c:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb
Static task
static1
1 signatures
General
-
Target
nircmd.exe
-
Size
117KB
-
MD5
4a9da765fd91e80decfd2c9fe221e842
-
SHA1
6f763fbd2b37b2ce76a8e874b05a8075f48d1171
-
SHA256
2e81e048ab419fdc6e5f4336a951bd282ed6b740048dc38d7673678ee3490cda
-
SHA512
4716e598e4b930a0ec89f4d826afaa3dade22cf002111340bc253a618231e88f2f5247f918f993ed15b8ce0e3a97d6838c12b17616913e48334ee9b713c1957a
-
SSDEEP
3072:oG0tOQJC9TPafQy26RAA3hh5Tgr559MJZpOSDUDyjHHKHlLz1Ms/b:2OQJC9uICA11l1MYb
Score
3/10
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nircmd.exe
Files
-
nircmd.exe.exe windows:4 windows x64 arch:x64
633684595a5911dabe231a798d532fcd
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
winmm
mixerClose
mixerOpen
mciSendStringA
mixerGetLineInfoA
mixerGetControlDetailsA
mixerGetLineControlsA
mixerSetControlDetails
waveOutGetVolume
waveOutGetNumDevs
waveOutGetDevCapsA
waveOutSetVolume
msvcrt
_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
__setusermatherr
_strlwr
atof
puts
_mbsicmp
_snprintf
_strnicmp
strtol
atoi
_stricmp
strcmp
_commode
_fmode
__set_app_type
_itoa
strtoul
strchr
strcpy
_memicmp
memcmp
strrchr
wcslen
malloc
wcscpy
free
wcscmp
wcsrchr
_wcsicmp
memcpy
strlen
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
_strcmpi
sprintf
strcat
kernel32
DeleteFileA
WinExec
LocalFileTimeToFileTime
GetStdHandle
CreateProcessA
SetComputerNameA
GetEnvironmentVariableA
DeviceIoControl
WritePrivateProfileStringA
GetCurrentProcess
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
GetCurrentThreadId
GetStartupInfoA
Beep
GetSystemTime
SetProcessAffinityMask
ReadProcessMemory
SetConsoleTextAttribute
GetSystemDirectoryA
OutputDebugStringA
WaitForSingleObject
SetPriorityClass
Sleep
OpenProcess
LocalFree
GetWindowsDirectoryA
CopyFileA
GetModuleHandleA
FreeLibrary
GetProcAddress
LoadLibraryA
GlobalAlloc
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
SystemTimeToFileTime
MultiByteToWideChar
GetFileAttributesA
ReadFile
GetModuleFileNameA
GetTimeFormatA
FindNextFileA
LoadLibraryExA
FormatMessageA
SetFileTime
GetDateFormatA
CreateDirectoryA
GetFileTime
WriteFile
FindFirstFileA
GetLastError
GetVersionExA
CreateFileA
GetFileSize
SetFileAttributesA
WideCharToMultiByte
FindClose
SetFilePointer
user32
IsWindowEnabled
GetMessageA
TrackPopupMenu
TranslateMessage
DispatchMessageA
GetWindowTextA
KillTimer
GetParent
FindWindowA
SendInput
ShowWindow
AttachThreadInput
PostQuitMessage
GetForegroundWindow
SendMessageTimeoutA
SystemParametersInfoA
GetActiveWindow
GetSystemMetrics
IsWindowVisible
SetTimer
SetWindowPos
DestroyIcon
PostMessageA
ExitWindowsEx
InvalidateRect
SetCursorPos
MessageBeep
GetWindowThreadProcessId
SetDlgItemTextA
GetSysColorBrush
ChildWindowFromPoint
DialogBoxParamA
LoadCursorA
SetCursor
EndDialog
SendMessageA
GetDlgItem
SetWindowTextA
MessageBoxA
GetDlgItemTextA
CreateWindowExA
GetWindowTextLengthA
GetClipboardFormatNameA
EmptyClipboard
RegisterClipboardFormatA
SetClipboardData
CloseClipboard
OpenClipboard
GetWindowLongA
SetWindowLongA
ReleaseDC
GetDC
GetClipboardData
SetForegroundWindow
EnableWindow
MapWindowPoints
GetWindowPlacement
GetCursorPos
GetWindowRect
MoveWindow
SetFocus
GetClassNameA
SetWindowPlacement
GetMonitorInfoA
EnumWindows
EnumDisplaySettingsA
GetDesktopWindow
EnumDisplayMonitors
EnumDisplayDevicesA
EnumChildWindows
RegisterClassA
ChangeDisplaySettingsA
DefWindowProcA
gdi32
CreateCompatibleBitmap
DeleteDC
BitBlt
CreateCompatibleDC
GetDeviceCaps
SelectObject
CreateDIBitmap
GetObjectA
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
advapi32
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExA
RegSetValueExA
RegCloseKey
RegDeleteKeyA
shell32
ExtractIconExA
SHFileOperationA
ShellExecuteExA
SHChangeNotify
ShellExecuteA
Shell_NotifyIconA
ole32
OleGetClipboard
ReleaseStgMedium
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
PropVariantClear
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ