nircmd[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

nircmd.exe
Size

114KB
MD5

b417238213efb0d2a23562674406cdf9
SHA1

04bf7acc7d0aa74fa750f7c32fdebbbe1daf46f8
SHA256

5bfa034f7555a38e64c078af71b4ff8c49511579fa826a87661940b7e9a6e333
SHA512

881b420af6e7104ac1f2edf03fc905f30af8ee264d8279f7eeb18e6178e210e063ac3c3d9a47f0c7c36ad04b51773e28595f965b037b0a0305d6c9fdf18e96a3
SSDEEP

3072:0l9AT3LpPBrPsvtoAeDmdGX5a7Y8G4ZXGUt+HdkzQFoHCfsDyR1q6:hT3ZVk6AwPRU6

Score

10^/10

Malware Config

Signatures

Nirsoft 1 IoCs

resource	yara_rule
sample	Nirsoft

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nircmd.exe

Files

nircmd.exe
.exe windows:4 windows x64

8c9a5302768cd0bfae05fbfdc7992ea3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

winmm

mixerOpen
mciSendStringA
mixerGetControlDetailsA
mixerClose
mixerGetLineControlsA
mixerSetControlDetails
waveOutGetVolume
mixerGetLineInfoA
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutSetVolume

msvcrt

_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
__setusermatherr
_strlwr
atof
printf
_mbsicmp
_snprintf
_strnicmp
strcpy
_memicmp
memcmp
strrchr
wcslen
_commode
_fmode
__set_app_type
_itoa
strtol
atoi
_stricmp
strcmp
strtoul
strchr
malloc
wcscpy
free
wcscmp
wcsrchr
_wcsicmp
strlen
memcpy
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
_strcmpi
sprintf
strcat

kernel32

DeleteFileA
WinExec
LocalFileTimeToFileTime
GetStdHandle
CreateProcessA
SetComputerNameA
GetEnvironmentVariableA
DeviceIoControl
WritePrivateProfileStringA
GetCurrentProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentThreadId
GetStartupInfoA
Beep
SetProcessAffinityMask
GetSystemTime
ReadProcessMemory
SetConsoleTextAttribute
GetSystemDirectoryA
WaitForSingleObject
SetPriorityClass
OutputDebugStringA
Sleep
OpenProcess
GetModuleHandleA
FindNextFileA
GetTimeFormatA
GetWindowsDirectoryA
CopyFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
SystemTimeToFileTime
MultiByteToWideChar
LoadLibraryExA
FormatMessageA
SetFileTime
GetDateFormatA
CreateDirectoryA
GetFileTime
WriteFile
FindFirstFileA
GetLastError
GetVersionExA
CreateFileA
GetFileSize
SetFileAttributesA
WideCharToMultiByte
FindClose
SetFilePointer
LocalFree
GetFileAttributesA
ReadFile
GetModuleFileNameA

user32

DispatchMessageA
TranslateMessage
TrackPopupMenu
IsWindowEnabled
GetMessageA
FindWindowA
GetWindowTextA
ShowWindow
KillTimer
GetParent
SendInput
AttachThreadInput
PostQuitMessage
GetForegroundWindow
SystemParametersInfoA
SendMessageTimeoutA
GetActiveWindow
GetSystemMetrics
IsWindowVisible
SetWindowPos
DestroyIcon
SetTimer
PostMessageA
InvalidateRect
ExitWindowsEx
SetCursorPos
GetWindowThreadProcessId
MessageBeep
SetDlgItemTextA
GetSysColorBrush
ChildWindowFromPoint
DialogBoxParamA
LoadCursorA
SetCursor
EndDialog
SendMessageA
GetDlgItem
SetWindowTextA
MessageBoxA
CreateWindowExA
GetWindowTextLengthA
GetDlgItemTextA
RegisterClipboardFormatA
SetClipboardData
CloseClipboard
OpenClipboard
GetClipboardFormatNameA
EmptyClipboard
SetWindowLongA
GetWindowLongA
ReleaseDC
GetDC
GetCursorPos
GetWindowRect
MoveWindow
SetFocus
GetClassNameA
SetWindowPlacement
GetClipboardData
SetForegroundWindow
EnableWindow
MapWindowPoints
GetWindowPlacement
GetDesktopWindow
EnumDisplayMonitors
EnumDisplayDevicesA
GetMonitorInfoA
EnumWindows
EnumDisplaySettingsA
EnumChildWindows
RegisterClassA
ChangeDisplaySettingsA
DefWindowProcA

gdi32

BitBlt
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
SelectObject
CreateDIBitmap
GetObjectA
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject

advapi32

RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegDeleteKeyA
RegCloseKey

shell32

ExtractIconExA
SHFileOperationA
ShellExecuteExA
SHChangeNotify
ShellExecuteA
Shell_NotifyIconA

ole32

OleGetClipboard
ReleaseStgMedium
CoInitialize
CoCreateInstance
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear

Sections

.text
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8c9a5302768cd0bfae05fbfdc7992ea3

Headers

DLL Characteristics

File Characteristics

Imports

winmm

msvcrt

kernel32

user32

gdi32

advapi32

shell32

ole32

Sections

.text Size: 83KB - Virtual size: 82KB

.rdata Size: 23KB - Virtual size: 23KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 3KB - Virtual size: 2KB

.text
Size: 83KB - Virtual size: 82KB

.rdata
Size: 23KB - Virtual size: 23KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 3KB - Virtual size: 2KB