Static task
static1
Behavioral task
behavioral1
Sample
decryp.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
decryp.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
nnll.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
nnll.exe
Resource
win10v2004-20230915-en
General
-
Target
nnll.zip
-
Size
407KB
-
MD5
0effd613adf3a4ee0490f2a72ed1f596
-
SHA1
f1f9f211fbdc0f9c9e9bc1e51ea06101e3b6bb37
-
SHA256
55e93dfebde154676d9f693e2573060366412110e6a7f05088c83b3f40e9a6c1
-
SHA512
28ab3826a197bea8e64f807e1a008c16ea572c7468d47b559a65737448362951a5e602e11fca4efa9f7126a152ce1bb0cfa8e3654e8dc3c1d75ba8bf4cc24d48
-
SSDEEP
6144:t2gRfMKJ4bKjZbedvYS/VPvDTiLgsORPn0+jiTUO9HwLMGxa9BWBLq7Z0hzbg:MUkm1S/Vv4ORPEhVUdhB4ShzU
Malware Config
Signatures
-
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/decryp.exe unpack001/nnll.exe
Files
-
nnll.zip.zip
-
decryp.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
nnll.exe.exe windows:4 windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 846KB - Virtual size: 845KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 70KB - Virtual size: 70KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ