General
- Target c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080
- Size 202KB
- Sample260919-sb7laasbqa
- SHA256 c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080
Score
9/10
Malware Config
Targets
-
- Target Files/StickyNotes/StickyNotes.vbs
- Size 733B
- SHA256 491f73ccda6ab648edee2ef6c8e0cd2695f5bb7f2e541aba9672aa05a17d840d
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes a VBScript file via the Windows Script Host.
-
- Target Files/nircmd/NirCmd.chm
- Size 44KB
- SHA256 e050308c4a297f637a848109d719c65a62f6ab6ed0d854d026cc2df257515d32
Score1/10 -
- Target Files/nircmd/nircmd_x64.exe
- Size 113KB
- SHA256 14801ff8d189dcd12374101754d0212be499fcea3cd2b967d1ae21e8bd6201e0
Score1/10 -
- Target Files/nircmd/nircmd_x86.exe
- Size 43KB
- SHA256 11f02159cd9e001e9c8eb6ab3875132f77b9e9e8af981d45d182ec71ce68c5ad
Score9/10-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft NirCmd
NirCmd is a lightweight Windows command-line tool for automating system tasks
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.