Extracted

• • Target

    DHL DELIVERY NOTIFICATIONS_PDF.exe

  • Size

    1.2MB

  • MD5

    db6402598c61afc744302ddee3709138

  • SHA1

    19b9742924e8d6d648fb9a83cf51302a5558b4bb

  • SHA256

    525fb87d7847f492ee968f742edba531d80ea6c877afe7e0b8e36a69203a1df3

  • SHA512

    5e3085aef1725770ca24d484025dac7d0136b6c61f819a9a1bf794a4b76e2f405480e66a0ca416dee12ceb90ba481030ce0b3f83c6f07bd07e5e7224d6ac988d

  • SSDEEP

    12288:FZGWfYACds2n3WLm7rT6mHgTBBEYKRCaavcf0C90ebshTd+doVDTniKmxCyWrDwT:LmPdsKPHwBDKnaC9kDifxEPXWxDCST

  Score

  10^/10

  hawkeye_rebornm00nd3v_loggerinfostealerkeyloggerspywarestealertrojan

  • HawkEye Reborn

    HawkEye Reborn is an enhanced version of the HawkEye malware kit.

    keyloggertrojanstealerspywarehawkeye_reborn

  • M00nd3v_Logger

    M00nd3v Logger is a .NET stealer/logger targeting passwords from browsers and email clients.

    stealerspywarem00nd3v_logger

  • M00nD3v Logger payload

    Detects M00nD3v Logger payload in memory.

    infostealer

  • NirSoft MailPassView

    Password recovery tool for various email clients

  • NirSoft WebBrowserPassView

    Password recovery tool for various web browsers

  • Nirsoft

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2