Behavioral task
behavioral1
Sample
1588-83-0x0000000001220000-0x0000000001592000-memory.exe
Resource
win7-20230220-en
General
-
Target
1588-83-0x0000000001220000-0x0000000001592000-memory.dmp
-
Size
3.4MB
-
MD5
15272f5121dddf0fda1ecd5721fc8610
-
SHA1
0466371ab5963c45b68df343704c0a324d051474
-
SHA256
91c949c93549a763f07f3c8f9c9e48da2982c1017c0b50337632724b309a0d3c
-
SHA512
2de57cfb34fa6ab9c5a4d0781f2c43057d37226af1d888659b66565953ced7b9ddb211faa82f5e36055b95d69e21741d39bd90bea95415d94ad004836665e64d
-
SSDEEP
49152:Tv2JBFiQLw62LTUIY5jRpFEdD60nlg7Pzvqe74KbTl+qK6XKp:TediN9MIQRH0RlgLzvqe7JhKh
Malware Config
Signatures
-
Njrat family
Files
-
1588-83-0x0000000001220000-0x0000000001592000-memory.dmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
Size: 40KB - Virtual size: 40KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Size: 2.5MB - Virtual size: 2.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Microsof Size: 912KB - Virtual size: 912KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ