Static task
static1
Behavioral task
behavioral1
Sample
Xyaqr.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Xyaqr.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
fgjgggjMN1111.exe
Resource
win7-20221111-en
General
-
Target
Mango Desktop (2).rar
-
Size
4.1MB
-
MD5
e110caa67d585ba1d1cf49c6fb479bd9
-
SHA1
73c02297643e5d25e826b72c782c55c80b3dca27
-
SHA256
f7fc62d444a2653b7383ef64b80844343c3093871e9106672380ff3cd023378f
-
SHA512
c94716ae00381979a52647d00f3c395783920f2140ec023bfae522dc1c5289171fa19c6d1e485fb6c0b2cd392e0f57c30be9d80e4c849c6fd482c0c2f197b6b9
-
SSDEEP
98304:lVuCQJTHrHuopYB80hTdBuW+Vm2KNi33diyOIbfzBUeaLJ0iUFVHY:lVunJ70+3b33oKDzBQ4FVHY
Malware Config
Signatures
Files
-
Mango Desktop (2).rar.rar
Password: 123
-
Xyaqr.exe.exe windows x86
Password: 123
250aea6e0152d0dfb5088306d7d06593
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
TerminateProcess
user32
CopyAcceleratorTableA
gdi32
BitBlt
msimg32
AlphaBlend
winspool.drv
OpenPrinterA
advapi32
RegEnumKeyA
shell32
SHGetMalloc
comctl32
InitCommonControlsEx
shlwapi
PathFindFileNameA
uxtheme
EndBufferedPaint
dwmapi
DwmSetWindowAttribute
ole32
CreateILockBytesOnHGlobal
oleaut32
SysAllocString
oledlg
ord8
gdiplus
GdipDrawImageI
oleacc
AccessibleObjectFromWindow
imm32
ImmGetContext
winmm
PlaySoundA
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 1.9MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 84KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
fgjgggjMN1111.exe.exe.exe windows x86
Password: 123
6c359a2045be487f8841f8ff8d8bc83f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
RtlUnwind
user32
IsDialogMessageA
gdi32
SelectObject
winspool.drv
DocumentPropertiesA
advapi32
RegSetValueExA
shell32
DragQueryFileA
comctl32
ord17
msvcrt
strncpy
iphlpapi
GetInterfaceInfo
psapi
GetMappedFileNameW
Sections
.text Size: 644KB - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 848KB - Virtual size: 848KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.sedata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ