top title background image
flash

file.exe

Status: finished
Submission Time: 2023-06-06 17:12:09 +02:00
Malicious
Ransomware
Evader

Comments

Tags

  • exe

Details

  • Analysis ID:
    882703
  • API (Web) ID:
    1249682
  • Analysis Started:
    2023-06-06 17:15:39 +02:00
  • Analysis Finished:
    2023-06-06 17:24:25 +02:00
  • MD5:
    e2c4c4dd8c6a357eca164955a8fe040c
  • SHA1:
    f4114815bce62efbc78c79f9a83ccf74a4ea075c
  • SHA256:
    f3efe3b57a0f5cc46963dbd8832ceecd5768117685b4cee684b1235d9e74ebe5
  • Technologies:

Joe Sandbox

Engine Download Report Detection Info
malicious
malicious
Score: 92
System: Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01

Third Party Analysis Engines

malicious
Score: 18/24
malicious

URLs

Name Detection
http://nsis.sf.net/NSIS_Error
http://nsis.sf.net/NSIS_ErrorError
https://www.youtube.com/channel/UCsKC-cU51wQN_jz-jUrzu-Ang
Click to see the 2 hidden entries
https://www.youtube.com/channel/UCsKC-cU51wQN_jz-jUrzu-A
https://vk.com/endnet

Dropped files

Name File Type Hashes Detection
C:\Baldi\Baldi.exe
PE32 executable (GUI) Intel 80386, for MS Windows
#
C:\Baldi\DisableUAC.exe
PE32+ executable (console) x86-64, for MS Windows
#
C:\Baldi\kill.exe
PE32+ executable (console) x86-64, for MS Windows
#
Click to see the 5 hidden entries
C:\Baldi\lol.png
PNG image data, 700 x 394, 8-bit/color RGBA, non-interlaced
#
C:\Baldi\mbr.exe
PE32 executable (console) Intel 80386, for MS Windows
#
C:\Baldi\7note.mp3
Audio file with ID3 version 2.4.0, contains:\012- MPEG ADTS, layer III, v2, 160 kbps, 22.05 kHz, Monaural
#
C:\Baldi\CleanZUpdater.bat
DOS batch file, ASCII text, with CRLF line terminators
#
C:\Users\user\AppData\Local\Temp\FC2B.tmp\FC2C.bat
ASCII text, with CRLF line terminators
#