nbtscan[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

nbtscan.exe
Size

32KB
MD5

150166b91d13d6f532b859d3e983a303
SHA1

92f2a14fbb218a0aa1eaf237bff45c25e991fa0a
SHA256

844f60c8c7f1cf71083ec1e218e3c8f9eade19b0d043870a3d0e56bbc1e3b333
SHA512

41319120f3e6e5c2cda2a7a31841c9a9610d8c44f8e0ad6fc4ff516f67d1d9c7a9e45dbb1dec6444c232c8bc45694af314f74f2daed1fab1d7c10662146fcebd
SSDEEP

768:/zIbhIqlVqhcd7YfyabsQqIw+c1515LPlTd:8BuhYgtbsQqIw+c1tLd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nbtscan.exe

Files

nbtscan.exe
.exe windows:4 windows x86 arch:x86

a855a71dc3e1e4637280da4dfa76c634

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

DeleteCriticalSection
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetStartupInfoA
GetSystemTimeAsFileTime
GetTickCount
GetTimeZoneInformation
InitializeCriticalSection
LeaveCriticalSection
QueryPerformanceCounter
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery

msvcrt

__getmainargs
__initenv
__lconv_init
__p___argv
__p__acmdln
__p__fmode
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_initterm
_iob
_onexit
_strdup
_vsnprintf
abort
atoi
calloc
exit
feof
fgets
fopen
fprintf
fputc
free
fwrite
getenv
malloc
memcpy
perror
printf
putchar
puts
signal
strchr
strcmp
strcpy
strlen
strncmp
strncpy
strstr
toupper
vfprintf

ws2_32

WSACleanup
WSAStartup
__WSAFDIsSet
bind
htonl
htons
inet_addr
inet_ntoa
ntohl
ntohs
recvfrom
select
sendto
socket

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 1008B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 52B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

a855a71dc3e1e4637280da4dfa76c634

Headers

File Characteristics

Imports

kernel32

msvcrt

ws2_32

Sections

.text Size: 19KB - Virtual size: 19KB

.data Size: 1KB - Virtual size: 1KB

.rdata Size: 7KB - Virtual size: 6KB

.bss Size: - Virtual size: 1008B

.idata Size: 2KB - Virtual size: 2KB

.CRT Size: 512B - Virtual size: 52B

.tls Size: 512B - Virtual size: 8B

.text
Size: 19KB - Virtual size: 19KB

.data
Size: 1KB - Virtual size: 1KB

.rdata
Size: 7KB - Virtual size: 6KB

.bss
Size: - Virtual size: 1008B

.idata
Size: 2KB - Virtual size: 2KB

.CRT
Size: 512B - Virtual size: 52B

.tls
Size: 512B - Virtual size: 8B