Behavioral task
behavioral1
Sample
ankieta.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ankieta.exe
Resource
win10v2004-20230221-en
General
-
Target
ankieta.exe
-
Size
23KB
-
MD5
55c94778b53f33c48439844afba5d462
-
SHA1
d63ba9eb29f3fed6cce5f640627fd8fb8a06d783
-
SHA256
4cf026eb53956b4017914b820c1918116cd88adb484339d698127f5257e2b8ed
-
SHA512
50981efb97a95834c9b9b92279ec760692fccab6209eed8eb6ee678249e0cf84c69919474326d506973be9e557442f7f017ff4fcb7cd1b0eb9ce55e5728914fb
-
SSDEEP
384:2Y324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZmD:ZL2s+tRyRpcnur
Malware Config
Extracted
njrat
0.7d
ankieta
194.62.1.7:5552
3b4dedf3f1158ff11bd86e73dce1ac44
-
reg_key
3b4dedf3f1158ff11bd86e73dce1ac44
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ankieta.exe
Files
-
ankieta.exe.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 21KB - Virtual size: 21KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ