nfs[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nfs.exe
Size

12.1MB
MD5

90427e08e4bb62c77445b47256fb8eb5
SHA1

37e35df337bbe2ca16a10eef48bacc552b0d4e88
SHA256

4ce76187579866f8833a42db87b283def52aeee2e6edd2ef4c24ad831876a67a
SHA512

0a54c6897c437a816495fa0198160014a3d2df812afc9866acbfe6a90c36f0f1cb0dc4560ee2014e6397b607b4faae9b8c8153eb2d1ae2c713c686d91cc6ec5b
SSDEEP

393216:CSoxJCVR5c/nTdvRCR8zTALx8fchx+lSK:h9RzF8D

Score

1^/10

Malware Config

Signatures

Files

nfs.exe
.exe windows:4 windows x86 arch:x86

84570b9b0b3a5aeb41673c6e028e29b7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Not Before

15/06/2007, 00:00

Not After

14/06/2012, 23:59

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

04/12/2003, 00:00

Not After

03/12/2013, 23:59

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Not Before

16/07/2004, 00:00

Not After

15/07/2014, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

71:4e:ce:03:10:80:c3:24:06:ec:f0:1d:69:8f:fe:1d
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Not Before

14/09/2006, 00:00

Not After

04/10/2008, 23:59

Subject

CN=Electronic Arts,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Synthetic,O=Electronic Arts,L=Redwood City,ST=Ca,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

aa:bb:cf:e2:5f:01:33:23:2b:29:94:bd:8f:b1:eb:a7:ac:f8:5f:93
Signer

Actual PE Digest

aa:bb:cf:e2:5f:01:33:23:2b:29:94:bd:8f:b1:eb:a7:ac:f8:5f:93

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MultiByteToWideChar
SuspendThread
ResumeThread
GetVersionExA
GetLongPathNameA
GetDriveTypeA
GetLogicalDrives
FindClose
FindNextFileA
FindFirstFileA
FreeLibrary
CreateDirectoryA
GetModuleHandleA
GetSystemInfo
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
SetErrorMode
GetTickCount
CreateWaitableTimerA
GetSystemTime
SystemTimeToFileTime
SetWaitableTimer
GetDiskFreeSpaceExA
SetThreadPriority
GetSystemTimeAsFileTime
GetCurrentProcessId
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
InterlockedCompareExchange
GetProcAddress
GetSystemDirectoryA
CreateThread
LeaveCriticalSection
TryEnterCriticalSection
WaitForSingleObject
CreateEventA
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
DuplicateHandle
GetCurrentThread
TerminateThread
SleepEx
GetThreadPriority
GetExitCodeThread
WriteFile
SetFilePointer
DeleteFileA
MoveFileA
ReadFile
GetFileSize
CreateFileA
ResetEvent
GetCurrentDirectoryA
LoadLibraryA
OutputDebugStringA
CloseHandle
GetCurrentThreadId
PulseEvent
GetPriorityClass
SetPriorityClass
RemoveDirectoryW
CreateDirectoryW
FindNextFileW
FindFirstFileW
WideCharToMultiByte
MoveFileW
DeleteFileW
SetEndOfFile
CreateFileW
QueryPerformanceCounter
GetLastError
QueryPerformanceFrequency
IsDebuggerPresent
IsBadReadPtr
InterlockedExchange
GetFileSizeEx
SetFilePointerEx
RaiseException
ReleaseSemaphore
InterlockedDecrement
CreateSemaphoreA
InterlockedExchangeAdd
SetThreadIdealProcessor
TlsGetValue
TlsSetValue
TlsAlloc
ReleaseMutex
CreateMutexA
VirtualProtect
GetLocalTime
GetVolumeInformationA
MapViewOfFile
OpenMutexA
QueryDosDeviceA
SetCurrentDirectoryA
UnmapViewOfFile
VirtualAlloc
VirtualFree
lstrlenA
lstrcmpiA
lstrcmpA
GetComputerNameA
FormatMessageA
FileTimeToSystemTime
lstrlenW
OpenProcess
FlushInstructionCache
IsBadWritePtr
ExitProcess
CreateProcessA
GetStartupInfoA
GetCommandLineA
GetTempPathA
GetShortPathNameA
GetProcessHeap
HeapFree
HeapAlloc
WaitNamedPipeA
SetNamedPipeHandleState
GetFileTime
SetFileAttributesA
CopyFileA
DeviceIoControl
CreateFileMappingA
SetLastError
VirtualQuery
GetModuleFileNameA
GetFileAttributesA
OpenEventA
ReadConsoleInputA
SetConsoleMode
GetConsoleMode
FileTimeToLocalFileTime
GetFullPathNameA
GetLocaleInfoA
GetWindowsDirectoryA
GetExitCodeProcess
GetACP
GetVersion
CompareStringA
CompareStringW
GetEnvironmentVariableA
LocalFree
LocalAlloc
SetThreadAffinityMask
GetProcessAffinityMask
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
GetUserDefaultLangID
LockResource
LoadResource
FindResourceA
RtlUnwind
HeapDestroy
HeapCreate
HeapReAlloc
TlsFree
HeapSize
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
LCMapStringA
LCMapStringW
GetOEMCP
GetCPInfo
IsBadCodePtr
GetStringTypeA
GetStringTypeW
SetStdHandle
FlushFileBuffers
SetConsoleCtrlHandler
GetTimeZoneInformation
SetEnvironmentVariableA
FlushConsoleInputBuffer
WaitForMultipleObjects
GlobalAlloc
GlobalLock
LocalLock
GlobalUnlock
GlobalFree
LocalUnlock
CompareFileTime
GlobalMemoryStatus

d3d9

Direct3DCreate9

d3dx9_34

D3DXCreateEffectFromResourceA
D3DXMatrixMultiplyTranspose
D3DXCreateEffectPool
D3DXSaveSurfaceToFileA
D3DXGetVertexShaderProfile
D3DXGetPixelShaderProfile
D3DXVec3Transform
D3DXVec4Transform
D3DXMatrixMultiply
D3DXCreateCubeTextureFromFileInMemory
D3DXCreateVolumeTextureFromFileInMemory
D3DXSaveSurfaceToFileInMemory
D3DXMatrixTranspose
D3DXMatrixInverse

dinput8

DirectInput8Create

user32

DispatchMessageA
TranslateMessage
GetMessageA
ShowCursor
PeekMessageA
GetClientRect
SetWindowLongA
SendInput
DestroyWindow
ReleaseCapture
SetCapture
EndPaint
SystemParametersInfoA
EnumDisplaySettingsA
MapVirtualKeyA
ToUnicode
PostQuitMessage
IsIconic
GetForegroundWindow
BeginPaint
MessageBoxA
wvsprintfA
GetCursorPos
LoadIconA
LoadCursorA
RegisterClassExA
AdjustWindowRect
CreateWindowExA
UpdateWindow
SetCursor
SetFocus
SetForegroundWindow
GetWindowRect
ShowWindow
GetWindowLongA
DefWindowProcA
PostMessageA
GetKeyState
MapVirtualKeyExA
GetKeyboardLayout
GetDesktopWindow
LoadCursorFromFileA
SetSystemCursor
LoadImageA
CopyImage
GetProcessWindowStation
GetUserObjectInformationW
DialogBoxIndirectParamA
SetDlgItemTextW
SetDlgItemTextA
SetWindowTextW
EnableWindow
SetWindowPos
FlashWindow
SetWindowTextA
UnregisterClassA
LoadStringA
CheckMenuItem
EnableMenuItem
FindWindowA
CharLowerBuffA
wsprintfA
FindWindowExA
GetMenu
GetMenuState
GetSubMenu
GetSysColorBrush
GetSysColor
SendDlgItemMessageA
GetDlgItem
EndDialog
CharLowerA
GetSystemMetrics
GetWindowTextA
GetParent
GetClassNameA
GetCursor
GetWindowThreadProcessId
EnumWindows
SendMessageA

advapi32

CheckTokenMembership
FreeSid
RegCreateKeyA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA
AllocateAndInitializeSid
OpenServiceA
QueryServiceStatus
OpenSCManagerA
DeleteService
ControlService
StartServiceA
CreateServiceA
RegQueryValueA
RegSetValueA
EqualSid
RegDeleteValueA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidIdentifierAuthority
GetTokenInformation
OpenProcessToken
OpenThreadToken
DeregisterEventSource
ReportEventA
RegisterEventSourceA
RevertToSelf
CloseServiceHandle
IsValidSid
GetUserNameA
RegQueryInfoKeyA
RegOpenKeyA
RegEnumValueA
RegEnumKeyExA
RegDeleteKeyA
RegCreateKeyExA

shfolder

SHGetFolderPathA

ws2_32

inet_addr
htons
WSACleanup
WSAStartup
htonl
WSACreateEvent
shutdown
WSACloseEvent
WSASetEvent
WSARecv
WSARecvFrom
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetOverlappedResult
bind
accept
sendto
recvfrom
getpeername
getsockname
gethostname
WSAIoctl
ntohs
ntohl
WSAGetLastError
gethostbyname
inet_ntoa
getservbyname
gethostbyaddr
getservbyport
closesocket
select
send
recv
connect
getsockopt
setsockopt
ioctlsocket
socket

rpcrt4

RpcStringFreeA
UuidToStringA

ole32

CoCreateGuid

msvcr80

_endthreadex
_beginthreadex
bsearch
_vsnwprintf
getenv
_findclose
_findnext64i32
memmove_s
_invalid_parameter_noinfo
memmove
??1exception@std@@UAE@XZ
??0exception@std@@QAE@XZ
??0exception@std@@QAE@ABV01@@Z
_purecall
printf
_findfirst64i32
malloc
atoi
strrchr
isspace
strstr
strncat
strchr
atof
strncpy
sscanf
sprintf
qsort
ceil
vsprintf
_isnan
exit
_exit
_stricmp
rand
_CIsqrt
__CxxFrameHandler3
memset
memcpy
_CIfmod
_CIpow
_CIsin
tolower
_CxxThrowException
_CIacos
_CIatan2
_CIcos
__iob_func
strncmp
fclose
fopen
_CIexp
floor
_CIasin
longjmp
_setjmp3
strcspn
strcoll
fprintf
_mktime64
isprint
_CIlog
fwrite
_getcwd
__RTDynamicCast
toupper
fseek
_chmod
rename
remove
_ftime64
_time64
strtok
_strnicmp
_mkdir
_ltoa
strlen
memcmp
_snprintf
_vsnprintf
cos
sqrt
fflush
srand
strcpy
calloc
strcmp
strtoul
strcat
raise
realloc
abs
clock
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
?terminate@@YAXXZ
_amsg_exit
__getmainargs
_cexit
_XcptFilter
__initenv
_initterm
_initterm_e
_configthreadlocale
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_localtime32
_crt_debugger_hook
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_except_handler4_common
_invoke_watson
_controlfp_s
_difftime64
strpbrk
asctime
_mkgmtime64
_gmtime64
_localtime64
_getdiskfree
_getdrive
_fullpath
_close
_write
?_open@@YAHPBDHH@Z
_lseek
_read
_filelength
_rmdir
isdigit
_CIlog10
_CItan
ldexp
_except_handler3
_aligned_malloc
_aligned_free
_control87
strtol
_CItanh
_CIsinh
_CIcosh
free
_CIatan

msvcp80

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z

dsound

ord1

winmm

timeBeginPeriod
timeGetTime
timeEndPeriod

netapi32

Netbios

shell32

ShellExecuteExA
ShellExecuteA

version

VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA

wsock32

shutdown
WSASetLastError
send
WSAGetLastError
recv
closesocket

Exports

Exports

PB_SendUdpPacket

Sections

.text
Size: 5.2MB - Virtual size: 5.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 872KB - Virtual size: 871KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 376KB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 4KB - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 868KB - Virtual size: 865KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

ars
Size: 3.0MB - Virtual size: 5.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

est
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

artem
Size: 876KB - Virtual size: 2.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

celare
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.securom
Size: 992KB - Virtual size: 988KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

84570b9b0b3a5aeb41673c6e028e29b7

Code Sign

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5Certificate

Extended Key Usages

Key Usages

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4Certificate

Extended Key Usages

Key Usages

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2Certificate

Extended Key Usages

Key Usages

71:4e:ce:03:10:80:c3:24:06:ec:f0:1d:69:8f:fe:1dCertificate

Extended Key Usages

Key Usages

aa:bb:cf:e2:5f:01:33:23:2b:29:94:bd:8f:b1:eb:a7:ac:f8:5f:93Signer

Headers

File Characteristics

Imports

kernel32

d3d9

d3dx9_34

dinput8

user32

advapi32

shfolder

ws2_32

rpcrt4

ole32

msvcr80

msvcp80

dsound

winmm

netapi32

shell32

version

wsock32

Exports

Exports

Sections

.text Size: 5.2MB - Virtual size: 5.2MB

.rdata Size: 872KB - Virtual size: 871KB

.data Size: 376KB - Virtual size: 5.7MB

.tls Size: 4KB - Virtual size: 9B

.rsrc Size: 868KB - Virtual size: 865KB

ars Size: 3.0MB - Virtual size: 5.6MB

est Size: 28KB - Virtual size: 27KB

artem Size: 876KB - Virtual size: 2.9MB

celare Size: 24KB - Virtual size: 20KB

.securom Size: 992KB - Virtual size: 988KB

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5
Certificate

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Certificate

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2
Certificate

71:4e:ce:03:10:80:c3:24:06:ec:f0:1d:69:8f:fe:1d
Certificate

aa:bb:cf:e2:5f:01:33:23:2b:29:94:bd:8f:b1:eb:a7:ac:f8:5f:93
Signer

.text
Size: 5.2MB - Virtual size: 5.2MB

.rdata
Size: 872KB - Virtual size: 871KB

.data
Size: 376KB - Virtual size: 5.7MB

.tls
Size: 4KB - Virtual size: 9B

.rsrc
Size: 868KB - Virtual size: 865KB

ars
Size: 3.0MB - Virtual size: 5.6MB

est
Size: 28KB - Virtual size: 27KB

artem
Size: 876KB - Virtual size: 2.9MB

celare
Size: 24KB - Virtual size: 20KB

.securom
Size: 992KB - Virtual size: 988KB