Static task
static1
Behavioral task
behavioral1
Sample
0d06dfdabb34c5d9fb8b453fc2f549af18688f025e5c719c388e234726912fd8.exe
Resource
win7-20220812-en
General
-
Target
0d06dfdabb34c5d9fb8b453fc2f549af18688f025e5c719c388e234726912fd8
-
Size
540KB
-
MD5
367543714fedbca9ecef7c320bc68a34
-
SHA1
8b0db5188606c474343a3cf72039a32d4a813ac7
-
SHA256
0d06dfdabb34c5d9fb8b453fc2f549af18688f025e5c719c388e234726912fd8
-
SHA512
80f7954c0e1ca402bd77029e186808b2ac60a50e62b1c76e9c580284db5f4ba846931250aff15427cf8fb45467a45356fc95e67b1fa620e5491eecb3e2cdd3eb
-
SSDEEP
6144:kumGBBbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9UDH:/QtqB5urTIoYWBQk1E+VF9mOx9U1V
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule sample MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule sample WebBrowserPassView
Files
-
0d06dfdabb34c5d9fb8b453fc2f549af18688f025e5c719c388e234726912fd8.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 527KB - Virtual size: 526KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ