Narrator[.]exe

General

Target

Narrator.exe
Size

92KB
MD5

bfb758841fc3ebbb98d9aff1f530487f
SHA1

c9891ad96eba140e85de4ec18394c3b2d4a4440c
SHA256

59868a0b228cdd2a69efc6b46e2d252f8bf694491e437bb32618adc771541e51
SHA512

601f7271cf338f0b542d1d0460df1015e153d5c08648b670839a9a27dd24deba0e09d947c71c918ad1d704fb4d0c4b78c683c8c51d4898f71871ddc950e7171e
SSDEEP

1536:HwPf9iWBz6SE9zx4fBxzXi4qd6N3rArBOLrrLbwM+cJ:sliWh6f9FKi4Z+BO/fbV+O

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Narrator.exe

Files

Narrator.exe
.exe windows x86

b91fbfdc80c3b66cbe30b9a20ebc34f8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeactivateActCtx
ReleaseActCtx
GetCurrentActCtx
GetModuleFileNameW
CreateActCtxW
ActivateActCtx
GetLastError
RaiseException
GetCurrentProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
Sleep
TerminateProcess

msvcrt

__p__fmode
_except_handler4_common
_controlfp
?terminate@@YAXXZ
??3@YAXPAX@Z
??2@YAPAXI@Z
memcpy_s
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter

oleaut32

SysStringLen
SysAllocStringLen
SysFreeString

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance

shlwapi

PathRemoveFileSpecW
PathFileExistsW

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 884B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 372B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b91fbfdc80c3b66cbe30b9a20ebc34f8

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

oleaut32

ole32

shlwapi

Sections

.text Size: 4KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 884B

.idata Size: 1KB - Virtual size: 1KB

.rsrc Size: 85KB - Virtual size: 84KB

.reloc Size: 512B - Virtual size: 372B

.text
Size: 4KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 884B

.idata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 85KB - Virtual size: 84KB

.reloc
Size: 512B - Virtual size: 372B