BlitzedGrabberV12[.]exe | Triage

Sharing

General

Target

BlitzedGrabberV12.exe
Size

4.6MB
MD5

4cb401aea8d5ca0d7c72a55bddacfc0b
SHA1

011f750475cb953e5a9a69cb9579d641b4dd099c
SHA256

f355d5ea514115c422d6861b2892b23f3e34ae6f4b8a8e10e660d68de83e66f4
SHA512

120cd80d428b5440943f8696c60d690bac1f92b160a9c284bbc99ba3e009e750838c94288c450095101e08b7c440c0d7d35445ab96ac877bdbabdf884aecf266
SSDEEP

98304:WFQf3s64R9ybzUcwti78OqJ7TPBF3ZlHHgkWJ0P39qXSaDvc:lzUcwti7TQlF3ZxxWJSUnDvc

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

NirSoft WebBrowserPassView 1 IoCs

Password recovery tool for various web browsers

resource	yara_rule
sample	WebBrowserPassView

Files

BlitzedGrabberV12.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

1m%$Vf#
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ