NecrumESP[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

NecrumESP.exe
Size

8.4MB
MD5

4bc692a38e8d009ff6d4e39cd75e5853
SHA1

5258f5d241e49703121aa8f7172ad259dbe19ced
SHA256

9e7f697768722f91655539636dcba17b5d45a8ee15efc5c4f779e360108388c8
SHA512

9e650762e413a0bb4f624183ca7cf269ff43cc993b421901eb2b6b2a44d14d5a38f56328deb8b158c63881fb92efc0aaaa5b54f8462ce1a28293a4093a4400be
SSDEEP

196608:Dn5DRInzL1B0WKpLZM6xI6qC/t/6fiYKpPEOrc0uLZ4:bfVxzQoZxrc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NecrumESP.exe

Files

NecrumESP.exe
.exe windows:6 windows x64 arch:x64

215eda3174fd9ac4a553f7af8abf29a1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

RegisterEventSourceA

kernel32

GetModuleHandleA

shell32

SHChangeNotifyRegister

user32

EndDialog

Sections

Size: - Virtual size: 971KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: - Virtual size: 267KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 7.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE