Managed XDR

c-programdata-nnfomhh06509-nnfomhh06509.exe — malware analysis report

File info

Filename
c-programdata-nnfomhh06509-nnfomhh06509.exe
File type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
File size
396.5 KB
First seen
Last seen

Environment

win7/x86 en

Hashes

SHA1
96ba456f2d22f3f7c1749d7a07ef93a2562257e6
SHA256
a8fc9a078b21b0371b693e3d2469b7d8f34fc9b7cf0c488220aebbc2dc6b133b
MD5
e73e23a0f80f30ca736ecc3219fed391

Signatures

Privilege Escalation

T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1134 opens_process_token: Opens the access token associated with a process

Other

yara_rules: Static rules
no_graphical_activity: No graphic activity
has_pdb: This executable file has a PDB path