{
  "timestamp": "2025-02-05T21:42:23.601075",
  "model": "deepseek/deepseek-r1-distill-llama-70b",
  "request": {
    "messages": [
      {
        "role": "system",
        "content": "You are a cybersecurity expert specializing in company websites and product documentation.\n        Analyze the content and classify it into the given categories.\n        Return only the applicable categories as a comma-separated list, nothing else."
      },
      {
        "role": "user",
        "content": "\n        Categories to choose from:\n        product_security_features, end_user_security, compliance_certifications, security_best_practices, data_protection, access_management, threat_prevention, incident_response, privacy_policy, technical_documentation\n        \n        Content to classify:\n        Search Free Trial Get Demo SolarMarker Backdoor Pretends to be Legit PDFescape Installer May 25, 2021 The modified installer of legit PDFescape Desktop Installer app looks like this Fake PDFescape Desktop Installer App SHA-256 0c933001de544ebc071d175d9f8e3bfad8066b532dc69dea4c713c52eb6a64a0 Cyren detects this kind of malware as W32SolarMarker.A.gen!Eldorado. Upon execution, It creates an encoded file under Userdirrandomcharsrandomcharsrandomcharsrandomcharsrandomcharsrandomcharsrandomchars encoded file. It then executes a Power Shell Script command to decode and execute the malicious script and delete the encoded file. Afterwards, it drops and executes a clean installer named PDFescape_Desktop_Installer.exe. Code Snippet of Power Script Decoder and Executer It then creates a copy in appdataMicrosoftrandomcharsrandomchars.PS1. This is a copy of a malicious powershell script, and Cyren detects this as PSHSolarMarker.A. It then creates appdataMicrosoftWindowsStart MenuProgramsStartupa7e886f7e164c982a59aa5b4981aa.lnk link file to randomchars.PS1. Cyren detects this as LNKSolarMarker.A It creates the following file userprofileAPPDATAROAMINGSOLARMARKER.DAT, which contains a random 32 byte string to be used as malware_id. Code Snippet of Solarmarker config file It creates a null file userprofileAPPDATAROAMINGBase64ENcodedString. This string is based on the malware_id and malware_version. Code Snippet of Null File using Malware ID and Version The following information is encrypted before it is sent to the Command and Control CC Server 192.121.87.53. actionping,hwidmalware_id,pc_nameGetComputerName,os_nameOS_Name,archx64x86,rightsAdminUser,versionmalware_version,workgroupGetWorkGroup,dns0,protocol_version2 Code Snippet of Information to be send to CC Server The following CC commands are used file  downloads and executes malware in the following file type exe or ps1 command  executes a powershell script command Code Snippet of CC commands Try it for Free Instant Data Classification Cyren URL Category Chacker Prev Dissecting a UnionBank Phishing Campaign Ransomware Attacks Are Here to Stay Next Company Partners Resources Investor Relations Products Freeware Demo Solutions Contact Us Privacy Management Service by Data443\n        "
      }
    ],
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  },
  "response": {
    "content": "technical_documentation, threat_prevention",
    "usage": {
      "prompt_tokens": 627,
      "completion_tokens": 750,
      "total_tokens": 1377
    },
    "model": "deepseek/deepseek-r1-distill-llama-70b"
  }
}