76e164795f3f9309850c181013bde4866efd155610d80ec23bd474f76e497bdd

Sharing

Copy URL

Twitter E-mail

General

Target

76e164795f3f9309850c181013bde4866efd155610d80ec23bd474f76e497bdd
Size

507KB
MD5

0d0a1da8b156e829b5f89c52e37ba3ba
SHA1

159f12b4cc694e63cf62c2f6cc6a1bb4a0328d0d
SHA256

76e164795f3f9309850c181013bde4866efd155610d80ec23bd474f76e497bdd
SHA512

0ec3f17d2c3186f06537d1fc4bf58166e75b3092f7e696086036d00092686741dec37f96cf3cfa42060e5274cd652e3d65ace661d10fd5c527b218b175d81a4f

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

Processes:

resource yara_rule

sample Nirsoft

resource	yara_rule
sample	Nirsoft

Files

76e164795f3f9309850c181013bde4866efd155610d80ec23bd474f76e497bdd
.exe windows x86

a0b975da9c53fe09ef3f52ac3b721930

Code Sign

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

CreateStatusWindowW
ImageList_AddMasked
ImageList_SetImageCount
ImageList_Create
CreateToolbarEx
ord17

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

WideCharToMultiByte
GetTempPathW
GetLocaleInfoW
GetLastError
CreateDirectoryW
SizeofResource
GlobalLock
GetCommandLineW
FormatMessageW
GetVersionExW
GetDateFormatW
GetTempFileNameW
GetTimeFormatW
GetModuleHandleW
GetFileAttributesW
GetWindowsDirectoryW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
EnumResourceNamesW
GetStdHandle
SetErrorMode
DeleteFileW
ReadProcessMemory
GetCurrentProcessId
ExitProcess
GetCurrentProcess
TerminateProcess
OpenProcess
EnumResourceTypesW
GetSystemInfo
GetTickCount
UnlockFileEx
GetFullPathNameW
GetSystemTimeAsFileTime
FlushFileBuffers
GetFullPathNameA
FormatMessageA
GetFileAttributesExW
DeleteCriticalSection
InitializeCriticalSection
CreateFileA
LockFileEx
MapViewOfFile
UnmapViewOfFile
EnterCriticalSection
SetEndOfFile
GetTempPathA
GetDiskFreeSpaceW
Sleep
GetSystemTime
LoadLibraryA
AreFileApisANSI
LoadLibraryExW
QueryPerformanceCounter
LeaveCriticalSection
GetFileAttributesA
CreateFileMappingW
InterlockedCompareExchange
UnlockFile
GetDiskFreeSpaceA
LockFile
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
RtlUnwind
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
GetConsoleMode
GetConsoleCP
GetStartupInfoA
GetFileType
SetHandleCount
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
GetTimeZoneInformation
LCMapStringW
LCMapStringA
GetModuleFileNameA
VirtualAlloc
VirtualFree
HeapCreate
HeapDestroy
RaiseException
HeapSize
GetCurrentThreadId
SetLastError
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleA
IsValidCodePage
GetOEMCP
GetACP
InterlockedDecrement
InterlockedIncrement
GetCPInfo
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
VirtualQuery
GetStartupInfoW
GetProcessHeap
GetVersionExA
HeapReAlloc
HeapAlloc
HeapFree
GlobalUnlock
LoadResource
GlobalAlloc
FindResourceW
lstrlenW
MultiByteToWideChar
lstrcpyW
LockResource
GetNumberFormatW
CreateFileW
WriteFile
LocalFree
GetModuleFileNameW
ReadFile
SetFileTime
SetFilePointer
GetProcAddress
FileTimeToSystemTime
LoadLibraryW
FreeLibrary
CompareFileTime
FileTimeToLocalFileTime
SystemTimeToFileTime
CloseHandle
GetFileSize
WriteConsoleW
CompareStringA
CompareStringW
SetEnvironmentVariableA
DeleteFileA

user32

GetMessageW
PostQuitMessage
TrackPopupMenu
RegisterWindowMessageW
LoadIconW
DestroyIcon
GetMenuItemInfoW
ModifyMenuW
LoadMenuW
GetWindowTextW
GetDesktopWindow
SetWindowPos
LoadStringW
EnumChildWindows
ShowWindow
ChildWindowFromPoint
SetCursor
LoadCursorW
DestroyWindow
CreateDialogParamW
DialogBoxParamW
DestroyMenu
GetDlgCtrlID
CheckMenuItem
CloseClipboard
GetMenuItemCount
GetMenuStringW
IsDialogMessageW
TranslateMessage
DrawTextExW
DispatchMessageW
PeekMessageW
GetSysColorBrush
SetDlgItemTextW
GetDlgItemTextW
GetSystemMetrics
DeferWindowPos
CreateWindowExW
MoveWindow
OpenClipboard
GetClassNameW
ReleaseDC
EmptyClipboard
GetDC
GetSubMenu
GetMenu
MapWindowPoints
EnableWindow
SetClipboardData
GetSysColor
GetParent
GetCursorPos
SetFocus
BeginDeferWindowPos
EndDeferWindowPos
GetWindowLongW
LoadImageW
LoadAcceleratorsW
GetWindowPlacement
SetMenu
MessageBoxW
RegisterClassW
SetWindowPlacement
SendMessageW
TranslateAcceleratorW
DefWindowProcW
PostMessageW
GetClientRect
UpdateWindow
BeginPaint
SetWindowTextW
SetDlgItemInt
DrawFrameControl
GetWindow
InvalidateRect
GetDlgItem
EndPaint
SetWindowLongW
EndDialog
SendDlgItemMessageW
GetDlgItemInt
GetWindowRect
EnableMenuItem

gdi32

SetBkColor
GetTextExtentPoint32W
GetStockObject
GetDeviceCaps
SelectObject
SetBkMode
DeleteObject
SetTextColor
CreateFontIndirectW

comdlg32

FindTextW
GetOpenFileNameW
GetSaveFileNameW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

SHGetMalloc
SHBrowseForFolderW
DragFinish
DragQueryFileW
DragAcceptFiles
SHGetFileInfoW
ShellExecuteW
SHGetPathFromIDListW

ole32

CoUninitialize
CoInitialize

Sections

.text
Size: 372KB - Virtual size: 371KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 52KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rmnet
Size: 56KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a0b975da9c53fe09ef3f52ac3b721930

Code Sign

Headers

File Characteristics

Imports

comctl32

version

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

Sections

.text Size: 372KB - Virtual size: 371KB

.rdata Size: 52KB - Virtual size: 52KB

.data Size: 9KB - Virtual size: 22KB

.rsrc Size: 16KB - Virtual size: 15KB

.rmnet Size: 56KB - Virtual size: 60KB

.text
Size: 372KB - Virtual size: 371KB

.rdata
Size: 52KB - Virtual size: 52KB

.data
Size: 9KB - Virtual size: 22KB

.rsrc
Size: 16KB - Virtual size: 15KB

.rmnet
Size: 56KB - Virtual size: 60KB