Static task
static1
Behavioral task
behavioral1
Sample
3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83.exe
Resource
win10v2004-20221111-en
General
-
Target
3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83
-
Size
896KB
-
MD5
f76142dfc872fbc7b82b38f6180bda9d
-
SHA1
a76d132faa4b5ff28ad23a1b3557cf59b9b5ba45
-
SHA256
3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83
-
SHA512
7ae7973fb7bdf8a9d3f2e14a7b46e5dee97590251cd3a3250d1c84e861a5717ee222ba59410f88d8b383594ce86288a7fe005f4865673caa63888833bc052d07
-
SSDEEP
24576:tQtqBorTlYWBhE+V3mOikWtlFrrClWmAUJnfvy8:+tqFWM4mdvS5Xt
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule sample MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule sample WebBrowserPassView
Files
-
3cfcf600bc33a221ffda8e4cf15920276e8ed61898b0af63c3aa10e365d5fd83.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 499KB - Virtual size: 498KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 19KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.enigma1 Size: 112KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.enigma2 Size: 264KB - Virtual size: 264KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE