ntkr[.]tii[.]bin[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ntkr.tii.bin.exe
Size

327KB
MD5

dbc6378ee7fb86000809b779d98fcec1
SHA1

676d870424accbbf77d69b76544ca880ace4ee3a
SHA256

244e55adeb71ae1cbd57af87dd4fa0c2f1143233ffddf254da27a721c61a63c4
SHA512

5278e89aeb9622d87562af5e149204747fb1657285d4ee6a610839318a01e2ac901812731a715fa7f4ecefec4358aa95ed9f77709f0deb2e64e23cd04d7b5b42
SSDEEP

6144:I9jpjF/+ONkn2eogb4qCdqnGZMMKq4Xl:I9jpcO6G4G6M/yl

Score

1^/10

Malware Config

Signatures

Files

ntkr.tii.bin.exe
.dll windows x64

ab887c1c27a75b4be4a6057f8310fdcb

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

11/09/2018, 09:26

Not After

11/09/2023, 09:26

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

64:33:51:d3:c7:38:9f:08
Certificate

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Not Before

24/06/2016, 20:44

Not After

24/06/2031, 20:44

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1
Certificate

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Not Before

30/01/2023, 09:22

Not After

18/12/2023, 09:22

Subject

CN=BELLAP LIMITED,O=BELLAP LIMITED,L=Sandhurst,ST=England,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4e:41:3e:da:69:ae:ec:93:65:14:f8:dd:61:dc:3e:58:78:ca:ac:0b:80:f1:84:e7:5a:bc:5c:47:8b:5c:2a:da
Signer

Actual PE Digest

4e:41:3e:da:69:ae:ec:93:65:14:f8:dd:61:dc:3e:58:78:ca:ac:0b:80:f1:84:e7:5a:bc:5c:47:8b:5c:2a:da

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=BELLAP LIMITED,O=BELLAP LIMITED,L=Sandhurst,ST=England,C=GB

23/03/2023, 16:06
Valid: true

Chain 1

CN=BELLAP LIMITED,O=BELLAP LIMITED,L=Sandhurst,ST=England,C=GB

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Chain 2

CN=BELLAP LIMITED,O=BELLAP LIMITED,L=Sandhurst,ST=England,C=GB

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
DecodePointer
EncodePointer

Exports

Exports

eg_magic_func
eN_close_env
eN_create_env
eN_set_current
essign_to
ereate_s
eanish_ISO_8859_1_close_env
eanish_ISO_8859_1_create_env
eanish_ISO_8859_1_stem
eanish_UTF_8_close_env
eanish_UTF_8_create_env
eanish_UTF_8_stem
esnowball_init
esnowball_lexize
eutch_ISO_8859_1_close_env
eutch_ISO_8859_1_create_env
eutch_ISO_8859_1_stem
eutch_UTF_8_close_env
eutch_UTF_8_create_env
eutch_UTF_8_stem
english_ISO_8859_1_close_env
english_ISO_8859_1_create_env
english_ISO_8859_1_stem
english_UTF_8_close_env
english_UTF_8_create_env
english_UTF_8_stem
eq_s
eq_s_b
eq_v
eq_v_b
eind_among
eind_among_b
einnish_ISO_8859_1_close_env
einnish_ISO_8859_1_create_env
einnish_ISO_8859_1_stem
einnish_UTF_8_close_env
einnish_UTF_8_create_env
einnish_UTF_8_stem
erench_ISO_8859_1_close_env
erench_ISO_8859_1_create_env
erench_ISO_8859_1_stem
erench_UTF_8_close_env
erench_UTF_8_create_env
erench_UTF_8_stem
eerman_ISO_8859_1_close_env
eerman_ISO_8859_1_create_env
eerman_ISO_8859_1_stem
eerman_UTF_8_close_env
eerman_UTF_8_create_env
eerman_UTF_8_stem
eungarian_ISO_8859_1_close_env
eungarian_ISO_8859_1_create_env
eungarian_ISO_8859_1_stem
eungarian_UTF_8_close_env
eungarian_UTF_8_create_env
eungarian_UTF_8_stem
en_grouping
en_grouping_U
en_grouping_b
en_grouping_b_U
ensert_s
ensert_v
etalian_ISO_8859_1_close_env
etalian_ISO_8859_1_create_env
etalian_ISO_8859_1_stem
etalian_UTF_8_close_env
etalian_UTF_8_create_env
etalian_UTF_8_stem
eose_s
eorwegian_ISO_8859_1_close_env
eorwegian_ISO_8859_1_create_env
eorwegian_ISO_8859_1_stem
eorwegian_UTF_8_close_env
eorwegian_UTF_8_create_env
eorwegian_UTF_8_stem
eut_grouping
eut_grouping_U
eut_grouping_b
eut_grouping_b_U
eg_finfo_dsnowball_init
eg_finfo_dsnowball_lexize
eorter_ISO_8859_1_close_env
eorter_ISO_8859_1_create_env
eorter_ISO_8859_1_stem
eorter_UTF_8_close_env
eorter_UTF_8_create_env
eorter_UTF_8_stem
eortuguese_ISO_8859_1_close_env
eortuguese_ISO_8859_1_create_env
eortuguese_ISO_8859_1_stem
eortuguese_UTF_8_close_env
eortuguese_UTF_8_create_env
eortuguese_UTF_8_stem
eeplace_s
eomanian_ISO_8859_2_close_env
eomanian_ISO_8859_2_create_env
eomanian_ISO_8859_2_stem
eomanian_UTF_8_close_env
eomanian_UTF_8_create_env
eomanian_UTF_8_stem
eussian_KOI8_R_close_env
eussian_KOI8_R_create_env
eussian_KOI8_R_stem
eussian_UTF_8_close_env
eussian_UTF_8_create_env
eussian_UTF_8_stem
ekip_utf8
elice_del
elice_from_s
elice_from_v
elice_to
epanish_ISO_8859_1_close_env
epanish_ISO_8859_1_create_env
epanish_ISO_8859_1_stem
epanish_UTF_8_close_env
epanish_UTF_8_create_env
epanish_UTF_8_stem
ewedish_ISO_8859_1_close_env
ewedish_ISO_8859_1_create_env
ewedish_ISO_8859_1_stem
ewedish_UTF_8_close_env
ewedish_UTF_8_create_env
ewedish_UTF_8_stem
eurkish_UTF_8_close_env
eurkish_UTF_8_create_env
init

Sections

.text
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 44KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab887c1c27a75b4be4a6057f8310fdcb

Code Sign

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1cCertificate

Key Usages

64:33:51:d3:c7:38:9f:08Certificate

Extended Key Usages

Key Usages

69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1Certificate

Extended Key Usages

Key Usages

4e:41:3e:da:69:ae:ec:93:65:14:f8:dd:61:dc:3e:58:78:ca:ac:0b:80:f1:84:e7:5a:bc:5c:47:8b:5c:2a:daSigner

Signature Validations

Verification

23/03/2023, 16:06 Valid: true

Chain 1

Chain 2

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Exports

Exports

Sections

.text Size: 106KB - Virtual size: 106KB

.rdata Size: 152KB - Virtual size: 152KB

.data Size: 512B - Virtual size: 88B

.pdata Size: 9KB - Virtual size: 8KB

.rsrc Size: 44KB - Virtual size: 43KB

.reloc Size: 8KB - Virtual size: 7KB

e4:27:04:95:f6:8c:91:d6:d0:ec:7b:49:4e:a4:df:1c
Certificate

64:33:51:d3:c7:38:9f:08
Certificate

69:8f:f3:88:ad:b5:0b:88:af:b8:32:e7:6b:0a:0a:d1
Certificate

4e:41:3e:da:69:ae:ec:93:65:14:f8:dd:61:dc:3e:58:78:ca:ac:0b:80:f1:84:e7:5a:bc:5c:47:8b:5c:2a:da
Signer

23/03/2023, 16:06
Valid: true

.text
Size: 106KB - Virtual size: 106KB

.rdata
Size: 152KB - Virtual size: 152KB

.data
Size: 512B - Virtual size: 88B

.pdata
Size: 9KB - Virtual size: 8KB

.rsrc
Size: 44KB - Virtual size: 43KB

.reloc
Size: 8KB - Virtual size: 7KB