Extracted

• • Target
    d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf
  • Size 170KB
  • SHA256 d3b3a4973f2513fc0513039eab279fc808fcb48ce4ce3a0bc5c3b734217cafaf
  • MD5 901ff7df218f19164e4d289fd6a7064e
  • SHA1 4bdceade9e88243e39c4c0ce1c6293bc88e9fa92
  • SHA512 6c4446228e4391bd94a1af2cadb7a809bcf8ce7e4e0cbf2e1935f6545e2334a734fedb2187f02ecbf4f8d34bb702e76a12ded19dd32ea4e964b254ef2fec8398
  • SSDEEP 3072:e51Wa8DwZU1jQupA47HGdK9ezOWSOSBdC2jPO7c4SyUMCx1asgG4PPAs2TH6Pz9L:e51Wa8DsU1jQKA47HGdK9ezOWSOSBdCL
  • TLSH
    T1B0048D2570D2C0B3D476193114F48BB19ABDBC710B915EBB27E81B3E2E346E19527AB3
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  9^/10

  discoverydefense_evasion

  • Enumerates VirtualBox registry keys

    defense_evasion

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Looks for VirtualBox Guest Additions in registry

    defense_evasion

  • Downloads MZ/PE file

  • Looks for VMWare Tools registry key

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks system information in the registry

    System information is often read in order to detect sandboxing environments.

  behavioral1behavioral2