Cuckoo Sandbox

Name	929f306071bc8cdd_fdxvpnhfax.exe Download Submit file
Filepath	C:\Temp\fdxvpnhfax.exe
Size	361.0KB
Processes	1248 (rljebwuomgeywroj.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`983c6ff8632684e982ed3aad51873dff`
SHA1	`989609158ba7b1a8f9997d2ea3af8a1758b48b4f`
SHA256	`929f306071bc8cdde1370d3755fa076cf0b30212a8516e439c47aefe47c1ba77`
CRC32	`C3626231`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Name	3bf658af03fe3ce0_i_fdxvpnhfax.exe Download Submit file
Filepath	C:\Temp\i_fdxvpnhfax.exe
Size	361.0KB
Processes	1248 (rljebwuomgeywroj.exe)
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a7b901e1d0dcd03b6520ade21caef755`
SHA1	`9923b0f9780d89db292a51cf205aa40bff79bc58`
SHA256	`3bf658af03fe3ce0cdaf0706dfcc251481786b954b73e303a073f474bdd07d77`
CRC32	`58C284AF`
ssdeep	`None`
Yara	vmdetect - Possibly employs anti-virtualization techniques anti_dbg - Checks if being debugged inject_thread - Code injection with CreateRemoteThread in a remote process create_service - Create a windows service network_http - Communications over HTTP network_dropper - File downloader/dropper network_tcp_socket - Communications over RAW socket escalate_priv - Escalade priviledges screenshot - Take screenshot keylogger - Run a keylogger
VirusTotal	Search for analysis

Dropped Files