SpyNote[.]exe | Triage™

General

Target
SpyNote.exe
Size 9.3MB
Sample261102-ndmaxabt9m
SHA256 b6627af4e2e2b53de946fea26bd9690775c2324e6fc534d67882374249d73462
MD5 06e54b22a1a9b835475421598ed5b67d
SHA1 ef871d5cb957a8eba99b035cb7224d9168a40f98
SHA512 ffe80b4b25778aacddcb8d315e6f5805c17e6f5cff263473771447575e3366b018bda0eade1d7550001cc3fe11a570c86f4e423afdfc9e96813df78ecf8d2772
SSDEEP 196608:+VuVZUjcUG4raKu24YY7HVT4hV0AD6QgqKRgX:+G6mKr4YYH+EUWpgX
TLSH
T169A6128CBFC7AF5FEA891AB51D4296633724D0233B93A391E7366D371DD90A257022C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

agilenet

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

resource	yara_rule
sample	agile_net

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SpyNote.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 b6627af4e2e2b53de946fea26bd9690775c2324e6fc534d67882374249d73462
MD5 06e54b22a1a9b835475421598ed5b67d
SHA1 ef871d5cb957a8eba99b035cb7224d9168a40f98
SHA512 ffe80b4b25778aacddcb8d315e6f5805c17e6f5cff263473771447575e3366b018bda0eade1d7550001cc3fe11a570c86f4e423afdfc9e96813df78ecf8d2772
SSDEEP 196608:+VuVZUjcUG4raKu24YY7HVT4hV0AD6QgqKRgX:+G6mKr4YYH+EUWpgX
TLSH
T169A6128CBFC7AF5FEA891AB51D4296633724D0233B93A391E7366D371DD90A257022C1
MD5 SHA1 SHA512 SSDEEP TLSH

Obfuscated with Agile.Net obfuscator

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9602202

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths