Nursultan 2[.]0[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Nursultan 2.0.exe
Size

346KB
MD5

b0eb9e3bb6a5d0a71f2dfed3721a6ec5
SHA1

7554247c3b037b1cbe759cad1193a839f599734d
SHA256

8766e469db1b070a5f6e6729c561b1bb1232eb257b4e34a2d81898d0f9356922
SHA512

b85dac21efbd3eb414b2b6005eb5ef2204c9685ee75d14c593ea93673e5fdfb41a508344df17638b105eb0afabb7a436252056033c5e81ff0054dc600c7c2ccf
SSDEEP

6144:w790IYqCf6JqNsqEqCoe6VlWT8b9tbsTa+9blW:w7kqoBS+PVle8HWaL

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nursultan 2.0.exe

Files

Nursultan 2.0.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 343KB - Virtual size: 342KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ