Malicious
baf9cea14437b586c05d0aea2082fc43
PE Executable
MD5: baf9cea14437b586c05d0aea2082fc43
Size: 156.16 KB
application/x-dosexec
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with Essential
| MD5 | baf9cea14437b586c05d0aea2082fc43 |
| Sha1 | 433599cf52b16e3c0ebc675ad69abba671af421d |
| Sha256 | c2665146924371e34157e249c8e05b276c52de7280f4b895923dc21b636dfe0f |
| Sha384 | 7b1f9c00341d7446a90b3d64cebe07baaccb9cca867184936ff70b9036dbb64a04d0d0fcb8c7d2a125f05059aa2c2c45 |
| Sha512 | f93bdbd04d2d87ac8533c205cab8745fbb7fccaf9bb2825dc168854f87fe72c3016d6b3c96ce75837e2aad56e2f584b0745e2eb4e603e72b89686c760fc205ca |
| SSDeep | 3072:vEFRh0auCcJVwDjwzTC2SCn/FtVQenIuxIGWsnRR9pLTfavXUowv+F9OerHJvX:c3h0aMJ+Hw3Pgen79/Svk9yb1 |
| TLSH | 38E38D193B93D472E5492B78227F37BCDEB08D362C50CAEBDF80290E4E671905796267 |
PeID
Microsoft Visual C++ v6.0 DLL
STICH
beta
No STICH Path has been generated for this analysis yet.
1 structural branch were classified as secondary (decorative or non-determinant content) and did not produce a fingerprint.
bin
1| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Name | Value |
|---|---|
| Info | PE Detect: PeReader OK (file layout) |
| Info | PDB Path: C:\Users\Administrator\Desktop\vdr1\Release\vdr1.pdb |
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
| Config. Field | Value |
|---|---|
| C2 | https:huhuhuhuhuhuhu |
| Botnet | oohuhuhuhu |
| UserAgent | Mozillhuhuhuhuhuhuhuhuhuhuhu |
| [Configuration Offset] | 0x0huhuhuhu |
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
You must be signed in to view YARA rules.