6cca0367d9876726e703e5e54b9c986a7c7829cad82a5b05b532675490eb6cef

Sharing

Copy URL Twitter E-mail

General

Target

6cca0367d9876726e703e5e54b9c986a7c7829cad82a5b05b532675490eb6cef
Size

3.8MB
MD5

ed57956e892bdcd31fbcfac26fb9e8d9
SHA1

d4bafb405a412402fa360ee9b01c131d08a4862e
SHA256

6cca0367d9876726e703e5e54b9c986a7c7829cad82a5b05b532675490eb6cef
SHA512

e605c5fce6fb0e84657c80263dfdb9b8ef173c49a29cf9420bb310bdcd5ecc4c5ba2fa741bcddc67fca4628650ce10f8a3cacac828e60b13769b57b7a5a163d7
SSDEEP

98304:iRewKqKUeo14qg8LM8Nr+DrClz/yhi+AmG4xmqrWETR9b:iReTCt4qxLM8cfCOi+/79b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6cca0367d9876726e703e5e54b9c986a7c7829cad82a5b05b532675490eb6cef

Files

6cca0367d9876726e703e5e54b9c986a7c7829cad82a5b05b532675490eb6cef
.exe windows:6 windows x64 arch:x64

655126deff1b593190d58b265ca94bf4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\BuildAgent\work\a2228a998c6232e2\Out\Nahimic3Restore\Nahimic3RestoreExe\Release\x64\NahimicRestoreTool.pdb

Imports

kernel32

SizeofResource
QueueUserAPC
GetCurrentThread
WaitForSingleObjectEx
CreateThread
SetEndOfFile
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
LockResource
SetHandleInformation
HeapReAlloc
WaitForSingleObject
GetUserDefaultLCID
IsValidLocale
ReadConsoleW
HeapAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetFilePointerEx
GetFileSizeEx
GetFileType
HeapFree
WriteFile
GetStdHandle
GetModuleHandleExW
ExitProcess
LoadResource
FindResourceW
Sleep
ReadFile
GetExitCodeProcess
CreatePipe
CloseHandle
TerminateThread
RaiseException
RtlPcToFileHeader
EnumSystemLocalesW
CreateProcessW
GetModuleFileNameW
WideCharToMultiByte
MultiByteToWideChar
GetCurrentThreadId
CopyFileA
RtlUnwindEx
LoadLibraryW
FormatMessageW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
RemoveDirectoryW
GetTempPathW
AreFileApisANSI
GetLastError
SetLastError
GetModuleHandleW
GetProcAddress
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
QueryPerformanceCounter
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
CreateTimerQueue
SignalObjectAndWait
SetThreadPriority
GetThreadPriority
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualAlloc
VirtualProtect
VirtualFree
DuplicateHandle
ReleaseSemaphore
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
RtlUnwind

user32

LoadIconW
SetWindowLongPtrW
GetSystemMetrics
CloseWindow
KillTimer
SetTimer
EnableWindow
DefWindowProcW
PostQuitMessage
DestroyWindow
EndPaint
BeginPaint
DispatchMessageW
TranslateMessage
GetMessageW
UpdateWindow
InvalidateRect
ShowWindow
MessageBoxW
SetActiveWindow
SetFocus
SetForegroundWindow
SetWindowPos
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
SetWindowTextW
SendMessageW
CreateWindowExW
GetClientRect
GetDesktopWindow
RegisterClassExW
LoadCursorW

gdi32

TextOutW
GetTextMetricsW
CreateSolidBrush
CreateFontW
SetBkColor

advapi32

RegSetValueExA
RegCreateKeyExA

shell32

ShellExecuteA

comctl32

InitCommonControlsEx

cfgmgr32

CM_Locate_DevNodeW
CM_Get_DevNode_Status
CM_Query_And_Remove_SubTreeW
CM_Uninstall_DevNode
CM_Reenumerate_DevNode

uxtheme

SetWindowTheme

Sections

.text
Size: 373KB - Virtual size: 373KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 152KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

655126deff1b593190d58b265ca94bf4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

comctl32

cfgmgr32

uxtheme

Sections

.text Size: 373KB - Virtual size: 373KB

.rdata Size: 152KB - Virtual size: 151KB

.data Size: 11KB - Virtual size: 18KB

.pdata Size: 22KB - Virtual size: 21KB

.rsrc Size: 2.7MB - Virtual size: 2.7MB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 373KB - Virtual size: 373KB

.rdata
Size: 152KB - Virtual size: 151KB

.data
Size: 11KB - Virtual size: 18KB

.pdata
Size: 22KB - Virtual size: 21KB

.rsrc
Size: 2.7MB - Virtual size: 2.7MB

.reloc
Size: 572KB - Virtual size: 576KB