Static task
static1
Behavioral task
behavioral1
Sample
NCTrainer2plus.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NCTrainer2plus.exe
Resource
win10v2004-20231020-en
General
-
Target
NCTrainer2plus.exe
-
Size
674.6MB
-
MD5
9583d4a2aa50223d6fd2309667ccc28f
-
SHA1
e842865abace978dda7fa876bdb8b10993551a83
-
SHA256
70379aa037cb9685c9d12345eabadd47953bc9df006128381362fe39b39ec2cc
-
SHA512
77fd45b9e454263da538e31f45fa382e1b1d9f72aaf11ccf5d18ee924ab3598c36326a1cbc0cdfb6dd356e187283fcb7178f69e01d047e59f2633bf6314e7bff
-
SSDEEP
12582912:ZYRHS6ai8KE32NccyBuE7595m/+XX/+kcn/AtY9uKf8iP/hLWLJonHOnta/nAZv+:Z/9bMNp2995o+XP+4w32JPEwQnvjNuTF
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource NCTrainer2plus.exe
Files
-
NCTrainer2plus.exe.exe windows:5 windows x86
30b3a59d67a9bd1a163dd4b28382b982
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
comctl32
ord17
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
lz32
LZCopy
LZOpenFileW
LZClose
msi
ord88
ord141
ord169
ord8
ord137
kernel32
RaiseException
InitializeCriticalSection
DeleteCriticalSection
WriteFile
SetFilePointer
CompareStringA
LoadLibraryW
FindResourceExW
GetFileAttributesW
ReleaseMutex
FindClose
FreeLibrary
UnmapViewOfFile
CompareStringW
lstrcmpiW
CreateEventW
QueryPerformanceFrequency
MapViewOfFile
GetSystemInfo
VirtualQuery
IsBadReadPtr
CreateFileMappingW
CreateMutexW
GetDiskFreeSpaceW
lstrcatW
LoadLibraryExW
CreateDirectoryW
GetFileSize
GetPrivateProfileIntW
GetDriveTypeW
GetSystemDefaultLangID
GetUserDefaultLangID
GetSystemTimeAsFileTime
lstrcpynW
FindFirstFileW
SetErrorMode
SetFileAttributesW
FileTimeToLocalFileTime
GetFileTime
HeapFree
lstrlenA
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
ExpandEnvironmentStringsW
CopyFileW
UnhandledExceptionFilter
GetCurrentThread
lstrcmpW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
lstrcpyW
lstrlenW
Sleep
CloseHandle
CreateProcessW
SetLastError
GetLastError
MultiByteToWideChar
ResumeThread
SetThreadContext
FlushInstructionCache
WriteProcessMemory
FreeResource
lstrcmpiA
GetPrivateProfileSectionNamesA
MulDiv
GetPrivateProfileIntA
lstrcatA
GetPrivateProfileStringA
FlushFileBuffers
CreateFileA
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
SetStdHandle
InitializeCriticalSectionAndSpinCount
LoadLibraryA
GetConsoleMode
GetConsoleCP
LCMapStringA
GetStringTypeW
GetStringTypeA
GetLocaleInfoA
GetStartupInfoA
GetFileType
SetHandleCount
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetModuleHandleA
HeapCreate
VerLanguageNameW
GetExitCodeProcess
CreateThread
ReadFile
GetCommandLineW
lstrcpyA
ExitThread
GetTickCount
WideCharToMultiByte
GetLocaleInfoW
IsValidLocale
GetTempPathW
GetVersionExW
CreateFileW
InterlockedIncrement
GetWindowsDirectoryW
InterlockedDecrement
LocalFree
FormatMessageW
GlobalFree
GlobalLock
GlobalUnlock
FindResourceW
LoadResource
SizeofResource
GlobalAlloc
LockResource
GetSystemDirectoryW
SetCurrentDirectoryW
WaitForSingleObject
DeleteFileW
RemoveDirectoryW
ExitProcess
GetCurrentProcess
DuplicateHandle
TerminateProcess
MoveFileExW
GetThreadContext
VirtualProtectEx
HeapReAlloc
VirtualAlloc
VirtualFree
GetModuleFileNameA
GetStdHandle
HeapSize
LCMapStringW
GetCurrentThreadId
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
IsValidCodePage
GetOEMCP
FindNextFileW
lstrcmpA
SearchPathW
VirtualProtect
SystemTimeToFileTime
QueryPerformanceCounter
SetEvent
ResetEvent
GetCurrentProcessId
GetVersion
GetACP
GetCPInfo
GetStartupInfoW
RtlUnwind
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
GetProcessTimes
OpenProcess
SetFileTime
GetTimeFormatW
GetDateFormatW
GetTempFileNameW
GetLocalTime
CompareFileTime
SetUnhandledExceptionFilter
user32
DialogBoxIndirectParamW
WaitForInputIdle
wsprintfW
MessageBoxW
SetActiveWindow
SetForegroundWindow
SetWindowLongW
InflateRect
GetMessageW
DefWindowProcW
LoadStringW
FillRect
GetSysColor
GetPropW
EnableMenuItem
SetPropW
RemovePropW
SetFocus
EndPaint
BeginPaint
GetWindow
SystemParametersInfoW
GetSystemMetrics
MapWindowPoints
LoadImageW
CreateDialogParamW
GetDC
ReleaseDC
GetParent
GetWindowTextW
CharNextW
GetDesktopWindow
GetClientRect
IsWindowEnabled
IsWindowVisible
CreateDialogIndirectParamW
PostMessageW
ShowWindow
EnableWindow
ScreenToClient
SetWindowPos
FindWindowExW
IsDialogMessageW
MsgWaitForMultipleObjects
ExitWindowsEx
SetWindowTextW
CallWindowProcW
DrawFocusRect
CharUpperW
DrawTextW
GetWindowDC
CopyRect
GetClassNameW
CreateWindowExW
wsprintfA
EnumChildWindows
UpdateWindow
InvalidateRect
DrawIcon
MapDialogRect
IntersectRect
RegisterClassExW
GetDlgItemTextW
TranslateMessage
DispatchMessageW
PeekMessageW
IsWindow
DestroyWindow
SendDlgItemMessageW
GetWindowLongW
SetDlgItemTextW
GetWindowRect
MoveWindow
EndDialog
LoadIconW
GetDlgItem
SendMessageW
gdi32
DeleteMetaFile
CreateDCW
GetStockObject
CreateCompatibleBitmap
CreatePatternBrush
GetTextExtentPoint32W
CreateDIBitmap
SetMetaFileBitsEx
SetStretchBltMode
CreateRectRgn
SetPixel
PatBlt
PlayMetaFile
StretchBlt
CreateBitmap
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
SetWindowOrgEx
SetMapMode
SelectClipRgn
SetBkColor
SetBkMode
SetTextColor
TextOutW
CreateSolidBrush
RestoreDC
SaveDC
GetDeviceCaps
GetDIBColorTable
GetSystemPaletteEntries
CreatePalette
CreateHalftonePalette
CreateCompatibleDC
UnrealizeObject
SelectPalette
RealizePalette
SelectObject
BitBlt
DeleteDC
DeleteObject
GetObjectW
CreateFontIndirectW
TranslateCharsetInfo
advapi32
RegCloseKey
RegEnumValueW
OpenThreadToken
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegEnumKeyW
RegOpenKeyW
OpenProcessToken
LookupPrivilegeValueW
AdjustTokenPrivileges
RegCreateKeyExW
RegOpenKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegQueryInfoKeyW
RegEnumKeyExW
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
SetSecurityDescriptorOwner
InitializeSecurityDescriptor
RegQueryValueExW
shell32
SHGetMalloc
ShellExecuteExW
SHGetPathFromIDListW
SHGetSpecialFolderLocation
ole32
CoInitializeEx
CoUninitialize
CoTaskMemAlloc
CoTaskMemRealloc
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
oleaut32
VariantClear
VariantInit
VarBstrCat
GetErrorInfo
SysAllocStringByteLen
SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen
SysStringByteLen
VarUI4FromStr
VariantChangeType
SysReAllocStringLen
VarBstrCmp
rpcrt4
UuidCreate
UuidToStringW
RpcStringFreeW
Sections
.text Size: 412KB - Virtual size: 411KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 9KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 290KB - Virtual size: 290KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ