Static task
static1
Behavioral task
behavioral1
Sample
NaZonWare.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
NaZonWare.exe
Resource
win10v2004-20240508-en
General
-
Target
NaZonWare.exe
-
Size
2.1MB
-
MD5
9162db3de83e2f17b1960cf7c376e213
-
SHA1
0249763f1ded61a5267a80181cf8fd41875f75e0
-
SHA256
f19ae8751b7a32b1de3c927af4035dcf1d3977f859a1ae97ad54cdf835d3f99b
-
SHA512
93fc9758770a6479b625735c1ad27174a2db5c40e410e3a257aa48908d6c29d977c55c0ed0925f7d5c8a7555351c7f4a00d216e42229b5d4d1e7f8ffc418d489
-
SSDEEP
49152:/tSdD2ppmuYITYbNbNWo4kSH3OqtwIrkqXfd+/9AqYaR:/4hIT4bNJFY3Oqt3kqXf0FnYe
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NaZonWare.exe
Files
-
NaZonWare.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
GkF8uk Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
GkF8uk Size: 265KB - Virtual size: 264KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
B66D8CE1 Size: 512B - Virtual size: 16B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ