nshi[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nshi.exe
Size

1.9MB
MD5

1fb84d8818b4f119e6377ebf88d86763
SHA1

c7f84de2111c98a7d90024385078beb75ed3c4b7
SHA256

af8e664ca86f97ad999e47c744eada29bc9ac72aebdbb4008dfa85c93d90793e
SHA512

ef0a97d27c6b065b77bbd7114126f3c2eab7d23b5f09757c928a9dfbe2bc702b5967e7c011e4e9fe0e9a94d53955da55b2d3584291fd71b2ad67ff2d7e31afb2
SSDEEP

49152:NVmleVvo22xCzAeYGkgr1WEUb2an1cjIU6idF:CYeteQ2i+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nshi.exe

Files

nshi.exe
.exe windows x64

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer
LsaEnumerateLogonSessions

kernel32

FindClose
SetThreadErrorMode
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
CompareStringOrdinal
GetProcessId
GetComputerNameExW
GetCurrentProcessId
CreateFileW
LocalAlloc
OpenProcess
SetCurrentDirectoryW
MoveFileExW
Sleep
VirtualAllocEx
WriteProcessMemory
VirtualProtectEx
CreateRemoteThreadEx
RemoveDirectoryW
DeleteFileW
CopyFileExW
LoadLibraryExW
FreeLibrary
GetProcAddress
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
WakeAllConditionVariable
GetDriveTypeW
GetVolumeInformationW
GetDiskFreeSpaceExW
DeviceIoControl
ReadProcessMemory
GetProcessTimes
GetSystemTimes
GetProcessIoCounters
LocalFree
VirtualQueryEx
GetSystemInfo
SetLastError
GetFinalPathNameByHandleW
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
ConnectNamedPipe
ReadFile
WriteFile
CancelIoEx
CreateNamedPipeW
GetModuleHandleA
ReleaseSRWLockExclusive
WakeConditionVariable
GetCurrentThread
TryAcquireSRWLockExclusive
GetStdHandle
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
GetCurrentProcess
ReleaseMutex
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
RtlCaptureContext
RtlLookupFunctionEntry
GetEnvironmentVariableW
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
SetFilePointerEx
FindNextFileW
CreateDirectoryW
SetHandleInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
CreateThread
WriteFileEx
CreateEventW
CancelIo
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
CreateIoCompletionPort
RtlVirtualUnwind
GetCurrentThreadId
GetConsoleOutputCP
FlushFileBuffers
HeapSize
LCMapStringW
CompareStringW
SetUnhandledExceptionFilter
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
FindFirstFileW
SwitchToThread
GetExitCodeProcess
WaitForSingleObject
GetOverlappedResult
WaitForMultipleObjects
GetLastError
ReadFileEx
SleepEx
CloseHandle
InitializeSListHead
IsDebuggerPresent
SleepConditionVariableSRW
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
RtlUnwindEx
GetStringTypeW
RtlPcToFileHeader
RaiseException
GetFileType
SetStdHandle
SetEnvironmentVariableW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
IsValidCodePage
FindFirstFileExW
GetCommandLineW
GetCommandLineA
GetModuleHandleExW
TlsFree
UnhandledExceptionFilter

ntdll

NtReadFile
NtQuerySystemInformation
NtQueryInformationProcess
RtlGetVersion
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile

iphlpapi

GetExtendedUdpTable
FreeMibTable
GetIfTable2
GetExtendedTcpTable

advapi32

FreeSid
SetEntriesInAclW
LookupAccountSidW
GetTokenInformation
OpenProcessToken
SystemFunction036
RegQueryValueExW
RegOpenKeyExW
SetSecurityDescriptorDacl
AllocateAndInitializeSid
InitializeSecurityDescriptor
GetUserNameW

netapi32

NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

ole32

CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
VariantClear

pdh

PdhOpenQueryA
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExA
GetModuleFileNameExW
GetPerformanceInfo

shell32

CommandLineToArgvW

ws2_32

WSAGetLastError
closesocket
connect
getsockname
setsockopt
ioctlsocket
send
WSASend
recv
WSASocketW
WSACleanup
WSAStartup
getaddrinfo
freeaddrinfo
getsockopt
select
bind

d3d11

D3D11CreateDevice

bcrypt

BCryptGenRandom

dxgi

CreateDXGIFactory1

Sections

.text
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 635KB - Virtual size: 634KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db175ec37423d0c156447bf27ff67726

Headers

DLL Characteristics

File Characteristics

Imports

secur32

kernel32

ntdll

iphlpapi

advapi32

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

ws2_32

d3d11

bcrypt

dxgi

Sections

.text Size: 1.2MB - Virtual size: 1.2MB

.rdata Size: 635KB - Virtual size: 634KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 9KB - Virtual size: 8KB

.text
Size: 1.2MB - Virtual size: 1.2MB

.rdata
Size: 635KB - Virtual size: 634KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 9KB - Virtual size: 8KB