Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
da5df9ef7d27acf7528a8b6b7cde2a10a31594347a6328affd5e0b219ccb45fbN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
da5df9ef7d27acf7528a8b6b7cde2a10a31594347a6328affd5e0b219ccb45fbN.exe
Resource
win10v2004-20241007-en
General
-
Target
da5df9ef7d27acf7528a8b6b7cde2a10a31594347a6328affd5e0b219ccb45fbN.exe
-
Size
29KB
-
MD5
9566e633b2a1ebc6bc652da1bda19760
-
SHA1
6edad8915c425d0e78552942e22b7a054e790cf1
-
SHA256
da5df9ef7d27acf7528a8b6b7cde2a10a31594347a6328affd5e0b219ccb45fb
-
SHA512
fcb6d74261cc879bd5bdce99014457f6342c4ef432bd65741858d12a62e87466ae4879f52e965e570a699091cf2ae11a1c36f1ea57b9f3f945e73ecf176b8345
-
SSDEEP
384:5PqvANl7TxTD+VF2dbofPauxnaIuXF5Xs4GOmqDwgjrzeo9GBsbh0w4wlAokw9OH:Ou75oa4fu124AqFjXeJBKh0p29SgRe/
Malware Config
Extracted
njrat
0.6.4
ام سلمان
127.0.0.1:1177
b00bcc1238637f2c38892eba30ad1638
-
reg_key
b00bcc1238637f2c38892eba30ad1638
-
splitter
|'|'|
Signatures
-
Njrat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da5df9ef7d27acf7528a8b6b7cde2a10a31594347a6328affd5e0b219ccb45fbN.exe
Files
-
da5df9ef7d27acf7528a8b6b7cde2a10a31594347a6328affd5e0b219ccb45fbN.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 27KB - Virtual size: 26KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1024B - Virtual size: 576B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ