NOTBackdoor[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NOTBackdoor.exe
Size

36KB
MD5

663c528e3e392c6d2b749267cd675a5a
SHA1

04918ce0d9a3cb84e237bd8a8fa33306bed06aca
SHA256

bfb9f65cf7b964d44bf6292b34ef99f2af7582478a770007706a0178fe1ea1c6
SHA512

baf9f5f0eaf3fd84f93b39a48723c6c4c4fdc1ea2c377745848084fe7e9f69fc5352ff342990d6b12bf2c4b04ef829dcdb4c7f30875141f1c1e780e476fe9821
SSDEEP

768:CNnmZ/8vPlLUdhfJ8v6utFpVsuRregrWChgzKllb7Dsr1:Enwu4DejVLyOhgzqYr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NOTBackdoor.exe

Files

NOTBackdoor.exe
.exe windows:4 windows x86 arch:x86

d01b793cfeabb1210a9dfd924e5cbf0d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

user32

SendInput

gdi32

DeleteDC

advapi32

RegCloseKey

shell32

ExtractIconA

msvcp60

??0_Winit@std@@QAE@XZ

msvcrt

_iob

winmm

waveInOpen

shlwapi

PathFileExistsA

ws2_32

htons

urlmon

URLDownloadToFileA

gdiplus

GdipFree

wininet

InternetOpenA

Sections

.MPRESS1
Size: 28KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE