Try VMRay Platform
Malicious
Classifications

Spyware Keylogger

Threat Names

Mal/Generic-S SnakeKeylogger

Dynamic Analysis Report

Created on 2023-03-16T23:52:19+00:00

221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe

Windows Exe (x86-32)
...

Remarks (1/1)

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe Sample File Binary
Malicious
...
»
Also Known As C:\Users\RDhJ0CNFevzX\AppData\Roaming\IFNGRZH.exe (Accessed File)
MIME Type application/vnd.microsoft.portable-executable
File Size 766.00 KB
MD5 cc17147aa1a1f904d8b9aef3516b804e Copy to Clipboard
SHA1 6cc7070b205acdd8b136889cc7d8042201a09ef0 Copy to Clipboard
SHA256 221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171 Copy to Clipboard
SSDeep 12288:jzAuF5iJGRTwdx8SQ7ZluhjvOmODV17VfGuVr4UG4mHd/wunj/N/VI04:LFEJTUdshjvUD/7d1r1unx/VI0 Copy to Clipboard
ImpHash f34d5f2d4577ed6d9ceec516c1f5a744 Copy to Clipboard
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x00400000
Entry Point 0x004BCD7E
Size Of Code 0x000BB600
Size Of Initialized Data 0x00004000
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_I386
Compile Timestamp 2023-03-15 04:44 (UTC+1)
Version Information (11)
»
Comments -
CompanyName Sky123.Org
FileDescription radarsystem
FileVersion 1.0.0.0
InternalName fKN.exe
LegalCopyright Copyright © Sky123.Org
LegalTrademarks -
OriginalFilename fKN.exe
ProductName radarsystem
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00402000 0x000BB57C 0x000BB600 0x00000200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 7.81
.rsrc 0x004BE000 0x00003E00 0x00003E00 0x000BB800 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 7.82
.reloc 0x004C2000 0x0000000C 0x00000200 0x000BF600 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.1
Imports (1)
»
mscoree.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CorExeMain - 0x00402000 0x000BCD54 0x000BAF54 0x00000000
Memory Dumps (16)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe 1 0x00DA0000 0x00E63FFF Relevant Image False 32-bit - False
...
buffer 1 0x01160000 0x01177FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x01140000 0x01145FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x07AF0000 0x07B89FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x01140000 0x01145FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe 1 0x00DA0000 0x00E63FFF Final Dump False 32-bit - False
...
buffer 1 0x07B90000 0x07B93FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x07ED0000 0x07EF4FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 1 0x07B90000 0x07B93FFF Reflectively Loaded .NET Assembly False 32-bit - False
...
buffer 7 0x00400000 0x00425FFF Content Changed False 32-bit - False
...
221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe 7 0x005B0000 0x00673FFF Relevant Image False 32-bit - False
...
221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe 1 0x00DA0000 0x00E63FFF Process Termination False 32-bit - False
...
buffer 7 0x043BE000 0x043BFFFF First Network Behavior False 32-bit - False
...
buffer 7 0x00187000 0x0018FFFF First Network Behavior False 32-bit - False
...
buffer 7 0x00400000 0x00425FFF First Network Behavior False 32-bit - False
...
221e4f5c1f12b340bde3be53c3ab9bdbf4940b4d9d22aa5a451a06a06572c171.exe 7 0x005B0000 0x00673FFF First Network Behavior False 32-bit - False
...
C:\Users\RDhJ0CNFevzX\AppData\Local\Temp\tmp16B3.tmp Dropped File Text
Clean
...
»
MIME Type text/xml
File Size 1.56 KB
MD5 df977a0edbe4f34177380540c8caf338 Copy to Clipboard
SHA1 67f4005a0f9d5b3cef8de0f5ef08a0cdf78f17d6 Copy to Clipboard
SHA256 493f65e79af5a168fcf79b4557b85b5598f853f39bbffe7e9cfa3c63548160cd Copy to Clipboard
SSDeep 24:2di4+S2qh9Y1Sy1mlUnrKMhEMOFGpwOzNgU3ODOiIQRvh7hwrgXuNto+xvn:cge2UYrFdOFzOzN33ODOiDdKrsuToyv Copy to Clipboard
ImpHash -
1cd5527f780c5023ee64244b5d3cd9ed1adc55b06bc3bd2bf0d30a58e43e5969 Downloaded File HTML
Clean
...
»
MIME Type text/html
File Size 104 Bytes
MD5 466de80be5e8b785131d356524726550 Copy to Clipboard
SHA1 3b5bb162df47e1ef32dfb62873b2916e383dc506 Copy to Clipboard
SHA256 1cd5527f780c5023ee64244b5d3cd9ed1adc55b06bc3bd2bf0d30a58e43e5969 Copy to Clipboard
SSDeep 3:qVZxgROCQ+y8RRCXbZ6SXOy0Wt2LQeuc2:qzxU4+b3CX96kOPo0x92 Copy to Clipboard
ImpHash -
6422009ebb2d117a18193a60242ae969355fe091e2a47c8ee54b2bfb3204514a Extracted File Image
Clean
...
»
Parent File C:\Users\RDhJ0CNFevzX\AppData\Roaming\IFNGRZH.exe
MIME Type image/png
File Size 13.91 KB
MD5 1f093c2126dd5419fb37070d6392d3e8 Copy to Clipboard
SHA1 02aa644064a63f064437fc4647845aa410402103 Copy to Clipboard
SHA256 6422009ebb2d117a18193a60242ae969355fe091e2a47c8ee54b2bfb3204514a Copy to Clipboard
SSDeep 384:UVgmi+Uz7HUzTiT4IlsCkYpkIa7seOM7Uhd6IAdw:ejKz7Ai0Ss1sYOMYhYI8w Copy to Clipboard
ImpHash -
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image