Extracted

• • Target

    file.exe

  • Size

    1.8MB

  • MD5

    43d5cdd9d280da31eaa75b0fdd9c41b7

  • SHA1

    61f3a20ba60a709e4735d0355dd7de2e0e4713bc

  • SHA256

    642526506bbddc486ae30a8c0b285bce7bda2b08ec90cedea172d1e2f70c1317

  • SHA512

    593ff08684fa1f0047cb4e441a95fdd57d8dadc04b45bac8ef6feca553811c2c4e75f24461afd26ee2977a0f6a3b76f8ef9898e5a397a4c8141404747c782c7a

  • SSDEEP

    49152:eiIcjwR7feeQwpHDSyq2GD5spOBTkwf/c3JPCycYZal:ei7klfbJhq265sYB7/c3JatYMl

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2