Cuckoo Sandbox

Name	64d4632c338de5c4_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	286.4KB
Processes	2564 (f215b961c3e6cc08_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`527992016e20f1405d41863b6223cb6d`
SHA1	`149868323787519b4595c85690bbadbd8df26cff`
SHA256	`64d4632c338de5c41827b244d7b5f145e63f9d33094da95ba8649eb8752d6875`
CRC32	`BD29E430`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	81c73ba7fe05a165_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	286.4KB
Processes	1528 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`7d59afb7855d9cc7c60ab1b1e8920352`
SHA1	`3b65455c9548bf22faf2175e26ee3975c786ef7c`
SHA256	`81c73ba7fe05a1654a6c06bab0c81512db85d5969194dc15ea0928b2c663e4d4`
CRC32	`23226B39`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files