nrich-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nrich-windows-x86_64.exe
Size 5.6MB
Sample260723-ajvycabl4y
SHA256 fa47586931567ac3c7cb91ca10013c6cc8ef643e8e5e207d6622dd02c34d084b
MD5 9313fa5e232c5b52db26b7caf088cfbf
SHA1 c4c8651a7b3fbd91e83bdd281298f7773c8221e3
SHA512 854c58731217c527d861c01d0a5978b2c57039c36f9231b0d0731fd310d32ad5b556b78b171f1559cbeaf0d76a1ecd8f94231f443bc085aaa2c8988ec10d027b
SSDEEP 49152:gcbLJGFmchrlriEnZHpMHS57ntsAWHXb9wa1wIU6iz+wPMbZg29Ejh2MmLqCMJig:bkmVYx2iWt3b9w8+zdqZJiO+FdLeUoW
TLSH
T1C8468D02E9981AF1E89BCA74885F932A77317E09D715D3E70A3592751D633C2EF0EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nrich-windows-x86_64.exe

File Explorer

nrich-windows-x86_64.exe

.exe 5.6MB

nrich-windows-x86_64.exe

IMPHASH eea2ad09195320e36f7423153e952e55
SHA256 fa47586931567ac3c7cb91ca10013c6cc8ef643e8e5e207d6622dd02c34d084b
MD5 9313fa5e232c5b52db26b7caf088cfbf
SHA1 c4c8651a7b3fbd91e83bdd281298f7773c8221e3
SHA512 854c58731217c527d861c01d0a5978b2c57039c36f9231b0d0731fd310d32ad5b556b78b171f1559cbeaf0d76a1ecd8f94231f443bc085aaa2c8988ec10d027b
SSDEEP 49152:gcbLJGFmchrlriEnZHpMHS57ntsAWHXb9wa1wIU6iz+wPMbZg29Ejh2MmLqCMJig:bkmVYx2iWt3b9w8+zdqZJiO+FdLeUoW
TLSH
T1C8468D02E9981AF1E89BCA74885F932A77317E09D715D3E70A3592751D633C2EF0EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateIoCompletionPort CreateMutexA CreateThread CreateToolhelp32Snapshot DuplicateHandle ExitProcess FormatMessageW GetCommandLineW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemInfo GetSystemTimeAsFileTime HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadConsoleW ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared SetConsoleMode SetFileCompletionNotificationModes SetFilePointerEx SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnmapViewOfFile WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtReadFile NtWriteFile RtlCaptureContext RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

496B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

855KB

Virtual Size

854KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

896B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

350KB

Virtual Size

349KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/35

Size

599KB

Virtual Size

598KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/61

Size

249KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/73

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/86

Size

715KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

512B

Virtual Size

234B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/127

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/143

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/159

Size

355KB

Virtual Size

354KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/172

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nrich-windows-x86_64.exe

kernel32

msvcrt

ntdll

advapi32

bcrypt

ws2_32

generic