Static task
static1
General
-
Target
AdskNLM.exe
-
Size
6.3MB
-
MD5
0d07f92324f1d0f6b44261afeedea63c
-
SHA1
b0d09f42b1002af86d60d0ce0a4bbd1f04c77323
-
SHA256
e3fa192618ea047023f08040741a9375de32f28f57acd214b8f51554c0521877
-
SHA512
a785fff3de7b44ce423cb0bf61ca1375315be2fbd3d6a6949876b6473ac928f79c31f38bcca1672198aadbd11fc5b0ddcc60a1df76ef63d19bdf68a55e7a9ed6
-
SSDEEP
98304:6CKFIMdUltQYodSRsCYW4QkfMm0W9XLN4/hrK9vauib6Bf5oT/tKr2+l/S+Fc:6AbQaHYIk90W9XBUVCkTH+5+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource AdskNLM.exe
Files
-
AdskNLM.exe.exe windows:4 windows x64 arch:x64
d3bbfd624fcfeb095c7bf0242b723cee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
comctl32
ord17
shell32
ShellExecuteW
SHBrowseForFolderW
ShellExecuteExW
SHGetPathFromIDListW
SHGetFileInfoW
SHGetSpecialFolderPathW
SHGetMalloc
gdi32
CreateCompatibleDC
CreateFontIndirectW
DeleteObject
DeleteDC
GetCurrentObject
StretchBlt
GetDeviceCaps
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
GetObjectW
advapi32
FreeSid
AllocateAndInitializeSid
CheckTokenMembership
user32
EnableMenuItem
IsWindow
EnableWindow
MessageBeep
LoadIconW
LoadImageW
SetWindowsHookExW
PtInRect
CallNextHookEx
DefWindowProcW
CallWindowProcW
DrawIconEx
DialogBoxIndirectParamW
GetWindow
ClientToScreen
GetDC
DrawTextW
SystemParametersInfoW
GetSystemMetrics
SetFocus
UnhookWindowsHookEx
GetWindowLongPtrW
SetWindowLongPtrW
GetClientRect
GetDlgItem
GetKeyState
GetSystemMenu
DestroyWindow
GetSysColor
SetWindowTextW
GetWindowTextLengthW
GetWindowTextW
wsprintfA
GetClassNameA
GetWindowLongW
GetMenu
GetWindowDC
ReleaseDC
CopyImage
GetParent
ScreenToClient
CreateWindowExW
GetDesktopWindow
GetWindowRect
SetWindowPos
SetTimer
GetMessageW
CreateWindowExA
KillTimer
CharUpperW
SendMessageW
DispatchMessageW
ShowWindow
BringWindowToTop
wsprintfW
MessageBoxW
wvsprintfW
MessageBoxA
EndDialog
ole32
CreateStreamOnHGlobal
CoInitialize
CoCreateInstance
oleaut32
SysFreeString
VariantClear
SysAllocStringLen
OleLoadPicture
SysAllocString
kernel32
GetFileInformationByHandle
WaitForMultipleObjects
VirtualAlloc
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
VirtualFree
SetEndOfFile
SetFileTime
ReadFile
SetFilePointer
GetFileSize
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
FormatMessageW
lstrcpyW
LocalFree
IsBadReadPtr
SuspendThread
TerminateThread
GetSystemDirectoryW
GetCurrentThreadId
InitializeCriticalSection
ResetEvent
SetEvent
CreateEventW
GetVersionExW
GetModuleFileNameW
GetCurrentProcess
SetProcessWorkingSetSize
SetEnvironmentVariableW
GetDriveTypeW
CreateFileW
LoadLibraryA
SetThreadLocale
GetSystemTimeAsFileTime
ExpandEnvironmentStringsW
CompareFileTime
WideCharToMultiByte
GetTempPathW
GetCurrentDirectoryW
FindFirstFileW
lstrcmpW
DeleteFileW
FindNextFileW
FindClose
RemoveDirectoryW
SetCurrentDirectoryW
GetEnvironmentVariableW
lstrcmpiW
GetLocaleInfoW
MultiByteToWideChar
GetUserDefaultUILanguage
GetSystemDefaultUILanguage
GetSystemDefaultLCID
lstrcmpiA
GlobalAlloc
GlobalFree
MulDiv
FindResourceExA
SizeofResource
LoadResource
LockResource
GetProcAddress
GetModuleHandleW
GetStdHandle
WriteFile
lstrlenA
CreateDirectoryW
GetFileAttributesW
lstrlenW
GetLocalTime
SystemTimeToFileTime
CreateThread
GetExitCodeThread
Sleep
ExitProcess
lstrcatW
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
CloseHandle
WaitForSingleObject
GetExitCodeProcess
GetQueuedCompletionStatus
ResumeThread
SetInformationJobObject
CreateIoCompletionPort
AssignProcessToJobObject
CreateJobObjectW
GetLastError
CreateProcessW
GetStartupInfoW
GetCommandLineW
SetLastError
GetDiskFreeSpaceExW
SetFileAttributesW
GetCurrentProcessId
msvcrt
__CxxFrameHandler
??3@YAXPEAX@Z
memset
_wtol
_purecall
memcmp
??2@YAPEAX_K@Z
_wcsnicmp
memmove
memcpy
strncpy
wcsncpy
wcsncmp
strncmp
?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z
_beginthreadex
wcscmp
_CxxThrowException
wcsstr
free
malloc
__C_specific_handler
_unlock
__dllonexit
_lock
_onexit
??1type_info@@UEAA@XZ
__getmainargs
_XcptFilter
_exit
_ismbblead
_cexit
exit
_acmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
Sections
.text Size: 125KB - Virtual size: 125KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 25KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 246KB - Virtual size: 245KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ