{
    "query_status": "ok",
    "data": [
        {
            "sha256_hash": "aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039",
            "sha3_384_hash": "b242b2596db55c27f40998edeb2d298bb9e7ba52dbdc8f042d04869b985b2d39df033c620de9d18d0f7572d3b5be3ca8",
            "sha1_hash": "3b994549ab4fd9024b2f0155094d7aa43b70bb8f",
            "md5_hash": "75a46b23825ce7aa4ca297d93450f4e2",
            "first_seen": "2025-09-12 11:28:28",
            "last_seen": "2026-05-22 15:52:27",
            "file_name": "aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039_windows_dpapiloader_wmiclnt.bin",
            "file_size": 316928,
            "file_type_mime": "application/x-dosexec",
            "file_type": "exe",
            "file_format": null,
            "file_arch": null,
            "reporter": "foxit_srt",
            "origin_country": "NL",
            "anonymous": 0,
            "signature": null,
            "imphash": "63d4a9b9eba532944ae2a220c057d409",
            "tlsh": "T107647C45B7E404B9E5B7923C8D634A46EBF2BC120B60E74F03A0466B7F237515A3DB62",
            "telfhash": null,
            "gimphash": null,
            "ssdeep": "6144:9nz0pq3O6sU6s1USOkObwlXrsiHWYLw/KwLv:Z/3O6sU60OkObw3HWY0/K",
            "magika": "pebin",
            "dhash_icon": null,
            "trid": [
                "48.7% (.EXE) Win64 Executable (generic) (10522/11/4)",
                "23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)",
                "9.3% (.EXE) OS/2 Executable (generic) (2029/13)",
                "9.2% (.EXE) Generic Win/DOS Executable (2002/3)",
                "9.2% (.EXE) DOS Executable Generic (2000/1)"
            ],
            "comment": null,
            "archive_pw": null,
            "tags": [
                "dll",
                "DPAPILoader",
                "exe",
                "Lazarus"
            ],
            "code_sign": null,
            "delivery_method": null,
            "intelligence": {
                "clamav": null,
                "downloads": "48",
                "uploads": "2",
                "mail": null
            },
            "file_information": [
                {
                    "context": "cape",
                    "value": "https://www.capesandbox.com/analysis/27129/"
                }
            ],
            "ole_information": [],
            "yara_rules": [
                {
                    "rule_name": "cobalt_strike_tmp01925d3f",
                    "author": "The DFIR Report",
                    "description": "files - file ~tmp01925d3f.exe",
                    "reference": "https://thedfirreport.com"
                },
                {
                    "rule_name": "DebuggerCheck__API",
                    "author": null,
                    "description": null,
                    "reference": "https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara"
                },
                {
                    "rule_name": "golang_bin_JCorn_CSC846",
                    "author": "Justin Cornwell",
                    "description": "CSC-846 Golang detection ruleset",
                    "reference": null
                }
            ],
            "vendor_intel": {
                "CERT-PL_MWDB": {
                    "detection": null,
                    "link": "https://mwdb.cert.pl/sample/aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039/"
                },
                "YOROI_YOMI": {
                    "detection": "Malicious File",
                    "score": "1.00"
                },
                "vxCube": {
                    "verdict": "malware2",
                    "maliciousness": "100",
                    "behaviour": [
                        {
                            "threat_level": "neutral",
                            "rule": "Sending a custom TCP request"
                        }
                    ]
                },
                "Intezer": {
                    "verdict": "unknown",
                    "family_name": null,
                    "analysis_url": "https://analyze.intezer.com/analyses/d955b1ed-83c9-403c-a9f9-b5783456e576?utm_source=MalwareBazaar"
                },
                "CAPE": {
                    "detection": null,
                    "link": "https://www.capesandbox.com/analysis/27129/"
                },
                "Triage": {
                    "malware_family": null,
                    "score": "3",
                    "link": "https://tria.ge/reports/250912-rm688avns7/",
                    "tags": [],
                    "signatures": [],
                    "malware_config": []
                },
                "ReversingLabs": {
                    "threat_name": "Win64.Trojan.Alevaul",
                    "status": "SUSPICIOUS",
                    "first_seen": "2024-08-22 02:40:37",
                    "scanner_count": "23",
                    "scanner_match": "14",
                    "scanner_percent": "60.87"
                },
                "Spamhaus_HBL": [
                    {
                        "detection": "suspicious",
                        "link": "https://www.spamhaus.org/hbl/"
                    }
                ],
                "UnpacMe": [
                    {
                        "sha256_hash": "aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039",
                        "md5_hash": "75a46b23825ce7aa4ca297d93450f4e2",
                        "sha1_hash": "3b994549ab4fd9024b2f0155094d7aa43b70bb8f",
                        "detections": [
                            "win_svcready_a0"
                        ],
                        "link": "https://www.unpac.me/results/5a2103f8-76f9-4441-8133-b65ffd3ca8e5/"
                    }
                ],
                "FileScan-IO": {
                    "verdict": "NO_THREAT",
                    "threatlevel": "0.25",
                    "confidence": "1",
                    "report_link": "https://www.filescan.io/uploads/68c42be30d1238ff0aaae0d2/reports/a24c6618-1049-48e6-89c5-e857544c34e5/overview"
                },
                "Kaspersky": {
                    "verdict": "Malware",
                    "file_type": "dll x64",
                    "first_seen": "2025-09-02T04:15:00Z",
                    "last_seen": "2025-09-02T04:15:00Z",
                    "hitscount": 10,
                    "report_link": "https://opentip.kaspersky.com/aa4a2d1215f864481994234f13ab485b95150161b4566c180419d93dda7ac039/results?tab=lookup",
                    "detections": []
                }
            },
            "comments": null
        }
    ]
}