ngrokreversed[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ngrokreversed.exe
Size

202KB
MD5

b841edd9533f05b3b199d7eaa5c1184b
SHA1

b1cc3313f988cc65a85ad70cd578fe2567718630
SHA256

f137990bcf8b10998252a96fc9eb91cc8b02b26ad839220a0d03f7a494264ca2
SHA512

05d8850390bb0627b20ac6980645a37191e8dc3f809decb9a22e2bd698335b6e55b427ce6752b3bd662f82b2e343245a533f78ef6a702080a5cce5f255c4c4ef
SSDEEP

6144:P8tYebHJCOR1MXTGeBEbW4mO+ZgwjyeL+:P8tY0HJhR1Musj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ngrokreversed.exe

Files

ngrokreversed.exe
.exe windows x64

b4c6fff030479aa3b12625be67bf4914

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualAlloc
ExitProcess

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 132B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.efwo
Size: 196KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE