Static task
static1
Behavioral task
behavioral1
Sample
NGVkZTM3.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
NGVkZTM3.exe
Resource
win10v2004-20230221-en
General
-
Target
NGVkZTM3.exe
-
Size
272KB
-
MD5
45898f41cf503d594a008038281b0d48
-
SHA1
241c9d33d0a0a4ea55e33da25e264612ca965384
-
SHA256
5b1f242aee0eabd4dffea0fe5f08aba60abf7c8d1e4f7fc7357af7f20ccd0204
-
SHA512
5a1305d4f5374a0ba4a39749e52e73d13571e690b8aaf9925e3f10297219d35f4fc73116cf470454af8e0660f38bed9bbc7235a917a8526263d0851ea03664fe
-
SSDEEP
3072:iySEX2o8a2hdurZX8KnXJ3c3h5TLTb0bnKzQ/xyZavDZInlnYIPZ9G0mwfy:D/mo32bux8xj0jjxXv2+IP96
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NGVkZTM3.exe
Files
-
NGVkZTM3.exe.exe windows x86
e5b44ef262abbb9d728bbe03f8aa847e
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleHandleA
user32
CreateMenu
advapi32
RegOpenKeyExA
Sections
Size: 168KB - Virtual size: 168KB
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE