NitroRansomware[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NitroRansomware.exe
Size

1.5MB
MD5

9dcfeae1d256ba61ae8cc141336c3663
SHA1

f33d1bb64f2da9c82fb59f4dfaf5baf14da4f6ff
SHA256

c0c2f6b54dec10cf5d9e321db9948a59a444136e63e5ff5b30f4cdf1df8a1d64
SHA512

af03390ae31e77359a86348596c43c430451c5ef17d7815af472781b15e01f2bdea644876ecb785d5d4d93f1c642d55a8bcfd3be1e680eeff1cd0f744d64089f
SSDEEP

49152:tZYGwfZPzodngwwHv5VbtHw1kqXfd+/9AE:tWDZbIgNhVRw1kqXf0F

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NitroRansomware.exe

Files

NitroRansomware.exe
.exe windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ