Static task
static1
Behavioral task
behavioral1
Sample
ChatNCL.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ChatNCL.exe
Resource
win10v2004-20240226-en
General
-
Target
ChatNCL.exe
-
Size
32.4MB
-
MD5
4a1625b5325f80f105d2a44a2a977139
-
SHA1
abd82c359d28408da9ef7c3c6f9dd2b2ff5fa926
-
SHA256
f0db41d6c9fbed2c8b1062fb0c16821007bc54f161e44cd07d59ce8f88c89d8a
-
SHA512
3ed3d46cd3280a7ef6bd4f54d762f8100809c9cee3ce10ead700660ab65c91cf61caca0d39a06a602cf62ef6fbce4c4bb8db7b8785ad10b0d2c8402298253ba9
-
SSDEEP
786432:cGJCHbbDg09EmCGLYqYXaofA1cVfjxlFw5JH7/mcrRpbSeHsqePr:cGJC7FT5YKQfjfFw5V/3rR9DHheD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ChatNCL.exe
Files
-
ChatNCL.exe.exe windows:6 windows x64 arch:x64
a8369a581a563d51e3a921c67aa46d87
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
shell32
SHFileOperationW
kernel32
SetLastError
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
Sections
.text Size: - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 67KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.v8K Size: - Virtual size: 26.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.aHk Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.99 Size: 32.3MB - Virtual size: 32.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 134KB - Virtual size: 133KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ