nymaim | f7e2d103fb403399e4dca1625cd9a733b0fd50e04fdeb435a81ade7b6f7d56e3

Sharing

Copy URL Twitter E-mail

General

Target
f7e2d103fb403399e4dca1625cd9a733b0fd50e04fdeb435a81ade7b6f7d56e3
Size 251KB
Sample221229-qhbfbagc8s
SHA256 f7e2d103fb403399e4dca1625cd9a733b0fd50e04fdeb435a81ade7b6f7d56e3
MD5 25b11ce189d36095c214ec12fd1c4e78
SHA1 fb194c5a31b57b4fda3ca58145636be85e5f5172
SHA512 0be17810ddbcfad5eddc5086962a8ee44451fc8c20035dbc1660e2339cdcc29ad65701b1538fa32f25eb5be7e68f4a3235cda4c80c21d8ca165eed49cda465da
SSDEEP 6144:ByX9Id6xvIhgsQkhTSTou+e0+WMf97z8IAO0TJTbw:ByX86xvIhgZkhTcJbebw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

nymaim

Malware Config

Extracted

Family

nymaim

45.139.105.171
85.31.46.167

Signatures

Nymaim family
nymaim

File Explorer

f7e2d103fb403399e4dca1625cd9a733b0fd50e04fdeb435a81ade7b6f7d56e3

.exe 251KB

f7e2d103fb403399e4dca1625cd9a733b0fd50e04fdeb435a81ade7b6f7d56e3

IMPHASH 753dada4106a2042611686433e9ac8bc
SHA256 f7e2d103fb403399e4dca1625cd9a733b0fd50e04fdeb435a81ade7b6f7d56e3
MD5 25b11ce189d36095c214ec12fd1c4e78
SHA1 fb194c5a31b57b4fda3ca58145636be85e5f5172
SHA512 0be17810ddbcfad5eddc5086962a8ee44451fc8c20035dbc1660e2339cdcc29ad65701b1538fa32f25eb5be7e68f4a3235cda4c80c21d8ca165eed49cda465da
SSDEEP 6144:ByX9Id6xvIhgsQkhTSTou+e0+WMf97z8IAO0TJTbw:ByX86xvIhgZkhTcJbebw
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

62354

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetLastError VirtualFree OutputDebugStringA VirtualAlloc LocalAlloc GetLastError LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress LocalFree GetProcessHeap FreeLibrary FormatMessageA IsBadReadPtr Process32First FindFirstFileA HeapFree FindClose GetLocaleInfoA OpenProcess CreateToolhelp32Snapshot Sleep GetTempPathA K32GetModuleFileNameExA Process32Next K32GetModuleBaseNameA CreateThread GetCurrentProcessId K32EnumProcessModules CreateDirectoryA SetEndOfFile HeapSize CreateFileW SetStdHandle VirtualProtect WideCharToMultiByte CloseHandle CreateFileA MultiByteToWideChar WriteFile FindNextFileA ReadFile SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW GetConsoleOutputCP FlushFileBuffers GetFileSizeEx HeapReAlloc EnumSystemLocalesW GetUserDefaultLCID WriteConsoleW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale

user32

GetForegroundWindow GetKeyboardLayoutList GetWindowTextA

advapi32

CryptAcquireContextW GetUserNameA CryptDecrypt CryptCreateHash CryptDeriveKey CryptHashData CryptReleaseContext CryptDestroyKey

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoCreateInstance CoInitialize CoUninitialize

wininet

InternetSetFilePointer HttpQueryInfoA HttpAddRequestHeadersA InternetSetOptionA InternetOpenA InternetCloseHandle HttpSendRequestA InternetConnectA HttpOpenRequestA InternetReadFile