Nursultan[.]rar | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nursultan.rar
Size 2.2MB
Sample260908-pmlleazfrd
SHA256 5fe51df8bce0128d4dd12a55679fc4ea7fc6fbaa568667b9e95be79502dfc512
MD5 d6d41c7ecaf21d0244f4b044571560ae
SHA1 dc7ceb16ac0a052469e0ab62731cf7fe548c6c32
SHA512 75934f7ab733b8db4b15de237aab10823e4908b6fe3bc96293f491e4d42ddf3a62f6b31e3459940d32f1a1c4152ee1c54db33f77e3bd66f0147085674897fa75
SSDEEP 49152:IeUA8DewXkNz2fkp7sHu+rD0Yy3SGduCJBkfxTRhHb78xKJX:CAj6kruu+nG+CDkf9RhH8A
TLSH
T1A7B533C9842222C790388C636B10D529EFFB39EE35945596083DF5B4A9C34A7B6F1FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nursultan.exe

File Explorer

Nursultan.rar

.rar 2.2MB
Nursultan.exe

.exe 2.9MB

Nursultan.rar

SHA256 5fe51df8bce0128d4dd12a55679fc4ea7fc6fbaa568667b9e95be79502dfc512
MD5 d6d41c7ecaf21d0244f4b044571560ae
SHA1 dc7ceb16ac0a052469e0ab62731cf7fe548c6c32
SHA512 75934f7ab733b8db4b15de237aab10823e4908b6fe3bc96293f491e4d42ddf3a62f6b31e3459940d32f1a1c4152ee1c54db33f77e3bd66f0147085674897fa75
SSDEEP 49152:IeUA8DewXkNz2fkp7sHu+rD0Yy3SGduCJBkfxTRhHb78xKJX:CAj6kruu+nG+CDkf9RhH8A
TLSH
T1A7B533C9842222C790388C636B10D529EFFB39EE35945596083DF5B4A9C34A7B6F1FB1
MD5 SHA1 SHA512 SSDEEP TLSH

Password

123

Nursultan.exe

IMPHASH 3d303175fced9345f14b8a51817a6c63
SHA256 abba089518b1b76508c86b53193da43af7b3f3082c44289d7a29f9c1899fc100
MD5 38f5d373e29e592c1847a44312e1a3c2
SHA1 b5def9b36f6ae0335be233d732a244d4df9f4148
SHA512 e7c63afb2f4656dbae32ee4232c6affab89d29273a365e256b6f2bfe1f5d5c73c986bbbf23aea938a0cdd72c8e21ccfcc5018b70bbf1f4453c62474f1863f4c4
SSDEEP 49152:FMyE/HE3Ma/0s2er5sHPg6EZ0ChjGQRZaHHRQRBcknlpSyhLDVHo6yll:FMhkca/0s2TtEjNRZamRBcOzvVI6
TLSH
T16BD5239832DAFCE9D4268FF2070D9670662B6F64CFE4D49701847312ED706FB6924BA4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

123

Minor OS version

Major OS version

Entry point

4416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Nursultan.rar

Nursultan.exe

msvcrt

kernel32

generic