nslookup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

nslookup.exe
Size

100KB
MD5

e1ad42845d19fc9cbfa7d6167d2ec709
SHA1

3bd6d9a9c94e16a3b7278990531b5d7d33d111d7
SHA256

ed7c553ef847d0e6b42969d56d84ecda77d4770131f70661fd430c34d2bccb94
SHA512

9a71e5714497b0e83a659721e753c85cad178ac5677d9ecabe7e1c301b070619d16a43ae19d1ce4768c80a42ebd0ffba340e920b9f2f6a0ea25e11c631fa4461
SSDEEP

1536:Qm+9V+qmsvwult/6pXm9lCW1gIy1Z4XIrb+XfjSxu:QVV+6P/60SfDoIyou

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nslookup.exe

Files

nslookup.exe
.exe windows:10 windows x64 arch:x64

ec3e3c718c086fab4f7f35008a5e9116

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

nslookup.pdb

Imports

msvcrt

putc
_vsnprintf
malloc
sscanf_s
system
getenv
printf
fwrite
strchr
fputc
fprintf
memset
perror
exit
strcpy_s
fputs
?terminate@@YAXXZ
_commode
_fmode
__C_specific_handler
_initterm
strcat_s
gmtime
__setusermatherr
isspace
getc
_cexit
realloc
_exit
putchar
__set_app_type
ferror
__getmainargs
sprintf_s
fflush
_amsg_exit
_XcptFilter
_write
fclose
memcpy
strncmp
fgets
_strnicmp
free
strncpy_s
fread
fopen
__iob_func
strcmp

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
HeapSetInformation
GetProcessHeap

ws2_32

htonl
WSAStartup
select
getaddrinfo
gethostname
closesocket
send
socket
connect
recv
WSAGetLastError
getprotobynumber
getservbyport
ntohs
freeaddrinfo
inet_ntoa
htons

crypt32

CryptBinaryToStringA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
GetLastError
SetUnhandledExceptionFilter

dnsapi

DnsQueryConfigAllocEx
DnsFreeConfigStructure

api-ms-win-core-localization-l1-2-0

FormatMessageA
SetThreadUILanguage

api-ms-win-core-registry-l1-1-0

RegCloseKey

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsA

mswsock

s_perror

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

ntdll

NtQueryValueKey
RtlFreeHeap
RtlUnicodeStringToAnsiString
RtlFreeUnicodeString
NtOpenKey
RtlAllocateHeap
RtlAnsiStringToUnicodeString
RtlIpv6StringToAddressExA
RtlIpv4StringToAddressA
RtlIpv6AddressToStringA
RtlInitString

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 344B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ec3e3c718c086fab4f7f35008a5e9116

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

ws2_32

crypt32

api-ms-win-core-errorhandling-l1-1-0

dnsapi

api-ms-win-core-localization-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

mswsock

api-ms-win-core-heap-l2-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

ntdll

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 44KB - Virtual size: 42KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 16KB - Virtual size: 21KB

.pdata Size: 4KB - Virtual size: 1KB

.didat Size: 4KB - Virtual size: 16B

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 344B

.text
Size: 44KB - Virtual size: 42KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 16KB - Virtual size: 21KB

.pdata
Size: 4KB - Virtual size: 1KB

.didat
Size: 4KB - Virtual size: 16B

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 344B