SWA-Nuker_Setup[.]exe | Triage

Sharing

General

Target

SWA-Nuker_Setup.exe
Size

102.3MB
MD5

1bd17d81b3b1c041841e0ee54ae849b4
SHA1

98d7cbacda557f5801628ff81b142b14a007edb4
SHA256

34d84b19f195fc4b81bd252bb924d2c4f32e241fb6079d076a83a52054776e91
SHA512

e4af0ea025c9caf231902721d0af3165a23657ce7e660a7686672a2f7b45a0cdc5c49911a2c2bc51d133b254e6b80f177d8f09a50844a60751ee1821f1d88059
SSDEEP

1572864:ri/p7m2/jJGGDf33ZLI9qhgkfAk91Rc/49TEOtdB2BNOj3NVd3Fa3Ta9BOuy3:POl/3ZLI9Y19lEOtdEBA33d3OW9BA3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SWA-Nuker_Setup.exe

Files

SWA-Nuker_Setup.exe
.exe windows:4 windows x86 arch:x86

a9c887a4f18a3fede2cc29ceea138ed3

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

malloc
memset
strcmp
strcpy
getenv
sprintf
fopen
fwrite
fclose
__argc
__argv
_environ
_XcptFilter
__set_app_type
_controlfp
__getmainargs
exit

shell32

ShellExecuteA

kernel32

SetUnhandledExceptionFilter

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 102.2MB - Virtual size: 102.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ