netclient 5(new)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

netclient 5(new).exe
Size

28.2MB
MD5

cb245a82339b0795f71c66b4a3a697ac
SHA1

c0a8b4fc7b24751e137c07d89f59245eb02bc73a
SHA256

0eddf06b6a82e8d760bcbe47c214776590a17896df15d539b43d3652da1ab08d
SHA512

2fd1099a54582b44cd782aba086bb9f091a9f82acc4e236fd1a6ef04b0f4c939a525d9ef66c92b180ea15e1888ad3edaa79bc6a99df3a856495ac43131771bec
SSDEEP

786432:v/n8vq5b9kNhPmaZZ8Qx6wBWlmY7Ve/oZyTymvZtw7Xmf05Y:vsql0pJwvBQYxTyTyQtw7XF5Y

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
netclient 5(new).exe

Files

netclient 5(new).exe
.exe windows:4 windows x86 arch:x86

a7b26b4bdefb616ffb9429b95e90b590

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

d:\Drproj\NetClient5\Nc5.Agent\install\n5iclient\Release\n5iclient.pdb

Imports

comctl32

InitCommonControlsEx

ws2_32

closesocket
WSACloseEvent
ioctlsocket
WSAEnumNetworkEvents
WSAWaitForMultipleEvents
WSAEventSelect
WSACreateEvent
WSAStartup
WSACleanup
WSAGetLastError
WSASend
getsockname
inet_ntoa
WSASocketA
inet_addr
gethostbyname
WSARecv
connect
htons

kernel32

OpenEventA
GetWindowsDirectoryA
CreateDirectoryW
GetVersionExA
LoadLibraryA
GetProcAddress
FreeLibrary
FindResourceA
LoadResource
SizeofResource
LockResource
GetModuleFileNameA
CreateDirectoryA
FindFirstFileA
lstrcmpiA
FindNextFileA
FindClose
DeleteFileA
CreateFileA
WriteFile
CreateProcessA
GetLastError
WaitForSingleObject
GetExitCodeProcess
OpenProcess
TerminateProcess
CloseHandle
GetSystemDefaultLangID
Sleep
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetSystemDirectoryA
ReadFile
GetFileAttributesExA
GetCurrentProcessId
SetFilePointer
GetFileSize
CreateFileW
GetLocalTime
GetEnvironmentVariableA
GetCurrentProcess
lstrlenW
lstrlenA
HeapFree
HeapAlloc
GetProcessHeap
FindFirstFileW
FileTimeToSystemTime
GetFileTime
WaitForMultipleObjects
CreateProcessW
GetModuleHandleA
SetFileAttributesA
CopyFileA
DeleteFileW
SetFileAttributesW
CopyFileW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
SetLastError
ExpandEnvironmentStringsW
GetTickCount
GetCurrentThreadId
GetModuleFileNameW
RemoveDirectoryA
RemoveDirectoryW
FindNextFileW
GetSystemInfo
QueryDosDeviceW
GetDiskFreeSpaceA
CreatePipe
QueryDosDeviceA
GetEnvironmentVariableW
GlobalAlloc
GetModuleHandleW
GetDriveTypeW
GetWindowsDirectoryW
GetSystemDirectoryW
GetTempPathW
SetComputerNameW
GetComputerNameW
GetFileAttributesW
GetFileAttributesExW
GetVersionExW
InterlockedDecrement
GetCurrentThread
LocalFree
InitializeCriticalSection
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
FileTimeToLocalFileTime
OpenFileMappingA
UnmapViewOfFile
ReleaseMutex
SetEvent
OpenMutexA
MapViewOfFile
FreeResource
InterlockedIncrement
CreateEventA
InterlockedCompareExchange
CreateFileMappingA
InterlockedExchange
ExitProcess
RtlUnwind
RaiseException
ExitThread
CreateThread
GetConsoleCP
GetConsoleMode
GetCommandLineA
GetStartupInfoA
HeapReAlloc
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetCPInfo
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
GetStdHandle
FatalAppExitA
SetConsoleCtrlHandler
GetACP
GetOEMCP
IsValidCodePage
VirtualFree
VirtualAlloc
HeapDestroy
HeapCreate
GetFileType
SetHandleCount
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
HeapSize
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetStringTypeA
GetStringTypeW
FlushFileBuffers
GetLocaleInfoA
GetTimeFormatA
GetDateFormatA
GetUserDefaultLCID
EnumSystemLocalesA
IsValidLocale
GetLocaleInfoW
SetEndOfFile
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetTimeZoneInformation
SystemTimeToFileTime

user32

MessageBoxW
EndDialog
SetWindowLongA
GetWindowLongA
SetWindowPos
GetWindowRect
IsWindow
GetParent
CreateDialogParamA
DialogBoxParamA
CallWindowProcA
DefWindowProcA
InvalidateRect
DrawTextA
GetClientRect
EndPaint
BeginPaint
GetDlgCtrlID
GetWindow
CreateWindowExW
AdjustWindowRectEx
ClientToScreen
GetWindowLongW
SetWindowLongW
DrawTextW
GetWindowTextW
SetWindowTextW
DialogBoxParamW
LoadBitmapW
DispatchMessageW
MessageBoxA
FindWindowA
SendMessageA
wsprintfA
GetSystemMetrics
SetForegroundWindow
ExitWindowsEx
GetDlgItem
SetWindowTextA
GetMessageW
SendMessageW
RegisterClassExW
CreateDialogParamW
FindWindowW
DefWindowProcW
CallWindowProcW
MoveWindow
LoadBitmapA

gdi32

TextOutW
GetTextMetricsW
DeleteDC
StretchBlt
DeleteObject
SetBkMode
CreateFontW
GetStockObject
SelectObject
CreateCompatibleDC
GetObjectA
GetTextExtentPointA
GetTextMetricsA
SetTextColor
GetTextExtentPoint32W
GetObjectW

advapi32

IsValidSid
ConvertSidToStringSidW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
LookupPrivilegeValueW
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegDeleteKeyA
RegEnumKeyExA
RegQueryInfoKeyA
RegEnumValueA
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
RegSetValueExW
RegDeleteKeyW
RegDeleteValueW
RegEnumValueW
LogonUserW
LookupAccountSidW
DuplicateTokenEx
CreateProcessAsUserW
QueryServiceConfigA
ChangeServiceConfigA
DeleteService
QueryServiceStatus
StartServiceA
ControlService
OpenSCManagerA
OpenServiceA
CreateServiceA
CloseServiceHandle
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
EqualSid
GetTokenInformation
CreateProcessAsUserA
SetTokenInformation
RevertToSelf
OpenThreadToken
PrivilegeCheck
ImpersonateSelf

oleaut32

CreateErrorInfo
SysAllocString
SysFreeString
VariantInit
VariantClear
GetErrorInfo
VariantChangeType
SetErrorInfo

version

VerQueryValueA
GetFileVersionInfoA
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
GetFileVersionInfoSizeA

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

wininet

FtpGetFileW
FtpRemoveDirectoryW
FtpDeleteFileW
FtpPutFileW
FtpCreateDirectoryW

setupapi

SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDescriptionW

winspool.drv

EnumPrintersW
EnumPortsW

comdlg32

GetOpenFileNameW

shell32

ShellExecuteW

ole32

CoInitialize
CoUninitialize
CoInitializeEx
CoCreateInstance

Sections

.text
Size: 528KB - Virtual size: 527KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27.6MB - Virtual size: 27.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7b26b4bdefb616ffb9429b95e90b590

Headers

File Characteristics

PDB Paths

Imports

comctl32

ws2_32

kernel32

user32

gdi32

advapi32

oleaut32

version

rpcrt4

wininet

setupapi

winspool.drv

comdlg32

shell32

ole32

Sections

.text Size: 528KB - Virtual size: 527KB

.rdata Size: 96KB - Virtual size: 94KB

.data Size: 12KB - Virtual size: 22KB

.rsrc Size: 27.6MB - Virtual size: 27.6MB

.text
Size: 528KB - Virtual size: 527KB

.rdata
Size: 96KB - Virtual size: 94KB

.data
Size: 12KB - Virtual size: 22KB

.rsrc
Size: 27.6MB - Virtual size: 27.6MB