PandoraHVNC.rar
- SHA256 e6fde59ccd2ab23714b2e7f32551226651e8367d459447dae2d9b80a20afbd22
Behavioral task
behavioral1
Sample
PandoraHVNC/Guna.UI2.dll
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral2
Sample
PandoraHVNC/PandorahVNC - Cracked By BoBhitBine.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
30 seconds
Behavioral task
behavioral3
Sample
PandoraHVNC/builder/Pandora Client Builder.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
30 seconds
Behavioral task
behavioral4
Sample
PandoraHVNC/builder/Stub/client.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
30 seconds
General
- Target PandoraHVNC.rar
- Size 3.8MB
- Sample220927-w1p93sebd2
- SHA256 e6fde59ccd2ab23714b2e7f32551226651e8367d459447dae2d9b80a20afbd22
- MD5 70642b74435f394d8c7001c4248fbd92
- SHA1 685c77def902375c54b4122d0f289e1921346943
- SHA512 1432200d8cf3c9aab2cbbf03525964b8604268bd60328a8b0346738d8a6d7fc5dc4ee06a19dd0cd619dab1643de842893369683c560e8f3fb92bf37a4cffe428
- SSDEEP 98304:0oPStM8K1DMidjhf27SjvqBYw5CEU1Lyohkc+u5UiXGxTQ:iZ+ZRBjvQZkEU1LyohUo/XGxTQ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
arrowrat
Botnet
-
Client Name
C2
-
127.0.0.1:1337
Mutex
-
Mutex
Signatures
File Explorer
-
PandoraHVNC.rar.rar 3.8MB
-
PandoraHVNC/Guna.UI2.dll.dll 2.1MB
-
PandoraHVNC/PandorahVNC - Cracked By BoBhitBine.exe.exe 5.1MB
-
PandoraHVNC/builder/Pandora Client Builder.exe.exe 5.0MB
-
PandoraHVNC/builder/Stub/client.bin.exe 158KB
PandoraHVNC/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bf7fd5efcd54d00bfda76187cb3f04dd36bb38d9b36b505e1493cffb7a7f3d9e
- MD5 aca7f1ca2525160b85404e638732bd87
- SHA1 612b5fa896871ee2f8f5710ac4bc63701cb96e4f
- SHA512 dbf6624da29167ac67ef8e2fbfa1a350f00f850a1c029fe427d54ddbc3299331633ee8e1c076cd54ff02fa219fbe9ab0397e89c1a32d502ccdd150df55e25ae3
- SSDEEP 49152:tvU6fD73waJnBA5lV8jldVmIgA5iKOvhn:tvU6vznglEldVmIJi/vt
- MD5 SHA1 SHA512 SSDEEP
-
Obfuscated with Agile.Net obfuscator
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
PE Signature issue
Digest
2b:c7:ea:b4:68:dc:cc:69:de:29:26:72:00:01:f2:82:5e:cb:27:08
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US
Serial Number
0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Issuer
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 1, 2021 - Jan 6, 2031
Subject
CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 7, 2016 - Jan 7, 2031
Minor OS version
Major OS version
Entry point
2220854
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PandoraHVNC/PandorahVNC - Cracked By BoBhitBine.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4ac535cf37a71be57dacd5677b09efd8bb216eb77e467313426e2edbf1600ab1
- MD5 4c3338c73014a5fd124c4b5b1538e80f
- SHA1 d6058fca565ef43355999ba3a42f7e26dcf9e495
- SHA512 00c61a16e2f5ecb00c9037410d316a53bd97cd654cca4272faf71c29a060f525d53f279c273daa8d79f44ff1e6c778e4870c342a5eb40fe48054481796abdfde
- SSDEEP 98304:6HB41DSe6NtONC25oD83lB41N+CIw6Se6Nt9C25o:6ADSe6PONC2K83KN+CIw6Se6P9C2
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
5205694
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
126KB
Virtual Size
125KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PandoraHVNC/builder/Pandora Client Builder.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 0737fc32aafdc1b6cc12efd32581e0a208c84d5760ab2d77c3c525d34fe333a6
- MD5 3716185e55790072076a961fa9629ab8
- SHA1 df8e3cc0ba2dc454e254d96534483ef23b805d53
- SHA512 05d94fc3d6a097293c396e276032a77cd07a73358c9cd1b17839b946a8f554ef0c91a198ffb758d220de475ead01d10cf0109379e62c7e6be4112b62a19dcf75
- SSDEEP 49152:tOUthyZ67WMAxUrgK7c80IirMPr2/3xv3m:vt2j1+dcxIiWr2g
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
5200270
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
5.0MB
Virtual Size
5.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
PandoraHVNC/builder/Stub/client.bin
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 b4f1b5a47175722b1a9230b934c227dc6b6a06bb5d8e6d0713bbaec35c34a44e
- MD5 84c7dfc6c975fb3391adf8fd27e0dfae
- SHA1 cb793feddca0194a5c011a2a5e581ab2510c0035
- SHA512 c250948d2f5cce26de34083d8d5051a10f90b070aab7ddb187934c9caaab7067725e822108444a4acc3bb64dc730efca5877446ff7a34ea5443042f68215f279
- SSDEEP 3072:Wbh0gAyRWW+0OMmlxvTltwLpBTkgIDeGIl3WNSmNJR1GddKqeCgqVbbp/YouwJbB:Wbh0LL0OrdltyB7dWY0J6ddKwpgouYn8
- MD5 SHA1 SHA512 SSDEEP
Minor OS version
Major OS version
Entry point
164638
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
153KB
Virtual Size
152KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ