NinjaRipper2[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

NinjaRipper2.exe
Size

16.4MB
MD5

427df19364659e8c7a66689741707d87
SHA1

ed8c14a573de8a4b07f9579a081b6b043af14c48
SHA256

024288440c2d9d32ae9f60e834a4d04e82618b470f09603f9cd539e184211d41
SHA512

61be030e598e5cfeac9aa9b8a4ad3bada11f8311c939d2c0f1241a99a05624fa35350668d3ea727f2069072d7401485528c86ca68b8ceaa71482366d4b0d131b
SSDEEP

196608:vkP0DgYJwqFWnPv80yKEOsYNC9J7eqnqD32OvYLExXGgRJLRZ9ugbsZvokz19T3P:yIhHEn38ODNaDnk2O0mXlug/k513jaHo

Score

1^/10

Malware Config

Signatures

Files

NinjaRipper2.exe
.exe windows:6 windows x64 arch:x64

0d3d3c5f1262ceaaea566727e7ed15d6

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28-07-2020 00:00

Not After

18-03-2029 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28-07-2020 00:00

Not After

28-07-2030 00:00

Subject

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:1f:1a:69:bd:ab:1c:da:c8:f6:7c:12
Certificate

Issuer

CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

11-10-2022 14:47

Not After

11-10-2025 14:47

Subject

CN=OOO MEDIAPRO,O=OOO MEDIAPRO,L=Kazan,ST=Tatarstan,C=RU

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03-05-2023 00:00

Not After

02-08-2034 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

21:b8:4e:2d:cb:dd:d8:8f:e2:8c:9a:5f:53:a2:1e:1b:b3:e8:b3:b2:de:5b:b6:95:19:0f:88:f6:cc:8d:ad:4c
Signer

Actual PE Digest

21:b8:4e:2d:cb:dd:d8:8f:e2:8c:9a:5f:53:a2:1e:1b:b3:e8:b3:b2:de:5b:b6:95:19:0f:88:f6:cc:8d:ad:4c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

qt5widgets

?setCenterButtons@QDialogButtonBox@@QEAAX_N@Z

qt5network

?staticMetaObject@QNetworkReply@@2UQMetaObject@@B

qt5gui

?pixmap@QIcon@@QEBA?AVQPixmap@@HHW4Mode@1@W4State@1@@Z

qt5core

?qt_metacall@QObject@@UEAAHW4Call@QMetaObject@@HPEAPEAX@Z

kernel32

MapViewOfFile

user32

WaitForInputIdle

shell32

SHGetKnownFolderPath

ole32

CoInitialize

advapi32

OpenProcessToken

msvcp140

?_Xbad_alloc@std@@YAXXZ

vcruntime140

__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback

api-ms-win-crt-heap-l1-1-0

calloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-math-l1-1-0

ceil

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strcmp

api-ms-win-crt-convert-l1-1-0

_ecvt_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 450KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fgf
Size: - Virtual size: 11.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.^5I
Size: 512B - Virtual size: 392B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.{\=
Size: 16.3MB - Virtual size: 16.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 256B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0d3d3c5f1262ceaaea566727e7ed15d6

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47Certificate

Extended Key Usages

Key Usages

4c:1f:1a:69:bd:ab:1c:da:c8:f6:7c:12Certificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

21:b8:4e:2d:cb:dd:d8:8f:e2:8c:9a:5f:53:a2:1e:1b:b3:e8:b3:b2:de:5b:b6:95:19:0f:88:f6:cc:8d:ad:4cSigner

Headers

DLL Characteristics

File Characteristics

Imports

qt5widgets

qt5network

qt5gui

qt5core

kernel32

user32

shell32

ole32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 450KB

.rdata Size: - Virtual size: 297KB

.data Size: - Virtual size: 12KB

.pdata Size: - Virtual size: 20KB

.fgf Size: - Virtual size: 11.8MB

.^5I Size: 512B - Virtual size: 392B

.{\= Size: 16.3MB - Virtual size: 16.3MB

.rsrc Size: 148KB - Virtual size: 147KB

.reloc Size: 512B - Virtual size: 256B

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Certificate

4c:1f:1a:69:bd:ab:1c:da:c8:f6:7c:12
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

21:b8:4e:2d:cb:dd:d8:8f:e2:8c:9a:5f:53:a2:1e:1b:b3:e8:b3:b2:de:5b:b6:95:19:0f:88:f6:cc:8d:ad:4c
Signer

.text
Size: - Virtual size: 450KB

.rdata
Size: - Virtual size: 297KB

.data
Size: - Virtual size: 12KB

.pdata
Size: - Virtual size: 20KB

.fgf
Size: - Virtual size: 11.8MB

.^5I
Size: 512B - Virtual size: 392B

.{\=
Size: 16.3MB - Virtual size: 16.3MB

.rsrc
Size: 148KB - Virtual size: 147KB

.reloc
Size: 512B - Virtual size: 256B