Cuckoo Sandbox

Name	38d573d80a56c02f_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	101.6KB
Processes	1516 (9120f299cf62f62d_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed
MD5	`50d49d5597ff9fd721f2924eb25e43a5`
SHA1	`4d442185b516ebbeaaeda7235c223dc079f4017c`
SHA256	`38d573d80a56c02f096d14150330da5575642a881f8a55514b37d300d02ded94`
CRC32	`7922BF14`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	73b2566c956ed17b_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	101.6KB
Processes	1472 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, PECompact2 compressed
MD5	`3d3641704843b74100d6255816567aeb`
SHA1	`53105ca58bc26543693b061a143197239ddc56d1`
SHA256	`73b2566c956ed17b2770c443ccb0468ca8be29a83c2ee72dca52efb2ae5020ef`
CRC32	`C9CBEBEF`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files