NTpassworder[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
NTpassworder.rar
Size 191KB
Sample260727-ptbpsasdre
SHA256 b8a27c9a8d053ee8cd54442d84d7570ad35efe874586b6ac3d2f6159ea8488a9
MD5 836d4ccc2d0e89e6ce56eadc0d4f0211
SHA1 44dbaadf4fa865a4c74b81c67a88761034c8b0e0
SHA512 02878d8754f206daeb88605a2b948f22796a6aa9cd8127acef54fa4c7f56f775a81b2382cad9b7d8fef8706f98e1fc19d93e25271504876e1dd1b5a720461645
SSDEEP 3072:fsfIqqU9FrQXpauA3hQLq15ky+dJkilI2caJJjNKkhD58R+98zfjY1fVIOukbFRF:fD7UTc0RF+dXPcm3hL9iq3ua
TLSH
T1111412A906C99A79AF4CDF7DCC9B8E17B4D425161380FF00193A70EA68B33D15BE2725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/NT passworder/NTPassworder.exe

File Explorer

NTpassworder.rar

.rar 191KB
NT passworder/NTPassworder.exe

.exe 497KB
NT passworder/readme.txt

1KB

NTpassworder.rar

SHA256 b8a27c9a8d053ee8cd54442d84d7570ad35efe874586b6ac3d2f6159ea8488a9
MD5 836d4ccc2d0e89e6ce56eadc0d4f0211
SHA1 44dbaadf4fa865a4c74b81c67a88761034c8b0e0
SHA512 02878d8754f206daeb88605a2b948f22796a6aa9cd8127acef54fa4c7f56f775a81b2382cad9b7d8fef8706f98e1fc19d93e25271504876e1dd1b5a720461645
SSDEEP 3072:fsfIqqU9FrQXpauA3hQLq15ky+dJkilI2caJJjNKkhD58R+98zfjY1fVIOukbFRF:fD7UTc0RF+dXPcm3hL9iq3ua
TLSH
T1111412A906C99A79AF4CDF7DCC9B8E17B4D425161380FF00193A70EA68B33D15BE2725
MD5 SHA1 SHA512 SSDEEP TLSH

NT passworder/NTPassworder.exe

SHA256 7c665ba66d95654a93416ee96a42a0582b4054fbb2fa833631004f93255e1998
MD5 9e672021265599c6bfb828717dec896a
SHA1 7533b4b3cef784adda55c797052e71d6ae3d5232
SHA512 1f0b4dd7f7acbf60cc528f18c142f35dcc40d66cf966a693c5ded1744d11586dc6d6d4e64509806396d8f804de147fb721c1367cdbbe96f3fc6297a5106fb562
SSDEEP 6144:kyM9608MABic5kVrxmPL0WFIoa8A+8kO/C79ROE40KOc2iB3pJzP/5rdJq0JX6Wm:3M96JMABd5arcPH8kESc22n5JJdJlRv
TLSH
T1A6B46C22B3B04473C1772A389C1B97AD683AFD10392999866FF53D4C5F38281797B297
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

407228

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

394KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NTpassworder.rar

NT passworder/NTPassworder.exe

generic

NT passworder/readme.txt