Static task
static1
Behavioral task
behavioral1
Sample
nc.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
nc.exe
Resource
win10v2004-20230831-en
General
-
Target
nc.exe
-
Size
48KB
-
MD5
94a1c655ba93be5a0205af99ac513f4e
-
SHA1
9dd8a70767250499c3b28e7bd6e2325aff9e1653
-
SHA256
267be68ada6d2a810e83f25011e377a0c5ec9fc49876ec39f1c75ccb4ea6d7f7
-
SHA512
baa55a6301fb38666220249981fabd5f7dd751452f5c9d7764d7a8c697a80f569770e28a3a0563304b55580d99b09c31c1a3208579a5c5dc26f2b90132a4fbb9
-
SSDEEP
768:CkFJBMErZ9x02PrMndDIyuBMXY+miuLZEZUZUZtlI6VAQvRi3lMC:CeBqIeu2XbmVSZUZU3ukAQvMMC
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nc.exe
Files
-
nc.exe.exe windows x86
b255786832d9ad08fc793fc3fa89494e
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
AddAtomA
ExitProcess
FindAtomA
FreeConsole
GetAtomNameA
GetStdHandle
SetUnhandledExceptionFilter
msvcrt
_close
_dup
_kbhit
_open
_read
_strcmpi
_write
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_errno
_iob
_isatty
_onexit
_setjmp
_setmode
_sleep
abort
atexit
atoi
exit
fflush
fprintf
free
getenv
gets
longjmp
malloc
memcmp
memcpy
memset
rand
signal
sprintf
srand
strcat
strchr
strcmp
strcpy
strlen
strncmp
strncpy
time
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
__WSAFDIsSet
accept
bind
closesocket
connect
gethostbyaddr
gethostbyname
getservbyname
getservbyport
getsockname
htons
inet_addr
inet_ntoa
listen
ntohs
recv
recvfrom
select
send
setsockopt
shutdown
socket
Sections
.text Size: 17KB - Virtual size: 16KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 120B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.bss Size: - Virtual size: 528B
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE