patch11[.]rar | Triage

Sharing

Copy URL Twitter E-mail

General

Target

patch11.rar
Size

174KB
MD5

9cb598142e8a257bb19e686825292bbb
SHA1

eea9a4ad79a4efe63905d68d7a71f5a91e63dff9
SHA256

3966b900e6fe17a72e22611d912b1360b8a4b9785cc792d1c1d4dbe9bc7c9b09
SHA512

1822d747783b8a33af21312e43085bcd2d2a1ca416ff6d49d6d7a3866d838d9139859925abb11c330951bff9eaf8af9cf02c861527d430d4b4c22b3850401ba6
SSDEEP

3072:MpcSSJ0bXp/8PsQ0SQuX7qndz4nK4JClIpjt5g0FHz8IU0rAcNBJds0rT7qCHyYe:1OZ/NMqn5WK6Cepr5xPU05DdFXpyYe

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/nitro.pro.14.5.x.enterprise-patch.exe
unpack001/nitro.pro.14.5.x.enterprise.(x64)-patch.exe
unpack001/nitro.pro.14.5.x.enterprise.(x86)-patch.exe

Files

patch11.rar
.rar
nitro.pro.14.5.x.enterprise-patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nitro.pro.14.5.x.enterprise.(x64)-patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
nitro.pro.14.5.x.enterprise.(x86)-patch.exe
.exe windows:5 windows x86 arch:x86

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteFileA
ExitProcess
FindResourceA
FreeLibrary
GetModuleHandleA
GetProcAddress
GetTempPathA
LoadLibraryA
LoadResource
RtlMoveMemory
SizeofResource
VirtualAlloc
lstrcatA
CloseHandle
CreateFileA
FlushFileBuffers
WriteFile

Sections

.text
Size: 512B - Virtual size: 502B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 512B - Virtual size: 472B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 58KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 82B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 512B - Virtual size: 502B

.rdata Size: 512B - Virtual size: 472B

.data Size: 512B - Virtual size: 52B

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 82B

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 512B - Virtual size: 502B

.rdata Size: 512B - Virtual size: 472B

.data Size: 512B - Virtual size: 52B

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 82B

dc73a9bd8de0fd640549c85ac4089b87

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

Sections

.text Size: 512B - Virtual size: 502B

.rdata Size: 512B - Virtual size: 472B

.data Size: 512B - Virtual size: 52B

.rsrc Size: 58KB - Virtual size: 58KB

.reloc Size: 512B - Virtual size: 82B

.text
Size: 512B - Virtual size: 502B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 52B

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 82B

.text
Size: 512B - Virtual size: 502B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 52B

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 82B

.text
Size: 512B - Virtual size: 502B

.rdata
Size: 512B - Virtual size: 472B

.data
Size: 512B - Virtual size: 52B

.rsrc
Size: 58KB - Virtual size: 58KB

.reloc
Size: 512B - Virtual size: 82B