Noro Free[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Noro Free.exe
Size 4.6MB
Sample261102-ljtk3aaz4j
SHA256 8510981131a905b9ae53ec1f1e0fb296e5aa7793d29a0747c5dbbd74ca3ec1b0
MD5 ed10ce12ab46d5ad24fbdee00ef935b0
SHA1 493b7a7c6251bad8b7e564aa92d42151398c591c
SHA512 5d330b7cdcfbc2daec1f2456d9525fc740b60e7347420bebe233e3c4e63d873a22324ec48d40376132298172c99be1a38168c7d1a016a33cc506db004cc475f1
SSDEEP 98304:00jU6157b81lZUGB2E+Q2Ld+Skl/wFQs2rBs3ZPp:aS5mP2lLrFp2rBs3ZP
TLSH
T1A236D02BF2A921E8D177D07DC55A8B1BEA71740947204ADB13D441A82F27BE45FBFB02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Noro Free.exe

File Explorer

Noro Free.exe

.exe 4.6MB

Noro Free.exe

IMPHASH b44afec8c04c2e7d9fad6d17b6736888
SHA256 8510981131a905b9ae53ec1f1e0fb296e5aa7793d29a0747c5dbbd74ca3ec1b0
MD5 ed10ce12ab46d5ad24fbdee00ef935b0
SHA1 493b7a7c6251bad8b7e564aa92d42151398c591c
SHA512 5d330b7cdcfbc2daec1f2456d9525fc740b60e7347420bebe233e3c4e63d873a22324ec48d40376132298172c99be1a38168c7d1a016a33cc506db004cc475f1
SSDEEP 98304:00jU6157b81lZUGB2E+Q2Ld+Skl/wFQs2rBs3ZPp:aS5mP2lLrFp2rBs3ZP
TLSH
T1A236D02BF2A921E8D177D07DC55A8B1BEA71740947204ADB13D441A82F27BE45FBFB02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24081

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Admin\Desktop\Current Projects\Noro\Noro External FREE\Noro\x64\Release\Noro.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

FreeLibrary GetProcAddress LoadLibraryA VerifyVersionInfoW CreateFileW DeleteFileA CloseHandle DeviceIoControl WaitForSingleObject Sleep CreateThread CreateProcessA CreateProcessW MapViewOfFile GetModuleHandleA CreateFileMappingA SetConsoleTitleW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW HeapSize SetStdHandle OutputDebugStringW SetConsoleCtrlHandler GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage GetExitCodeProcess HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx GetFileSizeEx GlobalAlloc QueryPerformanceFrequency FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW VirtualProtect IsThreadAFiber FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree HeapAlloc GetCurrentThread GetCommandLineW GetCommandLineA WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ResumeThread ExitThread ReadFile LoadLibraryExW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError QueryPerformanceCounter VerSetConditionMask WideCharToMultiByte MultiByteToWideChar GetFileAttributesA SetEndOfFile GlobalFree GlobalLock GetConsoleOutputCP GlobalUnlock GetConsoleMode LocalFree InterlockedFlushSList InterlockedPushEntrySList RtlUnwindEx RaiseException RtlPcToFileHeader ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind FormatMessageA GetLocaleInfoEx SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetDiskFreeSpaceExW GetFileAttributesW GetFileAttributesExW GetFileInformationByHandle GetFinalPathNameByHandleW GetFullPathNameW SetFileAttributesW SetFileInformationByHandle SetFileTime GetTempPathW AreFileApisANSI GetLastError CreateDirectoryExW CopyFileW MoveFileExW CreateHardLinkW GetFileInformationByHandleEx CreateSymbolicLinkW WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared TryAcquireSRWLockExclusive TryAcquireSRWLockShared GetTickCount64 EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait EncodePointer DecodePointer LCMapStringEx WakeConditionVariable GetStringTypeW CompareStringEx GetCPInfo

user32

UnregisterClassA OpenClipboard CloseClipboard SetClipboardData EmptyClipboard LoadIconW CallNextHookEx UnhookWindowsHookEx SetWindowsHookExW FindWindowW FindWindowA GetDesktopWindow SetWindowLongA GetWindowLongA MessageBoxW GetWindowRect SetForegroundWindow SetActiveWindow UpdateWindow GetSystemMetrics keybd_event GetAsyncKeyState SetFocus IsIconic SetWindowPos SetLayeredWindowAttributes ShowWindow DestroyWindow IsWindow CreateWindowExA RegisterClassExA IsChild PostQuitMessage DefWindowProcA PeekMessageA DispatchMessageW TranslateMessage GetMessageW SetProcessDPIAware MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen GetCursorPos SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow ReleaseCapture SetCapture GetCapture GetKeyState GetClipboardData

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

advapi32

GetUserNameW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmIsCompositionEnabled DwmExtendFrameIntoClientArea DwmGetColorizationColor DwmEnableBlurBehindWindow

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

786KB

Virtual Size

786KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.6MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

822B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Noro Free.exe

d3d11

kernel32

user32

gdi32

advapi32

imm32

d3dcompiler_47

dwmapi

generic