NordVPN 6[.]24[.]14[.]0 by PirateCity[.]zip | Triage

Sharing

General

Target

NordVPN 6.24.14.0 by PirateCity.zip
Size

11.6MB
MD5

6a27225a679006bc09921ae135dd2137
SHA1

52b2b74469806763235ead92d43e8abd9fc3cc32
SHA256

86b15ca0e14f991083a5b36b88de83ab122268034b49491cdefe7dfeb201809d
SHA512

36b5e8e207f7538e2fef7c2de981b0a1c02627a00283ae786b0c3c0aefefeff6d3474a215604262a834df88fdd6e657f52fbe15fd8a57b5ae155531e635a26ef
SSDEEP

196608:087vKGcF0rV9n9YTIpQaR2jpZApaJCSYrKdMX9dnCux0OZFvtUfrbbMublHTYSf3:v7iZSVd6IetpZArSum69Nnx0OZFi/Y2t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Setup.exe

Files

NordVPN 6.24.14.0 by PirateCity.zip
.zip
Setup.exe
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 145KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 8B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 117KB - Virtual size: 117KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Visit - PirateCity.url
.url
instructions + keys.txt