CrazyNCS[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
CrazyNCS.zip
Size 115KB
Sample260930-ev5ddaee26
SHA256 427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5
MD5 fdb5b1c351ef0edfef254ff89a173fd6
SHA1 ff6733409e27565058ee84ec556e3f6cc8ffdcd0
SHA512 8acf46c245404fc0a3d17e6153af8eca9d13f91b8446dcc82853b2462e7a4d89e5da660d4319d936c5af8bf67643981c9bc76f47279a3c4b45e635fb72e98249
SSDEEP 3072:vTySkDZ+RJlMn6w92zijjeUv9UmPuLTLLF:vGDFybS6Ojij0UvB
TLSH
T1E2B31240A919A8248A2FFD76307888E2D524015060EEFE5F8FF5DF9E45571C0EED83AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/CrazyNCS.exe

File Explorer

CrazyNCS.zip

.zip 115KB
CrazyNCS.exe

.exe 122KB

CrazyNCS.zip

SHA256 427bf5324d72089825d253b3515c0d3615cf65623ff59705ad3b2d6a347bc4b5
MD5 fdb5b1c351ef0edfef254ff89a173fd6
SHA1 ff6733409e27565058ee84ec556e3f6cc8ffdcd0
SHA512 8acf46c245404fc0a3d17e6153af8eca9d13f91b8446dcc82853b2462e7a4d89e5da660d4319d936c5af8bf67643981c9bc76f47279a3c4b45e635fb72e98249
SSDEEP 3072:vTySkDZ+RJlMn6w92zijjeUv9UmPuLTLLF:vGDFybS6Ojij0UvB
TLSH
T1E2B31240A919A8248A2FFD76307888E2D524015060EEFE5F8FF5DF9E45571C0EED83AB
MD5 SHA1 SHA512 SSDEEP TLSH

CrazyNCS.exe

SHA256 6820c71df417e434c5ad26438c901c780fc5a80b28a466821b47d20b8424ef08
MD5 d043ba91e42e0d9a68c9866f002e8a21
SHA1 e9f177e1c57db0a15d1dc6b3e6c866d38d85b17c
SHA512 3e9783646e652e9482b3e7648fb0a5f7c8b6c386bbc373d5670d750f6f99f6137b5501e21332411609cbcc0c20f829ab8705c2835e2756455f6754c9975ac6bd
SSDEEP 1536:frNvVsJysJYUjwRBRZ+dtf9naYlN4ZqhOn6w92znPIW+M2TlT8KV2enfBA2yYd1:zNv+JyS0DZ+hJlMn6w92zgnMq85f2v
TLSH
T1E5C31200EB660D9BE46AA73424FE76E26A244412443CF75F8AF2625F1C31568AF7077B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

323585

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

92KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

DATA

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.aspack

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

CrazyNCS.zip

CrazyNCS.exe

generic