzw","3072:kxTxzwA","3072:xTxzwA1","3072:TxzwA14","3072:xzwA14n","3072:zwA14n/","3072:wA14n/p","3072:A14n/pI","3072:14n/pId","3072:4n/pId0","3072:n/pId0g","3072:/pId0gt","3072:pId0gt4","3072:Id0gt4Z","3072:d0gt4ZT","3072:0gt4ZTv","3072:gt4ZTva","3072:t4ZTva4","3072:4ZTva4H","3072:ZTva4HI","3072:Tva4HIX","3072:va4HIX2","3072:a4HIX2N","3072:4HIX2NV","3072:HIX2NVp","3072:IX2NVp2","3072:X2NVp2I","3072:2NVp2Iw","3072:NVp2IwH","3072:Vp2IwHJ","3072:p2IwHJh","3072:2IwHJhZ","3072:IwHJhZ4","3072:wHJhZ49","3072:HJhZ49G","1536:c50UXl8","1536:50UXl8A","1536:0UXl8Az","1536:UXl8AzE","1536:Xl8AzEz","1536:l8AzEzz","1536:8AzEzz4","1536:AzEzz4n","1536:zEzz4n/","1536:Ezz4n/p","1536:zz4n/pi","1536:z4n/pil","1536:4n/pilt","1536:n/pilt4","1536:/pilt44","1536:pilt44M","1536:ilt44MI","1536:lt44MIX","1536:t44MIX2","1536:44MIX2v","1536:4MIX2vp","1536:MIX2vp2","1536:IX2vp2I","1536:X2vp2I8","1536:2vp2I8J"],"imphash":"Unknown"},"file_info":{"file_name":"21031 ★서울 용산 이태원사고 대처상황(18시).docx","file_type":["docx","office"],"file_type_id":"docx","file_size":109188,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1667376200000,"last_seen":1682459898000,"last_multi_scan":1682459898000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":4},"sandbox_signatures":{"informative_count":13,"suspicious_count":4,"malicious_count":2,"total":19},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/XML.Exernal","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"EXP/TempInj.T","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.63304756","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.63304756 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Downloader.MSOffice.Agent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.dvx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Exploit.Xml.CVE-2017-0199.equmby","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-AGTB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.49CCAC41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.49CCAC41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Msoffice/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Decrypted SSL network traffic"}],"sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"}],"sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}],"sandbox_signatures":[{"level":"informative","category":"General","name":"Contacts server","description":"\"108.166.183.161:443\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$27","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_031____18_.docx\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"\"OPTIONS /templates-for-word/ HTTP/1.1\nUser-Agent: Microsoft Office Protocol Discovery\nHost: ms-offices.com\nContent-Length: 0\nConnection: Keep-Alive\" (Indicator: \"user-agent: \")\n \"HEAD /templates-for-word/download?id=TYV6YAYWOPEKI61Y HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Microsoft Office Existence Discovery\nHost: ms-offices.com\" (Indicator: \"user-agent: \")\n \"OPTIONS / HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: DavClnt\ntranslate: f\nHost: ms-offices.com\" (Indicator: \"user-agent: \")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 5C260000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ms-offices.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops LNK files (Windows shortcut)","description":"\"21031____18_.LNK\" has type \"MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Wed Nov 2 08:07:17 2022 mtime=Wed Nov 2 08:07:17 2022 atime=Wed Nov 2 08:07:33 2022 length=109188 window=hide\"- Location: [%APPDATA%\\Microsoft\\Office\\Recent\\21031____18_.LNK]- [targetUID: 00000000-00003168]","origin":"Binary File","relevance":5,"id":"binary-31","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$29","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://ms-offices.com/templates-for-word/download?id=TYV6YAYWOPEKI61Y\"\n Heuristic match: \"s,9{'L@,eonV 4u72.Ba\"\n Heuristic match: \"jh6Had<11a 6BO|>dI@qX\\\\>.cf\"\n Heuristic match: \"ms-offices.com\"\n Pattern match: \"https://templates.office.com\"\n Heuristic match: \"HEAD /templates-for-word/download?id=TYV6YAYWOPEKI61Y HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Microsoft Office Existence Discovery\nHost: ms-offices.com\"\n Heuristic match: \"OPTIONS / HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: DavClnt\ntranslate: f\nHost: ms-offices.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://ms-offices.com/templates-for-word/download?id=TYV6YAYWOPEKI61Y\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"\"HTTPS traffic to 108.166.183.161 on port 443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"21031____18_.LNK\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\21031____18_.LNK]- [targetUID: 00000000-00003168]\n Dropped file: \"index.dat\" - Location: [%APPDATA%\\Microsoft\\Office\\Recent\\index.dat]- [targetUID: 00000000-00003168]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://ms-offices.com\" as malicious (15% detection rate)\n 4/90 reputation engines marked \"https://ms-offices.com/templates-for-word/download\" as malicious (4% detection rate)\n 10/90 reputation engines marked \"https://ms-offices.com\" as malicious (11% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/64 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"bsa@3btfr.j788ivjz\"\n Pattern match: \"r5@dby.f4bp\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 108.166.183.161 on port 443 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/64 Antivirus vendors marked sample as malicious (26% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}],"incidents":[{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":56,"imported_dlls_count":144,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":37,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6362243d5383a8326c4772c5","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"CVE-2017-0199","contacted_countries":["USA"],"submit_name":"21031 ★서울 용산 이태원사고 대처상황(18시).docx","analysis_start_time":"2022-11-02T08:03:09+00:00","indicators_count":{"informative":13,"suspicious":4,"malicious":2},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"108.166.183.161","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}],"dns_resolutions":[{"domain":"ms-offices.com","address":"108.166.183.161","ttl":21600,"country":"United States","registrar_name":"NetEarth One, Inc.","registrar_organization":"Kingsoft Office","registrar_name_servers":"NS13.SHARED-SERVERS.COM","registrar_creation_date":"2022-10-24T03:42:54+00:00","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}],"processes":[{"pid":3168,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\21031____18_.docx\"","sha256":"007b8c7a282521d8981386fb31abda08f3710239c7bb83d8da3b5a9826ebe246","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00003168","icon":"$2a"}],"all_imported_dlls":["SHCore.dll","dwmapi.dll","cryptsp.dll","ntasn1.dll","GdiPlus.dll","winmmbase.dll","fltLib.dll","dpapi.dll","TextInputFramework.dll","msproof7.dll","msvcp_win.dll","bcrypt.dll","version.dll","coml2.dll","clbcatq.dll","schannel.dll","winmm.dll","msvcrt.dll","gdi32.dll","winsta.dll","hlink.dll","msvcp110_win.dll","ntdll.dll","cfgmgr32.dll","IPHLPAPI.DLL","OSPPC.DLL","imagehlp.dll","d3d11.dll","srvcli.dll","cldapi.dll","ntmarta.dll","rmclient.dll","MSGR3EN.DLL","urlmon.dll","Csi.dll","winhttp.dll","FWPUCLNT.DLL","ncrypt.dll","GFX.DLL","VxSSL64.dll","dhcpcsvc6.dll","wininet.dll","oleacc.dll","RICHED20.DLL","aepic.dll","dcomp.dll","sechost.dll","MSO.DLL","OnDemandConnRouteHelper.dll","winnsi.dll","mscss7en.dll","shlwapi.dll","oleaut32.dll","ninput.dll","uxtheme.dll","iertutil.dll","combase.dll","gdi32full.dll","sfc_os.dll","secur32.dll","davhlpr.dll","AcGenral.dll","policymanager.dll","ntshrui.dll","win32u.dll","msxml6r.dll","msIso.dll","mskeyprotect.dll","WindowsCodecs.dll","cscapi.dll","MSSP7EN.DLL","apphelp.dll","rpcrt4.dll","cryptbase.dll","mswsock.dll","edputil.dll","msctf.dll","user32.dll","ws2_32.dll","rsaenh.dll","msvcp90.dll","NL7MODELS0009.dll","windows.storage.dll","ncryptsslp.dll","CoreMessaging.dll","twinapi.appcore.dll","AcSpecfc.dll","userenv.dll","drprov.dll","ntlanman.dll","davclnt.dll","mlang.dll","ALRTINTL.DLL","ucrtbase.dll","netutils.dll","linkinfo.dll","CSS7DATA0009.DLL","powrprof.dll","srpapi.dll","netprofm.dll","dnsapi.dll","winnlsres.dll","DataExchange.dll","dxgi.dll","bcryptprimitives.dll","crypt32.dll","WinTypes.dll","shell32.dll","profapi.dll","mpr.dll","msasn1.dll","dhcpcsvc.dll","normaliz.dll","CoreUIComponents.dll","OART.DLL","msi.dll","kernel.appcore.dll","msimg32.dll","ShellPreviewHandler3D.dll","netapi32.dll","sspicli.dll","imm32.dll","wtsapi32.dll","mscoreei.dll","npmproxy.dll","psapi.dll","rasadhlp.dll","KernelBase.dll","comctl32.dll","mscoree.dll","propsys.dll","wintrust.dll","wkscli.dll","msvcr90.dll","webio.dll","MSPTLS.DLL","kernel32.dll","ole32.dll","sxs.dll","advapi32.dll","WWLIB.DLL","rpcss.dll","msxml6.dll","USP10.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_031____18_.docx","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"21031____18_.LNK","sha256":"25b67f0c1309ae10f2b7fc7eb145a27dd2da3964451391650148053fb923b281","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"index.dat","sha256":"4ebc61d8915a11fb068e99f827c267caad83a69e5e685d9cdde9cfa6daa4340e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"FSD-CNRY.FSD","sha256":"3b90b8cb397461158c2080937eb36a449792bfe8ace85c1bc7433c756e3c8b95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"1084489A.jpeg","sha256":"dbc776ca7974c961efba5ff0d92c151a56bf2280e05ff745dd52d80710498a91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"18F2CC69.png","sha256":"5a05fcd297a418d6474648300fb86968a8a7c1c9598def4a29c0043f731c3cc5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"248D8CFC.png","sha256":"72e38f7f20b9c87e77acf378d53844c9a6dfe2a3718cce32d2bc3440f1d48b7b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"2934ABB8.png","sha256":"6140274ba45383a28cddfe3b4da0b39e7031e376f6119a0f470e46b45783c58c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"298FD5D4.png","sha256":"4c2369df502d28e27437fa37adb9ac2b11d6a216539ff826fd381ff718c762a8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"2F03C527.png","sha256":"ca814f9317e91b03dc0a1c6e04ada4f560781e3c6af211a62716fa69e07cd109","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"39D4E286.png","sha256":"23988023db44aad05a19e07fed501d8d48e3b2d9cb70a5093b82a3a79f9a0d5c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"3A7339AC.jpeg","sha256":"9e10e5bf75c0409ac9f9d5bee32a73a8c84bff76b86c4336dab7f5943815d120","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"3DF202E1.jpeg","sha256":"96cd5dca4eaa428eef3c0a36e9fd6f308d2493e67738b168432fcf72248a36fb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"4D3453C5.png","sha256":"7e37f81406d5615af75971d4d27391d9f7932ba0a5cd3c1c4c71df1e90f528e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"5D12A963.png","sha256":"d8316c9d52d630d32cf37873ed002db6003ec3d381abce4cad72518bb7919a1f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"5F890CD.png","sha256":"be70d68d042480f847b1ec1edd212e1a276e79a9a6a7e6d7ed6bd4190f706739","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"7B56086A.png","sha256":"44c648b6d9685f7a0b4b7b5c01b398e5a4cf12436eea8739b1752d416ce4f046","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"82A075BD.jpeg","sha256":"50e72984b9ede188ddc0c78d9ed225451878e4dc28b4e940dab8088e264adfab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"A0393660.jpeg","sha256":"4ff7e674f9b9fa870543b5fa5dd14028a3b9bf9337de4369f431aa37771214aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"A2AF0BD3.jpeg","sha256":"fb2f09723a9c5dfa422faa88dbd93374124fb9e68d9c8eb9ba82b7c1d530220c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"AEEBC63E.png","sha256":"71ef84231387fd1a57c7992579c97a9cf98a0d5f07ce9dbbc38ff2f3a767349f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"~_Normal.dotm","sha256":"2820507593b307075160abd5158557826ee851a7792cb937cbac4998a1043c05","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}],"files_written":[{"path":"%TEMP%\\CVR62F8.tmp","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"C:\\~$031____18_.docx","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\AEEBC63E.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\2F03C527.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\248D8CFC.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\5F890CD.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\7B56086A.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\5D12A963.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\B41B0C08.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\18F2CC69.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\F8073756.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\DFD0135F.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\298FD5D4.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\4D3453C5.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\F345BF02.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%APPDATA%\\Microsoft\\UProof","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\CBD77F1B.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\A0393660.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\3DF202E1.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\DA68CB6E.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\B61E2897.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\3A7339AC.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\82A075BD.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\1084489A.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\A2AF0BD3.jpeg","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\2934ABB8.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\D9100859.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\Content.MSO\\39D4E286.png","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"C:\\~WRD0001.tmp:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Office\\14.0","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_WDW:{89BA7625-A8B1-459B-B530-E1E9BC04E7CE}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5821B369","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\SM0:3168:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_WDW:{7C0128AA-5086-48F7-A31E-FDF61890F38A}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\SM0:3168:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-525A4CCD","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CC8C5001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\x64_10MU_ACB10_S-1-5-5-0-155713","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Global\\MsoCsi:GC:C:/Users/oHPAcSC/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_WDW:{E27C2E80-E9FD-440D-BBDC-4961A4E5EC05}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_WDW:{BCCBB001-AC1E-47C3-BB40-E5F47F711218}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Global\\MsoCsi:GC:C:/Users/oHPAcSC/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A1EF00DF","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_OMTX:{BCCBB001-AC1E-47C3-BB40-E5F47F711218}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_WDW:{207801F2-FEEE-499B-B4D0-97C923D4D688}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2B3677BC","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Global\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2AE7254B","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\x64_10MU_ACBPIDS_S-1-5-5-0-155713","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-130C88F3","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"Local\\CSI_OMTX:{7C0128AA-5086-48F7-A31E-FDF61890F38A}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACBPIDS_S-1-5-5-0-155713","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\x64_10MU_ACB10_S-1-5-5-0-155713","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3168:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-130C88F3","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{BCCBB001-AC1E-47C3-BB40-E5F47F711218}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{0D48D5A8-BB64-4F58-B58D-15009522A762}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{207801F2-FEEE-499B-B4D0-97C923D4D688}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{BCCBB001-AC1E-47C3-BB40-E5F47F711218}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2AE7254B","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/oHPAcSC/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/FSF-CTBL.FSF","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-525A4CCD","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-A1EF00DF","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-2B3677BC","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_OMTX:{7C0128AA-5086-48F7-A31E-FDF61890F38A}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{89BA7625-A8B1-459B-B530-E1E9BC04E7CE}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{E27C2E80-E9FD-440D-BBDC-4961A4E5EC05}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\CSI_WDW:{7C0128AA-5086-48F7-A31E-FDF61890F38A}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-CC8C5001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoCsi:GC:C:/Users/oHPAcSC/AppData/Local/Microsoft/Office/14.0/OfficeFileCache/LocalCacheFileEditManager/FSF-{0E1EEE64-E8C6-4E2A-9759-63CF07FD8988}.FSF","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{BDD98A3C-B57F-4199-B92A-95A54AA1132E}-5821B369","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Csi_CTTxnLock:{1FA12FD0-FCA4-47A3-B095-D5AABB6DDEE2}","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MsoShellExtRegAccess_S-1-5-21-735145574-3570218355-1207367261-1001","sources":[{"report_type":"sandbox","report_id":"6362243d5383a8326c4772c5"}]}]}},"report_ids":{"sandbox_job_ids":["6362243d5383a8326c4772c5"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Msoffice/malicious_confidence_100% Sample af5fb99d3ff1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample af5fb99d3ff1…. Malware family: Msoffice/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf"}],["$","meta","4",{"property":"og:title","content":"Malicious Msoffice/malicious_confidence_100% Sample af5fb99d3ff1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample af5fb99d3ff1…. Malware family: Msoffice/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/af5fb99d3ff18bc625fb63f792ed7cd955171ab509c2f8e7c7ee44515e09cebf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Msoffice/malicious_confidence_100% Sample af5fb99d3ff1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample af5fb99d3ff1…. Malware family: Msoffice/malicious_confidence_100%. Threat score 100/100. 11/28 AV engines flagged this file. 2 malicious and 4 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]