Cuckoo Sandbox

Name	3893ebbd09cf40cd_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\0C7910BA-F902-421E-9E69-CF9AEE0DD4D7\backup.exe
Size	82.2KB
Processes	1480 (541e4b1225d48f5a_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`5ea328992516063676393adc29273be9`
SHA1	`d52b4e9e6d2460512a5a50917405302b68936142`
SHA256	`3893ebbd09cf40cd5d5d2f906356541a63c8f1ae796e9f42a44473f2d20a37f9`
CRC32	`4F8110EE`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Name	62f7271dfb2d32ad_backup.exe Download Submit file
Filepath	C:\Users\Administrator\AppData\Local\Temp\hsperfdata_Administrator\backup.exe
Size	82.2KB
Processes	1480 (541e4b1225d48f5a_backup.exe)
Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
MD5	`cc3314709db32455d98b4cc1273ee42e`
SHA1	`7496b945d487fd78a4e611d1650dbe48dae8f27b`
SHA256	`62f7271dfb2d32ad257f9e24df8f2ae4d027dbe7d3b4923108a55b397781c751`
CRC32	`DF3E0D7F`
ssdeep	`None`
Yara	suspicious_packer_section - The packer/protector section names/keywords SEH__vba - (no description) escalate_priv - Escalade priviledges win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token
VirusTotal	Search for analysis

Dropped Files