Cuckoo Sandbox

Name	1cdbf143c9d16c0d_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	92.3KB
Processes	1360 (b5152728d0ad47d0_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`3e1689f6d892454a3ab45a0e912ceff0`
SHA1	`684bf2c3fe92c28bae9bbad61ed89c4478bd9e05`
SHA256	`1cdbf143c9d16c0dbcd75b692aea81d600d4cd2a55cc886c42795952d0808c7c`
CRC32	`F9A6565A`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	f6818fd384fa6ceb_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	92.3KB
Processes	1380 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`9869eb9927f502b26f96b1d08ca1c8f4`
SHA1	`2bb44a6db21ca56c2f48e7898a940aca41e666b5`
SHA256	`f6818fd384fa6cebb09349474bf129e91c61642fc7ae7d8f94b47b95dfd96e77`
CRC32	`133AB7D7`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files