ntlhost[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ntlhost.exe
Size

770.4MB
MD5

a20a01aba66627c5491b88a1e2cd829f
SHA1

47564abfeb6b11700cf4049a6bdca262887deade
SHA256

797ec80ab908b7f3e6fec9784b210efdfc4ca1562f03b3b8ba655825a160cfdb
SHA512

52ee8cd0a6699ae3a0718269a4e8498692a275b1fadf367014cab6d5a60cf76fd350078f85e6a30ffd4e2d5a958ac92fa07ad45b20ab9ba9f145c267609b3dea
SSDEEP

25165824:qEr86X3xlrhTqHm8PF0LBRDPe33qRxoMbZ35:qAlVmHm8t0LBFPVxoMd35

Score

N/A

Malware Config

Signatures

Files

ntlhost.exe
.exe windows x86

c7c88a9f12777d4c1f156ccc8f276fa1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

AcquireSRWLockExclusive
CreateEventA
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

oleaut32

GetErrorInfo

user32

GetForegroundWindow
CharUpperBuffW

bcrypt

BCryptGenRandom

msvcrt

__dllonexit

Sections

.text
Size: - Virtual size: 258KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.eh_fram
Size: - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asmc0
Size: - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.asmc1
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asmc2
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 115KB - Virtual size: 115KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7c88a9f12777d4c1f156ccc8f276fa1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

oleaut32

user32

bcrypt

msvcrt

Sections

.text Size: - Virtual size: 258KB

.data Size: - Virtual size: 152B

.rdata Size: - Virtual size: 5.1MB

.eh_fram Size: - Virtual size: 23KB

.bss Size: - Virtual size: 1KB

.idata Size: - Virtual size: 4KB

.CRT Size: - Virtual size: 64B

.tls Size: - Virtual size: 32B

.asmc0 Size: - Virtual size: 2.6MB

.asmc1 Size: 1KB - Virtual size: 1KB

.asmc2 Size: 7.2MB - Virtual size: 7.2MB

.rsrc Size: 115KB - Virtual size: 115KB

.text
Size: - Virtual size: 258KB

.data
Size: - Virtual size: 152B

.rdata
Size: - Virtual size: 5.1MB

.eh_fram
Size: - Virtual size: 23KB

.bss
Size: - Virtual size: 1KB

.idata
Size: - Virtual size: 4KB

.CRT
Size: - Virtual size: 64B

.tls
Size: - Virtual size: 32B

.asmc0
Size: - Virtual size: 2.6MB

.asmc1
Size: 1KB - Virtual size: 1KB

.asmc2
Size: 7.2MB - Virtual size: 7.2MB

.rsrc
Size: 115KB - Virtual size: 115KB