NitroRansomware[.]exe | Triage

Sharing

General

Target

NitroRansomware.exe
Size

690KB
MD5

0aa959049ed181008cd30a818ca4abc1
SHA1

9dee42230d2b31eebe14e68c103c7423fcb5de92
SHA256

faaac111b93bcfdc0024a28ee3d07a4e1a464d0211cac0eb387dc8542be69048
SHA512

90315cdabbfd0826d39cc4ea166cd037a371e72e9068926f8da0c00a9a59d00114b0422c2ecc59527e08e426a7a9d96c2b1a94592995707c58453a39e45fac91
SSDEEP

12288:08+ACgkCHHdmg0ByvR4mWWaqMpWTYkmIWXoKOvp5y8HN7CzsXgxx9/06UqU4q:JkamxmWeeWFDuorh57HN7Czswxj/tVO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NitroRansomware.exe

Files

NitroRansomware.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 688KB - Virtual size: 687KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ