Cuckoo Sandbox

Name	3cef0fa967599dfa_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	82.2KB
Processes	2552 (a8bb8d43053b171d_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`c0a0839c78519bf64365221f9a1b8d36`
SHA1	`7155fd72a43d3dad5c944a051df71bc33d20eb90`
SHA256	`3cef0fa967599dfa5014374e92c508b00b8b20029698ff89f8f4c163d911bc1d`
CRC32	`1B9EB32E`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	1ff1865ea45bc411_backup.exe Download Submit file
Filepath	C:\backup.exe
Size	82.2KB
Processes	2032 (backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`e3529bf1a4e725ee2843d61aa424a6b4`
SHA1	`f78f24c1a402d3d8ccb0f6830a0014026a7f83a5`
SHA256	`1ff1865ea45bc411930dd05960e4fb3846570c7f55e612fd7eb206d296ed41bd`
CRC32	`166D6A49`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files