86c433cb05aaed449b8098603a4da50356393cd275b78f4d4823356183d0ccc0

General

Target

86c433cb05aaed449b8098603a4da50356393cd275b78f4d4823356183d0ccc0
Size

2.7MB
MD5

308eeca161ce5bda319c4cbb6820cfe0
SHA1

4d916643dcb74e26e6ca2ba31cb9caba29956c1c
SHA256

86c433cb05aaed449b8098603a4da50356393cd275b78f4d4823356183d0ccc0
SHA512

f76d21d15044eca76d3178093e4c868e2c7f34811ea2116eaacf88bfb69d344b423d220afa02217361123dd5f133e3b05655a753897271946b65e39648e126a2
SSDEEP

49152:DvPRrSsTYIrIUgOQ+tTLn+DEz+IBb6yXRo5glSj9eMA88jH:TPNbILJ+t3Op2JXRo53eMA8uH

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

86c433cb05aaed449b8098603a4da50356393cd275b78f4d4823356183d0ccc0
.exe windows x86

e3375863abbd62135baac702f4deff18

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

RaiseException
LocalAlloc
GetModuleHandleA
LeaveCriticalSection
EnterCriticalSection
GetCurrentDirectoryA
GetShortPathNameA
FindResourceExA
EnumResourceLanguagesA
ResumeThread
WriteProcessMemory
LocalFree
GetCurrentThreadId
SetFileAttributesA
CreateDirectoryA
QueryPerformanceCounter
QueryPerformanceFrequency
GetPrivateProfileSectionA
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
GetProcAddress
InitializeCriticalSection
HeapValidate
lstrcatA
WideCharToMultiByte
RtlUnwind
GetStringTypeW

user32

SetFocus
AdjustWindowRectEx
DefWindowProcA

advapi32

RegCreateKeyA
RegSetValueA
RegCloseKey

ole32

CoRegisterClassObject
ReadClassStm

Sections

0
Size: 32KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

1
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

2
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

3
Size: 48KB - Virtual size: 65KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

4
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

5
Size: 12KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e3375863abbd62135baac702f4deff18

Headers

File Characteristics

Imports

kernel32

user32

advapi32

ole32

Sections

0 Size: 32KB - Virtual size: 86KB

1 Size: 4KB - Virtual size: 3KB

2 Size: 1.3MB - Virtual size: 1.3MB

3 Size: 48KB - Virtual size: 65KB

4 Size: 8KB - Virtual size: 4KB

5 Size: 12KB - Virtual size: 37KB

0
Size: 32KB - Virtual size: 86KB

1
Size: 4KB - Virtual size: 3KB

2
Size: 1.3MB - Virtual size: 1.3MB

3
Size: 48KB - Virtual size: 65KB

4
Size: 8KB - Virtual size: 4KB

5
Size: 12KB - Virtual size: 37KB