9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152

Sharing

Copy URL Twitter E-mail

General

Target
9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152
Size 7.4MB
Sample260930-nrat2aec44
SHA256 9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152
MD5 aa05e227901cf572661cd808df1eee03
SHA1 f2a3c0a9b691174913a51002a7accd1318c1949a
SHA512 642070a47dfccc43744a826986b2e637f1683b0ad65fa9359169a5a8ad8bb683ae3c2318b5fb6b53ad6e348bcb52ab1019881ecb3fe6af4d7c93a5d20a776b6e
SSDEEP 49152:1Xd4953efQHfAvE8YVmhauVc2W1N8hyEcWXFeCo3xSVQoxE/o7ERjXXynaJpKCK0:1aXuI0E8YMSErmhSF7b7xEuq
TLSH
T1E6765B07ECA514E9C0AED1308A6695137B31BC895B3263D71B90F6287F73BE4ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152

File Explorer

9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152

.exe 7.4MB

9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152

IMPHASH 4e2bd2c481372f7ab13b83b63b424e97
SHA256 9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152
MD5 aa05e227901cf572661cd808df1eee03
SHA1 f2a3c0a9b691174913a51002a7accd1318c1949a
SHA512 642070a47dfccc43744a826986b2e637f1683b0ad65fa9359169a5a8ad8bb683ae3c2318b5fb6b53ad6e348bcb52ab1019881ecb3fe6af4d7c93a5d20a776b6e
SSDEEP 49152:1Xd4953efQHfAvE8YVmhauVc2W1N8hyEcWXFeCo3xSVQoxE/o7ERjXXynaJpKCK0:1aXuI0E8YMSErmhSF7b7xEuq
TLSH
T1E6765B07ECA514E9C0AED1308A6695137B31BC895B3263D71B90F6287F73BE4ADB9350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

564320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

459KB

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

9bef20286a0136422e3639e6aca10238dfdab4b3effde04a33e0567b06b2b152

kernel32

generic