Static task
static1
Behavioral task
behavioral1
Sample
55b739cea74185bdf8097929ea6f0dc0N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
55b739cea74185bdf8097929ea6f0dc0N.exe
Resource
win10v2004-20240709-en
General
-
Target
55b739cea74185bdf8097929ea6f0dc0N.exe
-
Size
187KB
-
MD5
55b739cea74185bdf8097929ea6f0dc0
-
SHA1
5a8c6d340739bbb585343f790ea1afd4345b84a3
-
SHA256
f1e2a3d06721d3358a0707917aea5d67389f211ccf2d3c57b67d19cfe8ccc05a
-
SHA512
b0580652c7afbb8450ae6530408918f1ccd40f9cb9aa5da867d92a9db5ef6b1d81a356f798e50b2ec3645bf32935b4426fc66336545f07f140ababc2f419d0a9
-
SSDEEP
3072:JV8u9/7yuWn2b6qCWLeO0qg6iAlNB6m7f3t2lQBV+UdE+rECWp7hK2gw:JV8Ddn2nCjtqg6iwNoyBV+UdvrEFp7hr
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 55b739cea74185bdf8097929ea6f0dc0N.exe
Files
-
55b739cea74185bdf8097929ea6f0dc0N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 67KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ