NursultanLoader_1[.]16[.]5[.]exe | Triage

Sharing

General

Target

NursultanLoader_1.16.5.exe
Size

590KB
MD5

c2947000751dcfd21329caae70023999
SHA1

d541985190aaf1ea1cef06ccef0a4f653ffde2d7
SHA256

c4ac1cbd0db489e8dea678d8ea8ca859571ce1ceb4763579e1b77bac522b2112
SHA512

e2d46264685e888c0262581f8c23eab6a43bab62198847354d0cf6ef695e4a5d90a8122cbdd68dff7759c5add64715b740ea1ae1ab40be38df30b16e4c01bb7c
SSDEEP

12288:QpcHdiQV+ftsPVle88atashqpsl65NjA:/HdiQV+FPatasUpsy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NursultanLoader_1.16.5.exe

Files

NursultanLoader_1.16.5.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 587KB - Virtual size: 586KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ