Dynamic Analysis Report
Created on 2024-03-28T14:37:16+00:00
Point.exe
Windows Exe (x86-32)
Remarks (1/1)
(0x0200000E): The overall sleep time of all monitored processes was truncated from "1 minute, 7 seconds" to "10 seconds" to reveal dormant functionality.
| Filters: |
There are no files for this filter
There are no files in this analysis
| File Name | Category | Type | Verdict | Actions |
|---|
| C:\Users\OqXZRaykm\Desktop\Point.exe | Sample File | Binary |
Malicious
|
|
| MIME Type | application/vnd.microsoft.portable-executable |
| File Size | 1.32 MB |
| MD5 |
3e56975127f436aa5e8a9b9c7af5eb23
|
| SHA1 |
acbf171b31c25a66d7af44bf9e1f5666acaa3f2c
|
| SHA256 |
7d18e238febf88bc7c868e3ee4189fd12a2aa4db21f66151bb4c15c0600eca6e
|
| SSDeep |
12288:2jwHlbKaWY6oL1T0uwJ34dW/QtQF5KXGOTBwfRzPZ15HVCjkNMOuEFcd+wtZqA8s:2yHC/QtQF5kGXZPY+1BFc2AZoyLtkwx
|
| ImpHash |
44c9a0d6caae769769c87976fb6f71d4
|
Memory Dumps (46)
| Name | Process ID | Start VA | End VA | Dump Reason | PE Rebuild | Bitness | Entry Point | YARA | Actions |
|---|---|---|---|---|---|---|---|---|---|
| point.exe | 1 | 0x00400000 | 0x0055DFFF | First Execution |
|
32-bit | 0x0048EB4E |
|
|
| point.exe | 1 | 0x00400000 | 0x0055DFFF | Content Changed |
|
32-bit | 0x004B2E04 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | First Execution |
|
32-bit | 0x021A4D80 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A3204 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A2960 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219664C |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219F7F4 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A3B16 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A4388 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219D85F |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219F7F4 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A3800 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A4388 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219D85F |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219F8A0 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219E538 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A3B16 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A4388 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219D85F |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A3B16 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A4388 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219F7F4 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219E538 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219D85F |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219F8A0 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219D85F |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219F8A0 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219E538 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A3B16 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A4388 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02191022 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219A56C |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02196673 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02195F84 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A1C70 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219BB24 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x021A02C4 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02192000 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02193564 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02198F68 |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x0219728A |
|
|
| buffer | 1 | 0x02190000 | 0x021C2FFF | Content Changed |
|
32-bit | 0x02197000 |
|
|
| buffer | 1 | 0x00617458 | 0x0061A057 | Dump Rule: PikabotConfig |
|
32-bit | - |
|
|
| buffer | 1 | 0x02150000 | 0x02180FFF | Image In Buffer |
|
32-bit | - |
|
|
| buffer | 1 | 0x02314020 | 0x0241401F | Image In Buffer |
|
32-bit | - |
|
|
| point.exe | 1 | 0x00400000 | 0x0055DFFF | Process Termination |
|
32-bit | - |
|
|
| 358d30e2edfeda95d4f9c6c26faff95e0c28fedd2a7b004fe467b911ae86baed | Downloaded File | Stream |
Clean
|
|
| MIME Type | application/octet-stream |
| File Size | 7.53 KB |
| MD5 |
5b29599d21ab5d160d93ff69f8dade89
|
| SHA1 |
c84b08b706b33a498ee4bcb14549a0054a28cd3e
|
| SHA256 |
358d30e2edfeda95d4f9c6c26faff95e0c28fedd2a7b004fe467b911ae86baed
|
| SSDeep |
192:Y0ZMeFTPdOYLBdHhpcVkwc5gws2M75s8Lh:BMMdOYLngVd6gb2ML
|
| ImpHash | - |
| 5fd55da8747d933410bb637571802aca2eedf3314039722e2b9d6f37afdad97e | Downloaded File | HTML |
Clean
|
|
| MIME Type | text/html |
| File Size | 552 Bytes |
| MD5 |
eac0a6a53d4a4353aace122055b4b4c8
|
| SHA1 |
b400d2a40c870dd448eed9b418297c3038b9d023
|
| SHA256 |
5fd55da8747d933410bb637571802aca2eedf3314039722e2b9d6f37afdad97e
|
| SSDeep |
12:TD11VI48lI5r8INGlTF5TF5TF5TF5TF5TFK:bGDTPTPTPTPTPTc
|
| ImpHash | - |
| 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 | Extracted File | ZIP |
Clean
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\Point.exe |
| MIME Type | application/zip |
| File Size | 167.57 KB |
| MD5 |
9579dbad66dee207d4cdd4d879cb7366
|
| SHA1 |
3824117ae77f84b1570a16574995351b531dc27d
|
| SHA256 |
4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35
|
| SSDeep |
768:w19autkNYAcEvmCc/nTqpCLniMXqPlrCxlVsofTC5l5sgGGMSTkGZgj2y/DDcQPa:w1bwYCvmzlVsOGOj144MHr9DpkcC4PZ
|
| ImpHash | - |
| maindlg.xml | Archive File | Text |
Clean
|
|
| Parent File | 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 |
| MIME Type | text/xml |
| File Size | 66.52 KB |
| MD5 |
8250dd219957ac1826528031286fa557
|
| SHA1 |
1cb054b59585ebd163552457520c67e1c0d2ae52
|
| SHA256 |
29517678f285518617146eecefb7eb90eec52c46157b025907eba30a742e938a
|
| SSDeep |
768:aiMXqPlrCxlVsofTC5l5sgGGMSTkGZgj2y/DDcn:klVsOGOj14n
|
| ImpHash | - |
| comfirmdlg.xml | Archive File | Text |
Clean
|
|
| Parent File | 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 |
| MIME Type | text/xml |
| File Size | 24.75 KB |
| MD5 |
9ea8cf213b4ccaf3fa175058225991cc
|
| SHA1 |
ac608898bedc64990d56565c5adebb4109c44c6d
|
| SHA256 |
450186cfb582d99c3293c4dff65f61a0465d84403d2eb7d38b9a70beb24b3ae2
|
| SSDeep |
384:ztvtmw4PFe5RC5uX4we0D56TEZwEYw09k4o9DOD9PwCwjeo3RwYgoLdwxqwUn81i:619autkx
|
| ImpHash | - |
| shared.xml | Archive File | Text |
Clean
|
|
| Parent File | 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 |
| MIME Type | text/xml |
| File Size | 23.08 KB |
| MD5 |
36bfa1af6bfcd58f599f6eac96819242
|
| SHA1 |
e39ba3a78715513f7025fd4eb61d73064790f74e
|
| SHA256 |
003e6405827cd78cd858003a49137b830681e0e493d92d219449acbde5d3a84d
|
| SSDeep |
192:KMekzzAuZk42I1ZjhqIJqbdq9wE3qF9ivLDFT9fyEQ/ElscVLy3bb2DImojpR6b8:nb0d25eW3FTIvCDcT
|
| ImpHash | - |
| historydlg.xml | Archive File | Text |
Clean
|
|
| Parent File | 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 |
| MIME Type | text/xml |
| File Size | 21.00 KB |
| MD5 |
39d01dd2140456f4a81c763021ae3ec5
|
| SHA1 |
03fcd5114d6fc4a3160d84bb9a83f6a083577b36
|
| SHA256 |
eb38df58e0da7856241f709dedd78c1a24c33ed50d6edf64bc3e30d7289b727d
|
| SSDeep |
384:F/T/0wEwLPYwu5AmED6weLjyw4JlEUBwZPxwca/wKOCZkRQohwfFfENEwdC2ETpp:F/nTqpCLl
|
| ImpHash | - |
| fssettingsdlg.xml | Archive File | Text |
Clean
|
|
| Parent File | 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 |
| MIME Type | text/xml |
| File Size | 18.61 KB |
| MD5 |
a273f62c306b5bbc95579c236f048795
|
| SHA1 |
0aa02d33c860044dd34bc4418440d02a1ab2afe1
|
| SHA256 |
8868b4bd390c9af6c4262647c3342229c1c3700642516d69dd6083a61da95c27
|
| SSDeep |
384:Cx7AvqAwLPYGo5A/ED6weLFw4wuEZd3wZDPa9D6g2979awKSNEO7sodw5U75n0Yj:2AcEvmCO
|
| ImpHash | - |
| selfilefolderdlg.xml | Archive File | Text |
Clean
|
|
| Parent File | 4c7a804943b6045eff60f06b880597e5936a4357feb288cf706ee33e429ecc35 |
| MIME Type | text/xml |
| File Size | 12.48 KB |
| MD5 |
35816e0f97b455df55c9eea4cb97dac8
|
| SHA1 |
1f82790b41e80832f6ca092a105229000906a564
|
| SHA256 |
3636a72aab93e4bf482a72ebc5d15ef8add0ceb8ac83f02b4db6ddcc4c3ed7e7
|
| SSDeep |
384:ztk8tktw4PpC5jQ4EQX4weC4EpnwVRgwu0MJtgW9R4OjZ+Z5:+PFMHr9Dm
|
| ImpHash | - |
| 25f4f15ebdeac56a824c398367290cee6334657593ba32b78eb80e58ebaabddf | Extracted File | Image |
Clean
|
|
| Parent File | C:\Users\OqXZRaykm\Desktop\Point.exe |
| MIME Type | image/png |
| File Size | 3.99 KB |
| MD5 |
ecf8a23b96517d8eadbe017e703ed6e8
|
| SHA1 |
4084d9c04487db3acf40f30e7b8f291f4ee50fab
|
| SHA256 |
25f4f15ebdeac56a824c398367290cee6334657593ba32b78eb80e58ebaabddf
|
| SSDeep |
96:KuYzm7X4wM6KQQw55HEQB0Rc19EekwwTKh4wwwwgzEViwwr1i3H:KuYK7owMrQQw5s+19VkwwTJwwwwniww4
|
| ImpHash | - |
