NidhoggClient[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NidhoggClient.exe
Size

184KB
MD5

0090b023647095c20b2c1ef549a63101
SHA1

b16b71fded7c979dec0d8dace947b58eb70c3b96
SHA256

66fa1cc2b5ad37a2e9900f3353cd8111aa079b1ff7ed8047c75dd4e656633c0f
SHA512

d9307944451bf0cee829f62cd1f2a12db5519132acd3b2f948f0f0a343cc9d7f7bafd0c4ea2629c7099d7acd260e8056ce34ae0cb6d924ac636d4efcacd91a2b
SSDEEP

3072:gPdAjssK7vvSKOzWcU006yxgP4USEF+wILKt7hWAyT81ibPbzu/aU6:EdxvmHU0unUD41Kt7hWAy9b4a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NidhoggClient.exe

Files

NidhoggClient.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

5DqpFIS
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

5DqpFIS
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

zUmdyrWg
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ