Overview

overview

10

Static

static

10

044685b4ab...0f.exe

windows7-x64

10

044685b4ab...0f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    044685b4ab7d6662478a46d8f991da88a69bb8b73c66ce12e48a4570c3a5050f.exe.bin
  • Size 5.0MB
  • Sample230501-sb77tagb84
  • SHA256 044685b4ab7d6662478a46d8f991da88a69bb8b73c66ce12e48a4570c3a5050f
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
minerpdflinkmatiexsnakekeyloggerxmrigardamaxmetasploit

Malware Config

Signatures

  • Ardamax family
    ardamax
  • Ardamax main executable 1 IoCs
  • Matiex Main payload 1 IoCs
  • Matiex family
    matiex
  • Metasploit family
    metasploit
  • Snake Keylogger payload 1 IoCs
  • Snakekeylogger family
    snakekeylogger
  • XMRig Miner payload 1 IoCs
    miner
  • Xmrig family
    xmrig
  • HTTP links in PDF interactive object 1 IoCs

    Detects HTTP links in interactive objects within PDF files.

    pdflink
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • 044685b4ab7d6662478a46d8f991da88a69bb8b73c66ce12e48a4570c3a5050f.exe.bin
    .exe 5.0MB

044685b4ab7d6662478a46d8f991da88a69bb8b73c66ce12e48a4570c3a5050f.exe.bin

  • SHA256 044685b4ab7d6662478a46d8f991da88a69bb8b73c66ce12e48a4570c3a5050f
  • MD5 SHA1 SHA512 SSDEEP
windowsx86

  • Ardamax main executable

  • Matiex Main payload

  • Snake Keylogger payload

  • XMRig Miner payload

    miner

  • HTTP links in PDF interactive object

    Detects HTTP links in interactive objects within PDF files.

    pdflink

  • Unsigned PE

    Checks for missing Authenticode signature.

Minor OS version
Major OS version
Entry point
480
Magic Number
267
Subsystem
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE
PDB paths