Extracted

• • Target

    file.exe

  • Size

    2.0MB

  • MD5

    e0f8085c7cb8eb9cf1c263bb12cfc6df

  • SHA1

    a109ebcf251a1e69923c60330994190e40ab466c

  • SHA256

    a28fb531e91695081ac9a3a08bd9be333462f84a3b1e9de81dda94869fd3d32a

  • SHA512

    11f39030a9e5f5a095c85aa087fe949ed7e83e1a53a3df487baab09a38d5e744150a8d4e7b34eaec28678561861e640cb34231b893a7f38751f143d0ea1305d1

  • SSDEEP

    49152:XirWlOmsJ8sSNd3HEKBqd0yLaS1vNf+8UkqBx:XiClONJu3HEKBqd0yLaGFfvqH

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2