a[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

a.exe
Size

728KB
MD5

a1421248823ec7c199da006cd1bb7db1
SHA1

2da2298dab9a9af9fbb03747430b4d528d4792c1
SHA256

15f3c08dff5620da0ef6d33db8dc54d22c4e4dcb4af1abcfd4ea6d08e374b072
SHA512

bb78de83af2e30472e2d9d28bd56a271a90dfc6d3918099ae0b1483522c8a78b0e64855ee3fd1ac9cb4c4f06eb4a0afe29e09f56fbc139c2168951fe333beb83
SSDEEP

12288:fCp3c2o/vndz/ju0+4WFN5RSmIdbWb9M1eL1PG1Zke:fQc2o/1zS0+15RSmIdbWb9ZP

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Files

a.exe
.exe windows x86

db3ba5a38c467c1467d8cab70dfeeb13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

__setusermatherr
_initterm
_except_handler3
_onexit
_adjust_fdiv
__set_app_type
__p__fmode
__p__commode
__dllonexit
__getmainargs
__p___initenv
exit
_XcptFilter
toupper
_exit
rand
_controlfp
srand
_kbhit

kernel32

GetConsoleWindow
SetConsoleCursorPosition
EnumResourceTypesA
GetStdHandle

gdi32

GetTextExtentPoint32W
RectVisible
CreateDIBitmap
EnumMetaFile
GetCharWidthA

resutils

ResUtilResourceTypesEqual
ResUtilStopResourceService
ResUtilVerifyPropertyTable
ResUtilGetSzProperty

rpcrt4

NdrRpcSmClientFree
NdrProxyGetBuffer
RpcImpersonateClient
NdrConformantVaryingArrayMarshall
NdrAllocate

ws2_32

WSALookupServiceBeginW
WSASetServiceA
WSAAsyncGetHostByName
gethostbyname
WSAJoinLeaf

comdlg32

ChooseFontW
PrintDlgW
PrintDlgExW

user32

ShowWindow
DrawTextA
ShowWindowAsync
EmptyClipboard
PtInRect
OpenWindowStationA

mscms

AssociateColorProfileWithDeviceA
IsColorProfileTagPresent
GetStandardColorSpaceProfileA

wsnmp32

ord400
ord604
ord102
ord206
ord602
ord103

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db3ba5a38c467c1467d8cab70dfeeb13

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

kernel32

gdi32

resutils

rpcrt4

ws2_32

comdlg32

user32

mscms

wsnmp32

Sections

.text Size: 6KB - Virtual size: 5KB

.rdata Size: 2KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 6KB

.rsrc Size: 36KB - Virtual size: 35KB

.reloc Size: 1024B - Virtual size: 800B

.text
Size: 6KB - Virtual size: 5KB

.rdata
Size: 2KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 36KB - Virtual size: 35KB

.reloc
Size: 1024B - Virtual size: 800B