Extracted

• • Target

    file.exe

  • Size

    1.9MB

  • MD5

    9cdd10493e0b673dfe1ceadee1ba9c0d

  • SHA1

    eb93eb07eec6db7f9018ecdfe851ab3fed7930b1

  • SHA256

    559be79bc8e07116bdc4060a4ad64d41e65fe497750cf3e63eebd1bd641a036e

  • SHA512

    e36ed9f9c4aa35d5e8e3a45effad7a747d3370b71f9c2edcd0f667ff1bb457c84f451a82b2a641d4c903516adc15e45710fc51d630a69640440617b2e85b2ad9

  • SSDEEP

    49152:CiACiqzBtW2rQr4y9Ift98n6XrjLX/nvYX0FJD:CiACim7Nr5yon8nwrjLvvYuJD

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2