nslookup[.]exe[.]7z

Sharing

Copy URL Twitter E-mail

General

Target

nslookup.exe.7z
Size

32KB
MD5

952b0bf15d426e23c07e6b4cfe114403
SHA1

949a10dc8ec8a13fde1199e643f32aeb41fb95d0
SHA256

67530196bed8c53769ecb712aaf9982062df00ffac4bc0addeff26c39e47adf4
SHA512

20a0d7d563118d62f7f93ba1932ffb57c3c43113c85fa74f0918712ab48995055c2672775ce1bf347aa0972c655f20c58dc0f7303f58767fbfdf17a9233b3219
SSDEEP

768:w+W9p6krKQgnSctk7klQLiS54HkKIRui8JX71M:wX4Tk7klQ9CHkKI0i84

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/nslookup.exe

Files

nslookup.exe.7z
.7z

Password: infected
nslookup.exe
.exe windows x64

ec3e3c718c086fab4f7f35008a5e9116

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

msvcrt

putc
_vsnprintf
malloc
sscanf_s
system
getenv
printf
fwrite
strchr
fputc
fprintf
memset
perror
exit
strcpy_s
fputs
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
strcat_s
gmtime
__setusermatherr
isspace
getc
_cexit
realloc
_exit
putchar
__set_app_type
ferror
__getmainargs
sprintf_s
fflush
_amsg_exit
_XcptFilter
_write
fclose
memcpy
strncmp
fgets
_strnicmp
free
strncpy_s
fread
fopen
__iob_func
strcmp

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapSetInformation
GetProcessHeap

ws2_32

htonl
WSAStartup
select
getaddrinfo
gethostname
closesocket
send
socket
connect
recv
WSAGetLastError
getprotobynumber
getservbyport
ntohs
freeaddrinfo
inet_ntoa
htons

crypt32

CryptBinaryToStringA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

dnsapi

DnsQueryConfigAllocEx
DnsFreeConfigStructure

api-ms-win-core-localization-l1-2-0

FormatMessageA
SetThreadUILanguage

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA

mswsock

s_perror

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

NtQueryValueKey
RtlFreeHeap
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
NtOpenKey
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlIpv6StringToAddressExA
RtlIpv4StringToAddressA
RtlIpv6AddressToStringA
RtlInitString

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

ec3e3c718c086fab4f7f35008a5e9116

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

ws2_32

crypt32

api-ms-win-core-errorhandling-l1-1-0

dnsapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

mswsock

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 16KB - Virtual size: 21KB

.pdata Size: 4KB - Virtual size: 1KB

.didat Size: 4KB - Virtual size: 16B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 344B

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 16KB - Virtual size: 21KB

.pdata
Size: 4KB - Virtual size: 1KB

.didat
Size: 4KB - Virtual size: 16B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 344B