18386210e8667e0186189f59e22c3bca2398de3bff739ba2f0eb2523bc0d9750

Sharing

Copy URL Twitter E-mail

General

Target

18386210e8667e0186189f59e22c3bca2398de3bff739ba2f0eb2523bc0d9750
Size

108KB
MD5

ea97450a18e8da151bb5a053e7f8b08b
SHA1

985d6b4336a2d2b928c6a9b1b350b0c9e9f4ad9c
SHA256

18386210e8667e0186189f59e22c3bca2398de3bff739ba2f0eb2523bc0d9750
SHA512

f533adf8c37682df13b70346e4933719bec3de43c294b5b51012bfe3e901993d7a63943ca60f13dc0bbd9e18a7a5a3a5c50de29236f63f6ae76fca4737bda6d0
SSDEEP

3072:jAAN3I0VaGzc9r9+iJsuIo/cVNcZVGk2Y7B6:T60Zar9+iJj/cHkE

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

18386210e8667e0186189f59e22c3bca2398de3bff739ba2f0eb2523bc0d9750
.exe windows x64

06d26e2983bc313a82d340968c0518fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

_initterm
__wgetmainargs
_wcmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__setusermatherr
_wcslwr
strlen
qsort
_purecall
memmove
wcsrchr
wcscmp
_commode
_fmode
__set_app_type
__dllonexit
malloc
_memicmp
free
wcschr
modf
_wtoi
wcstoul
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_wtol
memcmp
_wcsicmp
memcpy
wcslen
_ultow
memset
wcscpy
wcscat
_itow
_snwprintf
wcsncat

comctl32

ImageList_Create
ImageList_AddMasked
ord17
ImageList_SetImageCount
CreateStatusWindowW
CreateToolbarEx

kernel32

ExitProcess
ReadProcessMemory
GetCurrentProcess
SetErrorMode
DeleteFileW
WideCharToMultiByte
GetStdHandle
GetPrivateProfileStringW
EnumResourceNamesW
GetPrivateProfileIntW
GetCurrentProcessId
OpenProcess
EnumResourceTypesW
GetStartupInfoW
GetSystemTimeAsFileTime
LoadLibraryW
FormatMessageW
FreeLibrary
SystemTimeToFileTime
CompareFileTime
FileTimeToLocalFileTime
LocalFree
GetSystemTime
FileTimeToSystemTime
GetProcAddress
GetLastError
ExpandEnvironmentStringsW
FindResourceW
LoadResource
GlobalAlloc
LockResource
LoadLibraryExW
GlobalUnlock
GetTempPathW
GetDateFormatW
GlobalLock
SizeofResource
GetTempFileNameW
GetFileSize
GetVersionExW
GetModuleHandleW
GetTimeFormatW
SetFilePointer
GetFileAttributesW
ReadFile
CloseHandle
WriteFile
GetModuleFileNameW
GetWindowsDirectoryW
CreateFileW
WritePrivateProfileStringW

user32

SetForegroundWindow
BeginPaint
ReleaseCapture
EndPaint
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
SetWindowTextW
SetDlgItemTextW
GetDlgItemTextW
CreateWindowExW
SendDlgItemMessageW
GetDlgItemInt
EndDialog
GetDlgItem
SetDlgItemInt
SetMenu
TranslateAcceleratorW
SetWindowPos
GetWindowPlacement
LoadAcceleratorsW
DefWindowProcW
UpdateWindow
SendMessageW
GetSystemMetrics
PostMessageW
RegisterClassW
MessageBoxW
GetWindowRect
LoadImageW
SetWindowLongW
GetWindowLongW
InvalidateRect
SetFocus
GetMenu
GetDC
EmptyClipboard
GetSubMenu
EnableMenuItem
ReleaseDC
GetClassNameW
OpenClipboard
MoveWindow
GetMenuItemCount
GetClientRect
CheckMenuItem
GetMenuStringW
CheckMenuRadioItem
GetCursorPos
ScreenToClient
SetClipboardData
GetSysColor
CloseClipboard
EnableWindow
MapWindowPoints
LoadMenuW
ModifyMenuW
GetMenuItemInfoW
GetDlgCtrlID
DestroyMenu
GetParent
DialogBoxParamW
CreateDialogParamW
EnumChildWindows
LoadStringW
DestroyWindow
GetWindowTextW
LoadIconW
DeferWindowPos
GetFocus
RemoveMenu
KillTimer
RegisterWindowMessageW
AppendMenuW
TrackPopupMenu
PostQuitMessage
GetMessageW
IsDialogMessageW
TranslateMessage
SetTimer
DispatchMessageW
DrawTextExW
EndDeferWindowPos
BeginDeferWindowPos
SetCapture
FillRect

gdi32

DeleteObject
GetStockObject
GetTextExtentPoint32W
SetBkColor
GetDeviceCaps
PatBlt
CreateSolidBrush
SelectObject
SetTextColor
CreateFontIndirectW
SetBkMode

comdlg32

GetSaveFileNameW
FindTextW

advapi32

RegCloseKey
RegConnectRegistryW
RegOpenKeyExW
RegEnumKeyExW
RegQueryValueExW
LookupAccountSidW

shell32

ShellExecuteW
Shell_NotifyIconW
SHGetFileInfoW

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

06d26e2983bc313a82d340968c0518fa

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

comctl32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

Sections

.text Size: 71KB - Virtual size: 70KB

.rdata Size: 17KB - Virtual size: 17KB

.data Size: 1KB - Virtual size: 7KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 14KB - Virtual size: 14KB

.text
Size: 71KB - Virtual size: 70KB

.rdata
Size: 17KB - Virtual size: 17KB

.data
Size: 1KB - Virtual size: 7KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 14KB - Virtual size: 14KB