Behavioral task
behavioral1
Sample
d4b2c0e71f35d631710e86e474e69193edc340bbc9b38f1c5ae65d4aa1c1d98a.exe
Resource
win7-20220901-en
General
-
Target
d4b2c0e71f35d631710e86e474e69193edc340bbc9b38f1c5ae65d4aa1c1d98a
-
Size
1.0MB
-
MD5
d383c18325423c6adc3b92a2f1d4c94d
-
SHA1
f35025e90dd70166d3c99563c0c738e0c2b41ac7
-
SHA256
d4b2c0e71f35d631710e86e474e69193edc340bbc9b38f1c5ae65d4aa1c1d98a
-
SHA512
a811355dd8e1715038c0e7fe649028b5c019a9dd7373b63246e2eba64138d45e87c351a3a32b7d9adefaad97e3d3daf50b26c4f16848dfd040225c95e30258a3
-
SSDEEP
24576:QPy40i+knpJmJ4e52AeFJHFm9V0WIOgDe4YrUl/Awpbc04tDt3z0K:Qki+A7AePE9V0JxvYCowpY04tN
Malware Config
Signatures
-
Nirsoft 1 IoCs
resource yara_rule sample Nirsoft -
NirSoft MailPassView 1 IoCs
Password recovery tool for various email clients
resource yara_rule sample MailPassView -
resource yara_rule sample themida
Files
-
d4b2c0e71f35d631710e86e474e69193edc340bbc9b38f1c5ae65d4aa1c1d98a.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
Size: 13KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata2 Size: 412KB - Virtual size: 411KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Themida Size: 617KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE