Static task
static1
Behavioral task
behavioral1
Sample
b368b4f8ba0c292896547adf2a35f967.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b368b4f8ba0c292896547adf2a35f967.exe
Resource
win10v2004-20221111-en
General
-
Target
b368b4f8ba0c292896547adf2a35f967.exe
-
Size
704KB
-
MD5
b368b4f8ba0c292896547adf2a35f967
-
SHA1
02db58020730eb1fb7169c3d4ccc6f17aa3b6037
-
SHA256
2e11a21dab7ad117856ecb9f80cdb22241bf6b4a0f231e05483bdddf997fbae5
-
SHA512
0412f02ee3feb86daca01131d7f7fd52037ed6484edd8188c62eeb9c43db7fa6443d5ce9ed3b9c2daba70cadba8d71badecb6dc2670c85b64a6829e80e194d11
-
SSDEEP
12288:aCe8LxGQ7MRSRAsDYeQBWlWc4b70eU06zTwjZ++R5Mi6/ZVgCp0TLAXZoCzZWpfb:aN88Q7aQjDYLWlhW7JUyZ++R5PyZ5pcN
Malware Config
Signatures
-
Nirsoft 1 IoCs
Processes:
resource yara_rule sample Nirsoft
Files
-
b368b4f8ba0c292896547adf2a35f967.exe.exe windows x86
755b26ee88bff31382938e00e4a0bfa6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
VirtualProtect
GetConsoleWindow
wsnmp32
ord106
ord999
ord220
ord300
msacm32
acmFormatEnumW
acmDriverRemove
acmDriverClose
acmDriverPriority
resutils
ResUtilGetResourceNameDependency
ResUtilIsPathValid
ResUtilGetPropertiesToParameterBlock
ResUtilSetBinaryValue
ResUtilResourcesEqual
ClusWorkerTerminate
ResUtilVerifyPropertyTable
shlwapi
ChrCmpIA
ord10
PathIsRelativeA
SHGetValueW
PathRemoveBlanksW
winspool.drv
EnumPrinterDriversA
ord208
StartDocDlgA
ord206
ord207
SetJobW
DeleteMonitorW
rtm
MgmGetFirstMfe
RtmBlockConvertRoutesToStatic
RtmDeleteRoute
RtmCloseEnumerationHandle
MgmTakeInterfaceOwnership
RtmRegisterClient
mpr
WNetConnectionDialog1A
WNetGetNetworkInformationA
user32
GetKeyboardLayoutNameW
OemKeyScan
SetClipboardData
DrawMenuBar
ShowWindow
UserHandleGrantAccess
gdi32
GetFontUnicodeRanges
comctl32
ord328
Sections
.text Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 768B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 524KB - Virtual size: 524KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 148B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ