Noob[.]rar | Triage

Sharing

General

Target

Noob.rar
Size

229KB
MD5

730fc7449475b23b30cf3a8e81b6f52a
SHA1

c6b47debd604cc8612c80096b7bc9150c8731ac5
SHA256

e374b2e875ac81359fadd54cb01e746af430034cf94e7bcc881cf08996c5cc45
SHA512

22af8ba571b85448dff1c98b7c822afa16e261b85541da9973cd087fb1d53f3fc0ef5fbf25aa50562e70d8c4f158b5e6f2faceb5b5ff996102aa6544f5b596b7
SSDEEP

6144:aRPrdERTINWv0h3NR8jYBPAdpKa6TmQ/XnL+DASR:aJr+eNWsdHAYBPA6/S4XnL+0A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/BootstrapperV1.23.exe

Files

Noob.rar
.rar
BootstrapperV1.23.exe
.exe windows:4 windows x64 arch:x64

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 797KB - Virtual size: 797KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
script.txt
solaraexexecute.txt