General
-
Target
NR_Giveaway.exe
-
Size
2.7MB
-
MD5
d731ed9f0d7d34536fb65edfadf3919c
-
SHA1
62c6a3b28876705944495aad3bc6a00622ea5d28
-
SHA256
2b0767a78e2b7a0d17110f77767f85737ae762f11c178ffff37ae59a1ad9dae9
-
SHA512
df4e016494df0e188469ea5d9968b0871278bca11723eb99bdaffa3e8af24139912dc51848ddd19c0e81a4152dd554caa90e6820e4032fb691cacceaab40cb93
-
SSDEEP
49152:XYl5zlzRLHVEnVml4q1XqG4q+A3Zqn7zKQWf:XYlBltLHV+fqv3Mm
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule sample agile_net -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NR_Giveaway.exe
Files
-
NR_Giveaway.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
.text Size: 2.7MB - Virtual size: 2.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ