Static task
static1
Behavioral task
behavioral1
Sample
NFSW_hack.dll
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
NFSW_hack.dll
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
NFSW_hack.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
NFSW_hack.exe
Resource
win10v2004-20221111-en
General
-
Target
34f3219b1471ec5ddc810525c9164869334b261c65766aeb81e911053930fe6e
-
Size
9KB
-
MD5
0f59650ffe6531a9f7843dbfd8a518e5
-
SHA1
e4a03f0f56fa16bc4d04006938a893ef66ac0ed5
-
SHA256
34f3219b1471ec5ddc810525c9164869334b261c65766aeb81e911053930fe6e
-
SHA512
8c4ecdb4c6c3c42481c8c6b57e1fcf03a010dd3882e64215b7a1519ae18f713b434b8172ac824f9d0cc03538dc73c7e05a0c9dc6597fab28cad6d52775ffd19d
-
SSDEEP
192:bg2zCCNa5llombnqjoNkIN9oKt6KxOXMQ+YP0orLBGsJmUVl:EIAlKkqjDIUKdQ3xPgUVl
Malware Config
Signatures
Files
-
34f3219b1471ec5ddc810525c9164869334b261c65766aeb81e911053930fe6e.zip
-
NFSW_hack.cpl.dll windows x86
374f64698eb90c8224910defbe60a922
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
CreateRemoteThread
CreateThread
DisableThreadLibraryCalls
GetFullPathNameA
GetModuleHandleA
LoadLibraryA
OpenProcess
Sleep
TerminateProcess
VirtualAllocEx
VirtualFreeEx
VirtualProtect
WaitForSingleObject
WriteProcessMemory
user32
FindWindowA
GetAsyncKeyState
GetClientRect
GetForegroundWindow
GetWindowThreadProcessId
MessageBoxA
ShowWindowAsync
psapi
EnumProcessModules
GetModuleBaseNameA
GetModuleInformation
msvcrt
_strcmpi
memcpy
d3dx9_43
D3DXCreateFontA
Sections
.text Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
NFSW_hack.exe.exe windows x86
b19cf13d55ce46c7fb0e5f9dd31ab8d6
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateRemoteThread
OpenMutexA
OpenProcess
VirtualAllocEx
WriteProcessMemory
user32
FindWindowA
GetWindowThreadProcessId
Sections
.text Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ