a42f8a7bdc23ccae3f0a879caa930325[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a42f8a7bdc23ccae3f0a879caa930325.exe
Size

728KB
MD5

a42f8a7bdc23ccae3f0a879caa930325
SHA1

e437f60aae21a8163d5fe7309b9db693da854b2e
SHA256

c6fcd571899853319ca5492a6df9e6d066ea86797033dff2b71ccee9c284b482
SHA512

6b4a5d0bd51fc4d767059a54c16f112618769837f65f612cfa25a4146d249590e78290a7b1db8f8b2b3359d54264206bce87c798b9c775b23abc165d90540e1b
SSDEEP

12288:fCp3c2o/vndz/ju0+4WFN5RSmIdbWb9M1eL1PG1Zke:fQc2o/1zS0+15RSmIdbWb9ZP

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

a42f8a7bdc23ccae3f0a879caa930325.exe
.exe windows x86

db3ba5a38c467c1467d8cab70dfeeb13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__setusermatherr
_initterm
_except_handler3
_onexit
_adjust_fdiv
__set_app_type
__p__fmode
__p__commode
__dllonexit
__getmainargs
__p___initenv
exit
_XcptFilter
toupper
_exit
rand
_controlfp
srand
_kbhit

kernel32

GetConsoleWindow
SetConsoleCursorPosition
EnumResourceTypesA
GetStdHandle

gdi32

GetTextExtentPoint32W
RectVisible
CreateDIBitmap
EnumMetaFile
GetCharWidthA

resutils

ResUtilResourceTypesEqual
ResUtilStopResourceService
ResUtilVerifyPropertyTable
ResUtilGetSzProperty

rpcrt4

NdrRpcSmClientFree
NdrProxyGetBuffer
RpcImpersonateClient
NdrConformantVaryingArrayMarshall
NdrAllocate

ws2_32

WSALookupServiceBeginW
WSASetServiceA
WSAAsyncGetHostByName
gethostbyname
WSAJoinLeaf

comdlg32

ChooseFontW
PrintDlgW
PrintDlgExW

user32

ShowWindow
DrawTextA
ShowWindowAsync
EmptyClipboard
PtInRect
OpenWindowStationA

mscms

AssociateColorProfileWithDeviceA
IsColorProfileTagPresent
GetStandardColorSpaceProfileA

wsnmp32

ord400
ord604
ord102
ord206
ord602
ord103

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db3ba5a38c467c1467d8cab70dfeeb13

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

gdi32

resutils

rpcrt4

ws2_32

comdlg32

user32

mscms

wsnmp32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 6KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 1024B - Virtual size: 800B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 1024B - Virtual size: 800B