Behavioral task
behavioral1
Sample
48f527c579252b56d189b71ad0fee6e1e01c099dfcdd724360172e04ef1ab946.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
48f527c579252b56d189b71ad0fee6e1e01c099dfcdd724360172e04ef1ab946.exe
Resource
win10v2004-20241007-en
General
-
Target
48f527c579252b56d189b71ad0fee6e1e01c099dfcdd724360172e04ef1ab946.exe
-
Size
63KB
-
MD5
c4eeb842564c5e9f732ac1a3f55259d9
-
SHA1
c78a419cfc967bea38671e105c94a71426b4b8b5
-
SHA256
48f527c579252b56d189b71ad0fee6e1e01c099dfcdd724360172e04ef1ab946
-
SHA512
c7d0c157e6bb9ff1afa342422e16a1081a3dd06c3524488b631c2a98c6360b4339c0d78a53d902af75eb71f6b1604f0c9c5bda9c36331332a94633e2b70b589f
-
SSDEEP
768:Ohwo1eiqkyPkhGOMTQU9RC/4qF+xiaufjtCWWifcejMsN08882TV5:gFeuyzDTxkDNacY2kejMsWR5
Malware Config
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 48f527c579252b56d189b71ad0fee6e1e01c099dfcdd724360172e04ef1ab946.exe
Files
-
48f527c579252b56d189b71ad0fee6e1e01c099dfcdd724360172e04ef1ab946.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 60KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 488B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ