ngrrram-windows[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ngrrram-windows.exe
Size

1.0MB
MD5

d7e788b1d03b6e73166886a6eca1b931
SHA1

dff391a1ae36c3441034d4592b09613c690d759b
SHA256

6b4162322fea4ac67bd25ee5dcf843b03a9ba47b65dcdbc185b8fd0f023c1123
SHA512

d8c906b2f4146b7e8d5700f413627d9c6ac5b707e952b1f3ca3342925e103a3c9cd54b50f84064e9a8d8863d6be0be61ab6883536de223b7ba4e36d0210e4ba8
SSDEEP

12288:ibbgRnhmd4v1XnQsa9gjkhqFwYQGLuN/TOIoi4BgProsenUmOFMk0upu0myrM:i4RQ5WghqF3QSrIo6Prosen6MklAyr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ngrrram-windows.exe

Files

ngrrram-windows.exe
.exe windows:6 windows x64 arch:x64

40d077c6842130f66e294013743402ca

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ngrrram.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsDebuggerPresent
SetUnhandledExceptionFilter
WaitForMultipleObjects
SetConsoleCursorInfo
SetConsoleCursorPosition
Sleep
GetModuleHandleA
GetProcAddress
CloseHandle
GetStdHandle
SetConsoleMode
GetConsoleMode
CreateFileW
CreateConsoleScreenBuffer
SetConsoleActiveScreenBuffer
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
WriteConsoleW
ReadConsoleInputW
GetNumberOfConsoleInputEvents
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
GetCurrentProcess
GetCurrentProcessId
QueryPerformanceFrequency
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetFileType
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
IsProcessorFeaturePresent
MultiByteToWideChar
GetCurrentThread
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA

user32

GetWindowThreadProcessId
GetForegroundWindow
GetKeyboardLayout
ToUnicodeEx

ntdll

NtWriteFile
NtReadFile
RtlNtStatusToDosError

vcruntime140

memcpy
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
memset
memcmp
memmove
__CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

round
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_crt_atexit
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 759KB - Virtual size: 759KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

40d077c6842130f66e294013743402ca

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

advapi32

kernel32

user32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 759KB - Virtual size: 759KB

.rdata Size: 253KB - Virtual size: 253KB

.data Size: 512B - Virtual size: 1016B

.pdata Size: 30KB - Virtual size: 29KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 759KB - Virtual size: 759KB

.rdata
Size: 253KB - Virtual size: 253KB

.data
Size: 512B - Virtual size: 1016B

.pdata
Size: 30KB - Virtual size: 29KB

.reloc
Size: 4KB - Virtual size: 3KB