Extracted

• • Target

    file.exe

  • Size

    1.5MB

  • MD5

    495ec9f487ebdac52568aa394f1db615

  • SHA1

    3893a7d5f9f91b9f2b2a3d7bbb5483c9ae5b385a

  • SHA256

    d229f2520f6ed70a022a6333483e844c35d792744a883fde05f03dd2a3fd7420

  • SHA512

    d7b7ee9da30fb52082f453156aec3932cbf40604fd6e4b5bc8a5458d731685a841674b784fd4957b9eed8d3159534585ae8234a9fb36d9cf06d34f2ac1e29de5

  • SSDEEP

    24576:220Sx+J5xUVuvxlj4J6DPZwVA3OQVFgcfsNfkhUyFtc/7Zf+BXMgXC75ld1qSVpk:228wubE6uBQVtfsN0R+/tOEd1qapk

  Score

  10^/10

  nymaimdiscoverytrojan

  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

    trojannymaim

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  behavioral1behavioral2