24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 30:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious GT:VB.Heur2.SCrypted.3 Sample ffdc53425ce4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ffdc53425ce4…. Malware family: GT:VB.Heur2.SCrypted.3. Threat score 100/100. 10/28 AV engines flagged this file. 6 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ffdc53425ce42cf1d738fe22016492e1cb8e1bc657833ad6e69721b3c28718b2","keywords":["Malicious","GT:VB.Heur2.SCrypted.3","malware analysis","sandbox report","threat intelligence","ffdc53425ce42cf1d738fe22016492e1cb8e1bc657833ad6e69721b3c28718b2"],"about":{"@type":"SoftwareApplication","name":"aabe9e1e51b958c3da478b81b5200d58bde178b3","applicationCategory":["doc","office"],"identifier":"ffdc53425ce42cf1d738fe22016492e1cb8e1bc657833ad6e69721b3c28718b2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"GT:VB.Heur2.SCrypted.3","antivirusDetections":{"malicious":10,"total":28},"behavioralIndicators":{"malicious":6,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T723,"WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LEO.EXE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\LEO.EXE") "WINWORD.EXE" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADDRESSBOOK") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\ADOBE FLASH PLAYER NPAPI") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AUTOITV3") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\CONNECTION MANAGER") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DIRECTDRAWEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\DXM_RUNTIME") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\FONTCORE") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE40") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE4DATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IE5BAKEX") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA0") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA1") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA10") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA100") "WINWORD.EXE" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\IEDATA101")26:T429,"\Sessions\1\BaseNamedObjects\Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\ZoneAttributeCacheCounterMutex" "Local\ZonesCounterMutex" "Local\10MU_ACB10_S-1-5-5-0-59722" "Global\552FFA80-3393-423d-8671-7BA046BB5906" "Local\ZonesLockedCacheCounterMutex" "Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\10MU_ACBPIDS_S-1-5-5-0-59722" "Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\10MU_ACBPIDS_S-1-5-5-0-59722" "\Sessions\1\BaseNamedObjects\Local\ZonesCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" "\Sessions\1\BaseNamedObjects\Local\10MU_ACB10_S-1-5-5-0-59722" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-4162757579-3804539371-4239455898-1000" "\Sessions\1\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-4162757579-3804539371-4239455898-1000"27:T618,"WINWORD.EXE" touched file "%WINDIR%\Globalization\Sorting\sortdefault.nls" "WINWORD.EXE" touched file "%WINDIR%\Fonts\staticcache.dat" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\USER32.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "WINWORD.EXE" touched file "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\SETUPAPI.dll.mui" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000c.db" "WINWORD.EXE" touched file "%WINDIR%\system32\rsaenh.dll" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\KERNELBASE.dll.mui" "WINWORD.EXE" touched file "%WINDIR%\System32\msxml6r.dll" "WINWORD.EXE" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{3C0CB816-BE62-466E-942C-CCFF48B1E704}.tmp" "WINWORD.EXE" touched file "%WINDIR%\system32\en-US\MSCTF.dll.mui"28:T88f,Pattern match: "http://www.monster.com/" Pattern match: "http://www.northropgrumman.com/Careers/Pages/Social-Media.aspx" Pattern match: "http://careers.northropgrumman.com/" Heuristic match: "Email: HYPERLINK mailto:universityrelationsandrecruiting@ngc.com \h universityrelationsandrecruiting@ngc.com" Pattern match: "www.wetransfer.com" Pattern match: "www.baidu.com" Heuristic match: "uk.yahoo.com" Pattern match: "www.google.com" Heuristic match: "web.whatsapp.com" Pattern match: "ph...............eJ/4hh%h2" Pattern match: "www.bitcoin.org" Pattern match: "l8.kc/Jm7+%%ECmu5}`~qSWm2if?6G---WZ`]?#4%fojWvsg{4n9\eH~SmB" Heuristic match: ";^Qep-D0gp05.w>%:xMRUkxwqE WG8G![fPaEx'~:*l|'mUAj&^#'Q)U//Yhk:EGlc7h7e,c9ZO|t'-[P5[fsdH62 xu/xM[H|SlNK{-bm%cK+.BW" Heuristic match: "pO'xSsxSQMf8,H[n$E't991@^S(D>K,BEi*K6woZ#vrhns.TD" Pattern match: "ob1.Ai/$?M3M%^-s['U-ttP20#y2rNNOz" Heuristic match: "UUVpXYzv{EC1HTM'8TVk$gH&r)MBZ(,ED*7YfDSp)KJ%d2l}XV!21IuZud+_,jE(l?@}L&Ynsp&2fff033Yb18j'&_c\rjR `vv.dk" Pattern match: "23yod.eU/@T&I~{s9l" Heuristic match: "Td2F0D$A8F0b3].Vi" Heuristic match: "[Yf^8 e^F|>?1$2^/\ml6.bD" Pattern match: "o.wMH/`oO~[[[p8HMvQIQ" Heuristic match: "c2G}XHC3fa@{^w/drffRtVhT*`ii.nZ" Pattern match: "F48.eg/.=}34GmO" Heuristic match: "}F=nM3xu+zHR'-lsa'w9T7|Dh0rrOU$1x46Y#^wr=yMv:E,@@Gr*tK`[s3Sw5bb<*7t56 $b8^z7,3O~O3#^0@bzaI;I8ZPdn.cZ" Pattern match: "EMI.ZgE/QiKQdya'*onr~WrI+z0:Vzwi3#" Pattern match: "gOe.tO/0gOD|=]AqqVOl%~|a" Pattern match: "w.XOz/xsBy}$" Pattern match: "9.zUy/-:W,'4Y~0" Heuristic match: "eH+}gyuK[$Q&yNK|3ck6G4ybisG'VGFo]M)Nt6>Y/y]KWdSG;y{9oI%oxPj9QX\dka^K5rz~uh.TD" Heuristic match: "JHcsyu~xrIo1ZPC=*(a$c28QT08.LT" Heuristic match: "]+6pGZrl<6_.~9\jKLHvm.Us" Pattern match: "M.De/r~!gOE\\I" Heuristic match: "HzV9E%+\JGrl.JzMq.A1z3lz:Kk6pYjF@#&80OvzG==;UA*@-:tU&*<3xVE0LO{H\I=N(tQn|W<<0