nnu[.]exe | Triage

General

Target

nnu.exe
Size

11KB
MD5

2ee4f288abca245ec159482d6b84cda9
SHA1

a4d512b899e4cc6180925a8bd9f98da6165b2f7b
SHA256

1d47fdbe3e29384a04e299464c2318fbccbfe2e3feb31a5f8dd7c7e92d6a1c66
SHA512

66c4ffbb67ca28612269fff4b5e9c7a2c068a4f8590b40c40690fac079312a9d7995bf605dd00fe9c471a6501e76b0c06a10aefeb82430314a28dc97182d59ed
SSDEEP

192:LSmK5Y90VuzftHqs6ncRlmul1BCeWJxTxnVsfxYi1T8s7kW9ObW:uY6IvocREwwjlnVKlAsAW9ObW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nnu.exe

Files

nnu.exe
.exe windows x86

a90e0616e1a305bc395c76ee27f395f5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

shlwapi

PathRemoveFileSpecA

user32

OemKeyScan

python27

Py_FrozenFlag
Py_IgnoreEnvironmentFlag
Py_SetPythonHome
Py_SetProgramName
Py_Initialize
PySys_SetArgv
PyExc_SystemExit
PyErr_ExceptionMatches
PySys_GetObject
PyObject_CallObject
PyImport_ImportModule
Py_NoSiteFlag
PyObject_GetAttrString
PyErr_Clear
Py_Exit
PyInt_AsLong
PyObject_Str
PyErr_Fetch
PyErr_NormalizeException
PyString_FromString
PyTuple_New
PyString_Format
_Py_NoneStruct
Py_Finalize
PyRun_SimpleStringFlags
PyImport_Import
_PyString_Join

msvcr90

_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__argc
__argv
_amsg_exit
__getmainargs
_cexit
_exit
_XcptFilter
_ismbblead
exit
_acmdln
_initterm
_initterm_e
_configthreadlocale
__setusermatherr

kernel32

IsDebuggerPresent
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStartupInfoA
InterlockedCompareExchange
Sleep
InterlockedExchange
GetModuleFileNameA

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a90e0616e1a305bc395c76ee27f395f5

Headers

DLL Characteristics

File Characteristics

Imports

shlwapi

user32

python27

msvcr90

kernel32

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 2KB - Virtual size: 1KB