ExitProtect
StartProtect
Static task
static1
Behavioral task
behavioral1
Sample
NBClose/NBClose.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
NBClose/NBClose.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
NBClose/Network.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
NBClose/Network.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
NBClose/Protect.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
NBClose/Protect.dll
Resource
win10v2004-20231215-en
Target
53f5064e1d0492836f12e8f7ff6bc2a0
Size
173KB
MD5
53f5064e1d0492836f12e8f7ff6bc2a0
SHA1
77491837e7c6c0cfdd673bab13ad381429cc8b93
SHA256
6b35905fbc68b7737838fd999262d4044ec9cfb66f9179787109a9bf0ce4055d
SHA512
74987814995a53ce4d21d37fadb80ee2a1c423c82c789e8431d2473b073348a960f0e978a01402eb6d9f5cd94a09b0d332108198ee1f9df6f0a41127e64cc99e
SSDEEP
3072:O9ReqDZ6HMyg81+rsUlyippvzkyn9itMEeH3IIHR84uQpRygFcu5bjnvkPd2jAcU:ObrDMHyLP3k6IyHYb4uQKgFn5PkPdmrU
Checks for missing Authenticode signature.
resource |
---|
unpack001/NBClose/NBClose.exe |
unpack001/NBClose/Network.run |
unpack001/NBClose/Protect.run |
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
WriteProcessMemory
GetModuleHandleA
GetCurrentProcessId
GetCurrentProcess
LoadLibraryA
GetProcAddress
FreeLibrary
RtlUnwind
GetCommandLineA
GetVersion
HeapAlloc
HeapFree
GetCurrentThreadId
TlsSetValue
TlsAlloc
TlsFree
SetLastError
TlsGetValue
GetLastError
ExitProcess
TerminateProcess
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
WriteFile
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetUnhandledExceptionFilter
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
SetWindowsHookExA
CallNextHookEx
UnhookWindowsHookEx
ExitProtect
StartProtect
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ