Nan0hail[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Nan0hail.exe
Size

3.0MB
MD5

18c59d0fa3c2d81c9447c25d46d86446
SHA1

107fbb4d508fef9263457a3b05faad59100a5fbe
SHA256

681eac0b71f8d821d28c5657cf4ee825a9b9175cfa948de3e235e676cfc0a198
SHA512

3a11d0df3a71c26d8c0983c94bc492c21047da05e806391399715f71ed43d86e048ed8ef54fd483b1bd906e922bb2ca80399a8f14376156dcea39df62aa0da45
SSDEEP

49152:y/ReuZEOGGon+dsp4YUOxMr7uuvOujtHD:uRLRZEp4Kxa7D2Yt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nan0hail.exe

Files

Nan0hail.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\ryand_000\Documents\Visual Studio 2010\Projects\Nan0hail\Nan0hail\obj\x86\Debug\Nan0hail.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 2.9MB - Virtual size: 2.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 154B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ