naps2[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

naps2.exe
Size

22KB
MD5

f6058ef09ecd93fff75e356f8d195571
SHA1

fd203bf046be9442dd99dfbc90e9f40dbe4b6755
SHA256

3523a6ef904c070716dd2122b54bc2941a58732265753bce3141a4524f553bf2
SHA512

2d3b7d2ad3f533819639b516ca3ffb1390fef3a2d19ebf092cca7bb06abb909d339bc43e2ff8aba01e8e3159799e1baca77ff32fafd7a643d2a09c3cf5b37cc5
SSDEEP

384:f+Qc5J/KaNcgEFcv4nh0NHuIh6RSsZcLvrG:f+DKaNSF7aNOfR7ZQrG

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
naps2.exe

Files

naps2.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\Devel\VS\NAPS2\NAPS2\obj\x86\InstallerEXE\NAPS2.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ