Necomator[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Necomator.exe
Size

25KB
MD5

d76d7efd946538f923427f61a3cb647b
SHA1

c698061184454601403ccbb3921defb0ce632fd0
SHA256

cbec89bc80a00ad77a7f1fb45e6eb3efe708c2d52f693d73058308d093b5fbcf
SHA512

54637f96ea88b6a35be2bf13a1d0707227f049c6800d91afed299b09d96ee5e28dc746ae3fe9adc3b48a2aa252402615105a64c1564fc9ff617fc56b903a91f1
SSDEEP

384:4ybRyRpqXLMsLqS8D03QVLzLeLGJ4rVhkvwKwq6uPuSaxokwqwAyH7wADI/rUExL:4ycRpq7MAZ8TpnaGmrb/rnxh9Rznx3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Necomator.exe

Files

Necomator.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\ncmdn\source\repos\WindowsFormsApp5\WindowsFormsApp5\obj\Debug\WindowsFormsApp5.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ