Try VMRay Platform
Malicious
Classifications

Backdoor

Threat Names

Mal/Generic-S

Dynamic Analysis Report

Created on 2024-03-04T17:00:39+00:00

f364d1b15bb2049549d9084496ad239b.exe

Windows Exe (x86-64)
...

Remarks (1/1)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "20 minutes, 32 seconds" to "30 seconds" to reveal dormant functionality.

Remarks

(0x0200005D): 2037 additional dumps with the reason "Content Changed" and a total of 29552 MB were skipped because the respective maximum limit was reached.

(0x0200004A): 3 dump(s) were skipped because they exceeded the maximum dump size of 16 MB. The largest one was 512 MB.

Filters:
File Name Category Type Verdict Actions
C:\Users\RDhJ0CNFevzX\Desktop\f364d1b15bb2049549d9084496ad239b.exe Sample File Binary
Malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 4.79 MB
MD5 f364d1b15bb2049549d9084496ad239b Copy to Clipboard
SHA1 adbe8eb29c5e442a8515ba9c63a62126427ada8e Copy to Clipboard
SHA256 e846d3cfad85b09f8fdb0460fff53cfda1176f4e9e420bf60ed88d39b1ef93db Copy to Clipboard
SSDeep 98304:GL4AFoEMQEbPjwV/xQzp2FMhsTBfkIS2oFw5gmpp4k:26EMnb7kZw4FMaTRkItym Copy to Clipboard
ImpHash 9aebf3da4677af9275c461261e5abde3 Copy to Clipboard
File Reputation Information
»
Verdict
Malicious
Names Mal/Generic-S
PE Information
»
Image Base 0x140000000
Entry Point 0x140E80830
Size Of Code 0x004CA000
Size Of Initialized Data 0x00001000
Size Of Uninitialized Data 0x009B6000
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Machine Type IMAGE_FILE_MACHINE_AMD64
Compile Timestamp 1970-01-01 01:00 (UTC+1)
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
UPX0 0x140001000 0x009B6000 0x00000000 0x00000200 IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 0.0
UPX1 0x1409B7000 0x004CA000 0x004C9C00 0x00000200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 7.92
.rsrc 0x140E81000 0x00001000 0x00000600 0x004C9E00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE 5.2
Imports (2)
»
KERNEL32.DLL (4)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
LoadLibraryA - 0x140E81528 0x00E81528 0x004CA328 0x00000000
ExitProcess - 0x140E81530 0x00E81530 0x004CA330 0x00000000
GetProcAddress - 0x140E81538 0x00E81538 0x004CA338 0x00000000
VirtualProtect - 0x140E81540 0x00E81540 0x004CA340 0x00000000
msvcrt.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
exit - 0x140E81550 0x00E81550 0x004CA350 0x00000000
Memory Dumps (29)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF First Execution False 64-bit 0x7FF6C82D0A80 False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF Content Changed False 64-bit 0x7FF6C7D3ACE0 False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF Content Changed False 64-bit 0x7FF6C74514E0 False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF Content Changed False 64-bit 0x7FF6C7D3AE80 False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF Content Changed False 64-bit 0x7FF6C7D35D30 False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF Content Changed False 64-bit 0x7FF6C749BC40 False
...
buffer 1 0x3DB65FE000 0x3DB65FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x3DB63FE000 0x3DB63FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x3DB61FD000 0x3DB61FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x3DB5FFE000 0x3DB5FFFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x3DB5DFE000 0x3DB5DFFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x3DB59FD000 0x3DB59FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0xC000000000 0xC0003FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171A9EB0000 0x171A9ECFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171A9FD0000 0x171AA00FFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AA010000 0x171AA01FFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AA020000 0x171AA02FFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AA030000 0x171AA06FFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AA070000 0x171AA0AFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AB800000 0x171AB8FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AB900000 0x171AC0FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171AE130000 0x171AE130FFF First Network Behavior False 64-bit - False
...
buffer 1 0x171C0280000 0x171C0280FFF First Network Behavior False 64-bit - False
...
buffer 1 0x171E0280000 0x171E0280FFF First Network Behavior False 64-bit - False
...
buffer 1 0x171F0100000 0x171F08FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171F0900000 0x171F09FFFFF First Network Behavior False 64-bit - False
...
buffer 1 0x171F0A00000 0x171F0A3FFFF First Network Behavior False 64-bit - False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF First Network Behavior False 64-bit 0x7FF6C7805F00 False
...
f364d1b15bb2049549d9084496ad239b.exe 1 0x7FF6C7450000 0x7FF6C82D1FFF Process Termination False 64-bit - False
...
C:\Users\RDHJ0C~1\AppData\Local\Temp\system.txt Dropped File Text
Clean
...
»
Also Known As system.txt (Archive File, Miscellaneous File)
Parent File C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\os6nBSYL-46246cf2-4ef3-491d-866c-5d417187d893.zip
MIME Type text/plain
File Size 535 Bytes
MD5 73b17f5d4863bef4be5395dc4281f9a6 Copy to Clipboard
SHA1 e5b272665339f6dc41224fa4b17164f0a0e002bf Copy to Clipboard
SHA256 4d064bae23085e238a30783829220be9f90e6886856633f5e43e525787157ec9 Copy to Clipboard
SSDeep 12:0b3XTHP/h2oQEMyKwEHdloBhavkHgMJDQCvC:0bnTvZ2oQqhBhavkAMJDQCa Copy to Clipboard
ImpHash -
C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\os6nBSYL-46246cf2-4ef3-491d-866c-5d417187d893.zip Downloaded File ZIP
Clean
...
»
Also Known As C:\Users\RDHJ0C~1\AppData\Local\Temp\os6nBSYL-46246cf2-4ef3-491d-866c-5d417187d893.zip (Accessed File)
C:\Users\RDHJ0C~1\AppData\Local\Temp\os6nBSYL.zip (Downloaded File, Accessed File)
MIME Type application/zip
File Size 446 Bytes
MD5 d6da45f842ac4df4fb12513dcbfe74cb Copy to Clipboard
SHA1 e63fd141a42411fa36bb52310730b44160ebbd76 Copy to Clipboard
SHA256 a31ad03b83f0aa4e4eb8372b46c25c46f2d217de855b1a3cd388a38806c35447 Copy to Clipboard
SSDeep 12:5jMPI+mt3bk7Euvi0+NZ6vRkQ0Fg0dWbKi97xcXv+1a/t:9UXmu7ti0+NVFgH1xcmSt Copy to Clipboard
ImpHash -
Archive Information
»
Number of Files 1
Number of Folders 0
Size of Packed Archive Contents 312 Bytes
Size of Unpacked Archive Contents 535 Bytes
File Format zip
Contents (1)
»
File Name Packed Size Unpacked Size Compression Is Encrypted Modify Time Verdict Recursively Submitted Actions
system.txt 312 Bytes 535 Bytes Deflate False -
Clean
-
...
966a3882930698ad2c64ee8f3a296458406f97c46815555dd91a5b9182300fac Downloaded File Unknown
Clean
...
»
MIME Type application/json
File Size 524 Bytes
MD5 c3909ba2de5bb5102b1e28fae6e06200 Copy to Clipboard
SHA1 4107ed41463cc263cc9957b4aa4c9bf9c93ed154 Copy to Clipboard
SHA256 966a3882930698ad2c64ee8f3a296458406f97c46815555dd91a5b9182300fac Copy to Clipboard
SSDeep 12:YKSD4Yb/Fz12YXD7fBOYMxp4WctvkHIomlbSvM7DJQbC:YKKbUD/ytvkopbS0JQe Copy to Clipboard
ImpHash -
a99a755129d0d6cca666ccc51c6df69f77ee5292a9588e48702184bd23234eff Downloaded File Unknown
Clean
...
»
MIME Type application/json
File Size 312 Bytes
MD5 0da74ca805681cbdc27b794107d13f9a Copy to Clipboard
SHA1 04b42814d6719c075213ec56ba740c32fc0f1fe3 Copy to Clipboard
SHA256 a99a755129d0d6cca666ccc51c6df69f77ee5292a9588e48702184bd23234eff Copy to Clipboard
SSDeep 6:jK95rWMG9xExVmZmFNH0//fwLiJpWYgpBjF/W35jY:OTCMGj8XHUXBpCBJA5k Copy to Clipboard
ImpHash -
84da13f8b72911e62aaead5af60e91beee6af925c7f926f3d426b6f7bc346619 Downloaded File Unknown
Clean
...
»
MIME Type application/json
File Size 66 Bytes
MD5 f1b8da12185c8d221b2c5d6009675429 Copy to Clipboard
SHA1 c01c0c2338f252991ea27e89a3770989f05c9769 Copy to Clipboard
SHA256 84da13f8b72911e62aaead5af60e91beee6af925c7f926f3d426b6f7bc346619 Copy to Clipboard
SSDeep 3:YWQRAW6pEfHRbx9H0+yd4:YWQmD2xd9yd4 Copy to Clipboard
ImpHash -
c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Downloaded File Unknown
Clean
Known to be clean.
...
»
MIME Type application/json
File Size 16 Bytes
MD5 7363e85fe9edee6f053a4b319588c086 Copy to Clipboard
SHA1 a15e2127145548437173fc17f3e980e3f3dee2d0 Copy to Clipboard
SHA256 c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Copy to Clipboard
SSDeep 3:YWQRAW64:YWQmq Copy to Clipboard
ImpHash -
File Reputation Information
»
Verdict
Clean
Known to be clean.
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image