F:\dowloa\Noskill Engine V10x\return-wnm9-panel.pdb
Static task
static1
Behavioral task
behavioral1
Sample
755016f416e6e78a4cbc1f64826e5c7ec8a032d9c40823d9bea256f7eda85137.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
755016f416e6e78a4cbc1f64826e5c7ec8a032d9c40823d9bea256f7eda85137.exe
Resource
win10v2004-20240508-en
General
-
Target
755016f416e6e78a4cbc1f64826e5c7ec8a032d9c40823d9bea256f7eda85137
-
Size
4.7MB
-
MD5
4994ecab5fdd6488936924ea0374f5cd
-
SHA1
d203cf27268f9a5cf32b2377ce6d42cdd37697e8
-
SHA256
755016f416e6e78a4cbc1f64826e5c7ec8a032d9c40823d9bea256f7eda85137
-
SHA512
63cd51d6e13d5ac33b00df91d9a152013bba78b6664378cdddcb91c69735bb38a7bc95104f4d7ba61c072380345710dd6b63ff91f88cbe0aae6e801e6920bc5e
-
SSDEEP
98304:d9NWXCVteLveAa8GAKDYm1L4wqWAbVho/jf/oVoMDv6p:d98XCWLve1JAK49wjK5Dvu
Malware Config
Signatures
-
Detects executables Discord URL observed in first stage droppers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_DiscordURL -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 755016f416e6e78a4cbc1f64826e5c7ec8a032d9c40823d9bea256f7eda85137
Files
-
755016f416e6e78a4cbc1f64826e5c7ec8a032d9c40823d9bea256f7eda85137.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: - Virtual size: 2.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.9}a Size: - Virtual size: 2.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
._-/ Size: 512B - Virtual size: 8B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
._:0 Size: 4.7MB - Virtual size: 4.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ