ngen[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ngen.exe
Size

140KB
MD5

417d6ea61c097f8df6fef2a57f9692df
SHA1

ed27c605f1d2df6de1c5489930bfea2059631727
SHA256

d0105566bc22ef92204e163428e5feda866f8a9b2be19be3b95e6327fff3f8c6
SHA512

d013cd96d78309fa02d524299722fb05c8976b367a998564599e857d375ad25790dd414d8d00724fae91f47bff81c0b0b5d220a9edd9cf39305f7f5dd6ccad86
SSDEEP

3072:Ux1a7d+LgHy+i8DC12HiN4gsdpEGaYyzzSczG:ULa7dS+i8S3SzCz2cy

Score

1^/10

Malware Config

Signatures

Files

ngen.exe
.exe windows:6 windows x86 arch:x86

3e0e9999397436894662f70fc3d346eb

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

04/03/2020, 18:39

Not After

03/03/2021, 18:39

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08/07/2011, 20:59

Not After

08/07/2026, 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6a:c3:de:57:4b:76:a0:53:09:18:a5:50:e4:d7:c4:fc:17:54:e6:4f:d2:e8:e2:3d:65:0c:da:cd:33:5e:6d:7e
Signer

Actual PE Digest

6a:c3:de:57:4b:76:a0:53:09:18:a5:50:e4:d7:c4:fc:17:54:e6:4f:d2:e8:e2:3d:65:0c:da:cd:33:5e:6d:7e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

ngen.pdb

Imports

kernel32

IsDebuggerPresent
VirtualQuery
TlsFree
TlsGetValue
SleepEx
CreateSemaphoreW
DeleteCriticalSection
HeapDestroy
ResetEvent
TlsAlloc
WaitForSingleObjectEx
SetEvent
CreateEventW
HeapValidate
ReleaseMutex
CreateMutexW
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
UnhandledExceptionFilter
VirtualFree
EnterCriticalSection
VirtualProtect
TlsSetValue
HeapCreate
MoveFileExW
GetFileAttributesExW
GetFileSizeEx
ReadFile
CreateProcessW
GetSystemTimeAsFileTime
SetLastError
DebugBreak
OutputDebugStringW
GetCurrentThreadId
TerminateProcess
LoadLibraryExW
HeapSetInformation
CreateFileW
GetEnvironmentVariableW
GetCurrentProcess
RaiseException
LCMapStringW
LocalFree
IsDBCSLeadByte
FormatMessageW
MultiByteToWideChar
GetACP
GetCPInfo
FreeLibrary
GetProcessHeap
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
InitializeSListHead
CreateDirectoryW
GetLastError
WideCharToMultiByte
GetModuleHandleW
GetCurrentProcessId
GetCurrentDirectoryW
GetLocalTime
CloseHandle
GetFileAttributesW
WaitForSingleObject
SetErrorMode
GetModuleFileNameW
WriteFile
GetStdHandle
GetConsoleOutputCP
GetFullPathNameW
WerSetFlags
ReleaseSemaphore
HeapFree
HeapAlloc

vcruntime140_clr0400

memset
_except_handler4_common
memcpy
_CxxThrowException
__CxxFrameHandler3
_purecall
memmove

ucrtbase_clr0400

_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_set_fmode
_exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
__setusermatherr
_set_app_type
_crt_atexit
malloc
free
_set_new_mode
_putws
_flushall
iswspace
strcpy_s
__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
wcsncpy_s
_errno
wcstoul
_wcsnicmp
__stdio_common_vswprintf
wcscat_s
wcscpy_s
tolower
_wtoi
_wcsicmp
exit
_controlfp_s
terminate
__p__commode
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe

mscoree

GetRequestedRuntimeInfo
CLRCreateInstance
GetCORSystemDirectory
CorGetSvc
CorBindToRuntime
GetRealProcAddress

oleaut32

SysAllocString
SetErrorInfo
SysFreeString

user32

LoadStringW

advapi32

EventWrite
RegOpenKeyExW
RegCloseKey
RegQueryValueExW

Sections

.text
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3e0e9999397436894662f70fc3d346eb

Code Sign

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87Certificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

6a:c3:de:57:4b:76:a0:53:09:18:a5:50:e4:d7:c4:fc:17:54:e6:4f:d2:e8:e2:3d:65:0c:da:cd:33:5e:6d:7eSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

mscoree

oleaut32

user32

advapi32

Sections

.text Size: 117KB - Virtual size: 117KB

.data Size: 1024B - Virtual size: 2KB

.idata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 6KB

33:00:00:01:87:72:17:72:15:59:40:c7:09:00:00:00:00:01:87
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

6a:c3:de:57:4b:76:a0:53:09:18:a5:50:e4:d7:c4:fc:17:54:e6:4f:d2:e8:e2:3d:65:0c:da:cd:33:5e:6d:7e
Signer

.text
Size: 117KB - Virtual size: 117KB

.data
Size: 1024B - Virtual size: 2KB

.idata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 6KB