NL Hybrid[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NL Hybrid.dll
Size

4.2MB
MD5

ede20fc6e74a86a4d1c45f28d35d182f
SHA1

c0af37d1ee3cd67beb8d72f0612033cc9ccf4e5c
SHA256

69639119de9cf4069cebb54b1697cbe037dfa9b8dec99f9e4a7bdb3782529955
SHA512

dcc3aacaf6f1c001114bb571a863c901cb86c4e05b71515ff0b6c9b52570d19e7d63ea4883e9494543e833c5fe431cce162acfc61ee94d3c32454532f9f44d21
SSDEEP

98304:Ur2MfZ3x045Faw+Ga9qfbMI9cczO7VOt+rJ+Whk:UrD0KawXlfbMRc4+g+W6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NL Hybrid.dll

Files

NL Hybrid.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

NL Hybrid.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 4.2MB - Virtual size: 4.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ