General
- Target jaffacakes118_Corel.Painter.Essentials.v4.0.REPACK.ISO-TBE.exe
- Size 740KB
- Sample260910-exb5lsztet
- SHA256 69e3ac32bb5984b2b3899562c576b0c5d982bfe7083d44a83475b6a5ce187ab1
- MD5 973a3d01edbbf3d0cd7cc90c6c431efa
- SHA1 a88287b1a5bfb1ea460b7abe2f7d8a9088ac5e5c
- SHA512 42d97e1fc771a7cb885c5e2107a85b016d94b74db92011c0eee82f97b2621438dc06dde655db6083b4cb5fcdf73fd0e568c0ce1f1842a88d2291d852ad7bfea9
- SSDEEP 6144:Mu3Zecer2C46OwQMz/Z/kpX1GZPpKwtblQ2Gae9qhQV2AjUwsGKfS:XAcert4fwQMrlkdFwbK2XeohAZsGKf
- TLSH T116F423BE7391D128E842C2300CB797AAD37BFD560E13CD9B2595B24ABC359429F35907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
jaffacakes118_Corel.Painter.Essentials.v4.0.REPACK.ISO-TBE.exe
Resource
win10v2004-20260513-en
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
jaffacakes118_Corel.Painter.Essentials.v4.0.REPACK.ISO-TBE.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
Malware Config
Targets
-
- Target jaffacakes118_Corel.Painter.Essentials.v4.0.REPACK.ISO-TBE.exe
- Size 740KB
- SHA256 69e3ac32bb5984b2b3899562c576b0c5d982bfe7083d44a83475b6a5ce187ab1
- MD5 973a3d01edbbf3d0cd7cc90c6c431efa
- SHA1 a88287b1a5bfb1ea460b7abe2f7d8a9088ac5e5c
- SHA512 42d97e1fc771a7cb885c5e2107a85b016d94b74db92011c0eee82f97b2621438dc06dde655db6083b4cb5fcdf73fd0e568c0ce1f1842a88d2291d852ad7bfea9
- SSDEEP 6144:Mu3Zecer2C46OwQMz/Z/kpX1GZPpKwtblQ2Gae9qhQV2AjUwsGKfS:XAcert4fwQMrlkdFwbK2XeohAZsGKf
- TLSH T116F423BE7391D128E842C2300CB797AAD37BFD560E13CD9B2595B24ABC359429F35907
- MD5 SHA1 SHA512 SSDEEP TLSH
Score9/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft MailPassView
Password recovery tool for various email clients
-
Accesses Microsoft Outlook accounts
-
Suspicious use of SetThreadContext