Try VMRay Platform
Malicious
Classifications

Spyware Injector

Threat Names

AgentTesla AgentTesla.v4

Dynamic Analysis Report

Created on 2024-06-10T07:06:57+00:00

2023081921.exe

Windows Exe (x86-64)
...

Remarks (1/1)

(0x02000008): One or more processes crashed during the analysis. Analysis results may be incomplete.

Filters:
File Name Category Type Verdict Actions
C:\Users\kEecfMwgj\Desktop\2023081921.exe Sample File Binary
Malicious
...
»
MIME Type application/vnd.microsoft.portable-executable
File Size 2.28 MB
MD5 f1fff084da0c4dab27b7eafbeb49aedb Copy to Clipboard
SHA1 5367ffc156f6d224d83c3566c811d308692506a7 Copy to Clipboard
SHA256 16bd420d8eb671ac24fe12160403e5d95b9a3b0f5e13a286c36dbeb363ccadb7 Copy to Clipboard
SSDeep 3072:NnJXq/vdkF+1flC3vw3+6YsdywnYFRMCdkxzGuP0ULga6Z6XWExYgrMqTfiL5UU7:NnJJ Copy to Clipboard
ImpHash -
PE Information
»
Image Base 0x00400000
Size Of Code 0x00242E71
Size Of Initialized Data 0x00006032
File Type IMAGE_FILE_EXECUTABLE_IMAGE
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Machine Type IMAGE_FILE_MACHINE_AMD64
Compile Timestamp 2096-02-04 11:38 (UTC)
Version Information (11)
»
Comments Update from Java t
CompanyName Update from Java
FileDescription Update from Java
FileVersion 1.0.0.0
InternalName NorthAmericaUpdate.exe
LegalCopyright Copyright © 2024
LegalTrademarks -
OriginalFilename NorthAmericaUpdate.exe
ProductName Update from Java
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0
Sections (2)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x00402000 0x00242E71 0x00243000 0x00000200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 3.1
.rsrc 0x00646000 0x0000604E 0x00006200 0x00243200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.63
Memory Dumps (25)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point YARA Actions
2023081921.exe 1 0x00BF0000 0x00E3DFFF Relevant Image False 64-bit - False
...
buffer 1 0x00AC0000 0x00AF9FFF Reflectively Loaded .NET Assembly False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Reflectively Loaded .NET Assembly False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
buffer 1 0x1B350000 0x1B3DEFFF Marked Executable False 64-bit - False
...
2023081921.exe 1 0x00BF0000 0x00E3DFFF Process Termination False 64-bit - False
...
e74fdc72000449bdd24e559d7db4a16b831037dcaf9ed213ad5a6d7199f30158 Extracted File Image
Clean
...
»
Parent File C:\Users\kEecfMwgj\Desktop\2023081921.exe
MIME Type image/png
File Size 7.16 KB
MD5 ae13114fd29fabf469ef77d3349f25cc Copy to Clipboard
SHA1 eb02aa734c4b72a04c3d231756283a110a443e67 Copy to Clipboard
SHA256 e74fdc72000449bdd24e559d7db4a16b831037dcaf9ed213ad5a6d7199f30158 Copy to Clipboard
SSDeep 96:qJ2W8ZlcY3aq+yeq8QgYDrCasPi6ZK0vCiW3aAW9dUt9qvw4hpbGHjFoNA:qJP8ZKq4qNgYDrFswaAW92G/mV Copy to Clipboard
ImpHash -
VMRay - Analyzer - www.vmray.com
Legal Note - Privacy Policy
Function Logfile
Download-Icon
Exit-Icon

This feature requires an online-connection to the VMRay backend.

An offline version with limited functionality is also provided.
The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\". 


    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting \"security.fileuri.strict_origin_policy\".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    

     Exit-Icon
    

    

     

      WHOIS Domain Information
     

     

      

       
        Domain Name
       
       
       
      

      

       
        WHOIS Response
       
       
        

       		
      

     

    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image