Static task
static1
Behavioral task
behavioral1
Sample
f19338d724c0e6b14325ce3b6d38d17dc60c7a70e8d460e2353bd624a16cf81f.exe
Resource
win7-20221111-en
General
-
Target
f19338d724c0e6b14325ce3b6d38d17dc60c7a70e8d460e2353bd624a16cf81f
-
Size
540KB
-
MD5
c340b545e167371f71a21251f16980f7
-
SHA1
546efcf9a52b1efa0351e71d1e17becfc6a08250
-
SHA256
f19338d724c0e6b14325ce3b6d38d17dc60c7a70e8d460e2353bd624a16cf81f
-
SHA512
314b30fe3068aaf54a6547f706508929ab91a008ac0a6fdc5443b63b7848007538ea14a7b24185c436182af5a32aa32681b681c3ac5492035fef3120f742139e
-
SSDEEP
6144:ku9GDrsbS/QTjhUqBfxrwEnuNcSsm7IoYGW0VvBXCAt6kihwE+VDpJYWmlwnx9DK:zQtqB5urTIoYWBQk1E+VF9mOx9Dw3
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule sample MailPassView -
NirSoft WebBrowserPassView 1 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule sample WebBrowserPassView
Files
-
f19338d724c0e6b14325ce3b6d38d17dc60c7a70e8d460e2353bd624a16cf81f.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 527KB - Virtual size: 526KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ