Static task
static1
Behavioral task
behavioral1
Sample
e2cbf833fa1ffc5fa51c79678e27568e8bb448dd803d53f6b19e8fa3cbfc1ca3.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e2cbf833fa1ffc5fa51c79678e27568e8bb448dd803d53f6b19e8fa3cbfc1ca3.exe
Resource
win10v2004-20221111-en
General
-
Target
e2cbf833fa1ffc5fa51c79678e27568e8bb448dd803d53f6b19e8fa3cbfc1ca3
-
Size
533KB
-
MD5
d28f2b1c2a803cb6da37464970ee3d36
-
SHA1
df311795b419aa0c4953ce281726fca845d97c41
-
SHA256
e2cbf833fa1ffc5fa51c79678e27568e8bb448dd803d53f6b19e8fa3cbfc1ca3
-
SHA512
d8da99a262f6e3ef04c7edd9584de8a5db23e6799d9d767eeb106209bc3496e2fe6494d52c9b3d01bba21027897c3825020f12f495b79080b0e9c3ba88ecb2ee
-
SSDEEP
6144:oujqcCbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx91:aQtqB5urTIoYWBQk1E+VF9mOx9
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule sample MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule sample WebBrowserPassView
Files
-
e2cbf833fa1ffc5fa51c79678e27568e8bb448dd803d53f6b19e8fa3cbfc1ca3.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 520KB - Virtual size: 519KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ