nloader | ff2b9b6121b3812a344144bfa4082c8b7567af1e75e352fde64eee6d060b18d8 | Triage

Sharing

General

Target

ff2b9b6121b3812a344144bfa4082c8b7567af1e75e352fde64eee6d060b18d8
Size

6KB
MD5

1cd6aba7a98a884da1b038bb5d74071d
SHA1

a113d6af994fdd81c70b9cf5b8a3f11819c7c568
SHA256

ff2b9b6121b3812a344144bfa4082c8b7567af1e75e352fde64eee6d060b18d8
SHA512

be08ebed96c90640d5e90e7ab43c29e5c0ba4a0a7c16c6db10ae3de4b84f27e5347170a97cfa99fa9493f42fd3ea32c79f437fabd9fb1dc0bd2292d882f3f7e8
SSDEEP

96:LCaVdGBHYVoePqZomcI+8Yi8yoiIZ0nPRSkdJh6h8aaS9VxcO/m:LxV6HYVvPqemsjiBPvJh6daIV3

Score

10^/10

nloader

Malware Config

Signatures

Nloader Payload 1 IoCs

Processes:

resource yara_rule

sample nloader
Nloader family
nloader

Files

ff2b9b6121b3812a344144bfa4082c8b7567af1e75e352fde64eee6d060b18d8
.dll windows x86

213f3a37dd98f37379105d390f7e35e0

Code Sign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

CreateFileA
WriteFile
CloseHandle
Sleep
GetProcAddress
LoadLibraryA
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsProcessorFeaturePresent

ws2_32

WSACleanup
WSAStartup
send
gethostbyname
recv
htons
connect
closesocket
socket

user32

wsprintfA

Exports

Exports

DF1

Sections

.text
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 284B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ