{
    "query_status": "ok",
    "data": [
        {
            "sha256_hash": "0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493",
            "sha3_384_hash": "b4c3f627fa3f71c8e942504dbeba053c89d82a5496e2dcbc5ed56c880dcc9944ce3ce1b328b69c79f6a03a5206812666",
            "sha1_hash": "ea940cc09b54b9ec060e65d9ccc3a00c3cb00921",
            "md5_hash": "5c373c2116ab4a615e622f577e22e9be",
            "first_seen": "2021-11-03 12:20:27",
            "last_seen": null,
            "file_name": "0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493",
            "file_size": 311296,
            "file_type_mime": "application/x-dosexec",
            "file_type": "dll",
            "file_format": null,
            "file_arch": null,
            "reporter": "JAMESWT_WT",
            "origin_country": null,
            "anonymous": 0,
            "signature": "Kimsuky",
            "imphash": "23a7dbe071e826457a9ee2eac6296f32",
            "tlsh": "T1DC64F72ABAD19036D57F437495F586D7A928B9633370D84FE3C60B4D4C22BC36AA131E",
            "telfhash": null,
            "gimphash": null,
            "ssdeep": "6144:Y5KVAtFaFoGI0fJtnnDeCXhc0pASzJBjo:Y5Ky7aGGVznD7XFLJBjo",
            "magika": null,
            "dhash_icon": null,
            "trid": null,
            "comment": null,
            "archive_pw": null,
            "tags": [
                "dll",
                "Kimsuky"
            ],
            "code_sign": null,
            "delivery_method": null,
            "intelligence": {
                "clamav": null,
                "downloads": "130",
                "uploads": "1",
                "mail": null
            },
            "file_information": [
                {
                    "context": "cape",
                    "value": "https://www.capesandbox.com/analysis/201804/"
                }
            ],
            "ole_information": [],
            "yara_rules": [
                {
                    "rule_name": "INDICATOR_EXE_Packed_VMProtect",
                    "author": "ditekSHen",
                    "description": "Detects executables packed with VMProtect.",
                    "reference": ""
                }
            ],
            "vendor_intel": {
                "CERT-PL_MWDB": {
                    "detection": null,
                    "link": "https://mwdb.cert.pl/sample/0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493/"
                },
                "YOROI_YOMI": {
                    "detection": "Malicious File",
                    "score": "1.00"
                },
                "vxCube": {
                    "verdict": "clean1",
                    "maliciousness": "0",
                    "behaviour": []
                },
                "Intezer": {
                    "verdict": "malicious",
                    "family_name": "Lazarus",
                    "analysis_url": "https://analyze.intezer.com/analyses/beae3655-a72f-4df2-9e51-7cff57d26161?utm_source=MalwareBazaar"
                },
                "InQuest": {
                    "verdict": "MALICIOUS",
                    "url": null,
                    "details": [
                        {
                            "category": "info",
                            "title": "Windows PE Executable",
                            "description": "Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious."
                        }
                    ]
                },
                "CAPE": {
                    "detection": null,
                    "link": "https://www.capesandbox.com/analysis/201804/"
                },
                "Triage": {
                    "malware_family": null,
                    "score": "7",
                    "link": "https://tria.ge/reports/211103-pjbxssdgb8/",
                    "tags": [
                        "persistence"
                    ],
                    "signatures": [
                        {
                            "signature": "Deletes itself",
                            "score": "7"
                        },
                        {
                            "signature": "Loads dropped DLL",
                            "score": "7"
                        },
                        {
                            "signature": "Adds Run key to start application",
                            "score": "6"
                        },
                        {
                            "signature": "Suspicious use of AdjustPrivilegeToken",
                            "score": null
                        },
                        {
                            "signature": "Suspicious use of WriteProcessMemory",
                            "score": null
                        }
                    ],
                    "malware_config": []
                },
                "ReversingLabs": {
                    "threat_name": "Win32.Trojan.APost",
                    "status": "MALICIOUS",
                    "first_seen": "2021-09-30 14:29:29",
                    "scanner_count": "44",
                    "scanner_match": "23",
                    "scanner_percent": "52.27"
                },
                "UnpacMe": [
                    {
                        "sha256_hash": "0845f218a588f7619169787c4db69ce9de0c84143b100400b6476d7289a1c493",
                        "md5_hash": "5c373c2116ab4a615e622f577e22e9be",
                        "sha1_hash": "ea940cc09b54b9ec060e65d9ccc3a00c3cb00921",
                        "detections": [],
                        "link": "https://www.unpac.me/results/07e7f45c-f91a-4e54-abbb-a359490364c7/"
                    }
                ],
                "FileScan-IO": {
                    "verdict": "SUSPICIOUS",
                    "threatlevel": "0.5",
                    "confidence": "1",
                    "report_link": "https://www.filescan.io/uploads/61827eb0bf51178dbe4c594c/reports/56f261f1-c7f3-4d16-a2bd-21620da7a0cc/overview"
                }
            },
            "comments": null
        }
    ]
}