Static task
static1
Behavioral task
behavioral1
Sample
d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27.exe
Resource
win10v2004-en-20220113
General
-
Target
d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27
-
Size
823KB
-
MD5
1f66154d69a4032a509979beb79f7e00
-
SHA1
d89ad9add9987ae28f2141a3f4bbe3b323a0f4d9
-
SHA256
d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27
-
SHA512
aa74a86a6b96e254b3ad17d935af65fac8136d2809e9e5907fd50f2609a04da54cf6e60c4fa26823e8e60f3b2ea01c29853d0bde8f291e8d38b73a893c0b3520
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule sample Nirsoft -
Panda Stealer Payload 1 IoCs
resource yara_rule sample family_pandastealer -
Pandastealer family
Files
-
d4308d3282c98dc1f298484756d43ab8962f7e6c43eccd9c4ee29a253f5dba27.exe windows x86
Code Sign
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 124B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 1KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1024B - Virtual size: 770B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 456B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 814KB - Virtual size: 814KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ