Static task
static1
Behavioral task
behavioral1
Sample
902cf40fb643625d724e2c1f0a000b00N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
902cf40fb643625d724e2c1f0a000b00N.exe
Resource
win10v2004-20240802-en
General
-
Target
902cf40fb643625d724e2c1f0a000b00N.exe
-
Size
57KB
-
MD5
902cf40fb643625d724e2c1f0a000b00
-
SHA1
39ca90dd8a52f8d2b1bf4f460bfcfb0256ed8827
-
SHA256
8ab13203d5772e20ba1f41d937d64ddc0dd434044497cec1e094d97e891f7da7
-
SHA512
653d30a6ac584d152c4cdf34d13e7902496688d7d4f1d9a3f3353948105c2d7e866c38229702e37957cd12e66a4cf26daa49bb223e6b321f20968460bf131167
-
SSDEEP
1536:744701lIWnffqhvCq5LixkA2BOHpbwzF7bK+:7j7CIWnfih3AHpkzF7bK+
Malware Config
Signatures
-
Detected Nirsoft tools 1 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule sample Nirsoft -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 902cf40fb643625d724e2c1f0a000b00N.exe
Files
-
902cf40fb643625d724e2c1f0a000b00N.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 36KB - Virtual size: 35KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ