Nexthink_Collector_autoglassbr-T77[.]exe

Resubmissions

25-07-2024 17:44

240725-wa4psaxhma 8

25-07-2024 17:31

240725-v3s83sxdrf 8

Sharing

Copy URL

Twitter E-mail

General

Target

Nexthink_Collector_autoglassbr-T77.exe
Size

67.4MB
MD5

bbe39c9b18a0cf01dc06e7e6066182d8
SHA1

c1ce5ff1045f340391872f7f14d596df91987ead
SHA256

e9de164b71f028dfd1211ad2a7bf17f698f2592e031d1776fb061321906ac274
SHA512

01aa24e0bd6c2a082b618d3cc20deddf590b43f682bc39e3002b3559de16268921a9fce5d21bec974affa21a57f7d6af80634d038377f1503867247d61ba0437
SSDEEP

1572864:bTvLOok9zgMPQFTb1D5XdRJBdYmfCqZs0i3Ig9CxcCu8t:XTOV7YlhV5Ym6qZsH3J9C7t

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nexthink_Collector_autoglassbr-T77.exe

Files

Nexthink_Collector_autoglassbr-T77.exe
.exe windows:6 windows x64 arch:x64

c2fbdf6fe9a10d1f1101af7aaa5e4d39

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\workspace\nexthinkinstaller_release_24.3.1\Local\bin\x64\Release\msirun.pdb

Imports

shlwapi

PathFileExistsW

advapi32

OpenProcessToken
GetUserNameW

userenv

LoadUserProfileW

kernel32

LoadLibraryExA
DeleteCriticalSection
VirtualQuery
VirtualProtect
CreateDirectoryW
SizeofResource
SetDefaultDllDirectories
GetCurrentProcess
WriteFile
GetTempPathW
WaitForSingleObject
CreateFileW
GetVersionExW
GetSystemDirectoryW
Sleep
GetLastError
LockResource
CloseHandle
GetSystemInfo
LoadResource
FindResourceW
GetComputerNameW
CreateProcessW
CopyFileW
GetSystemTime
IsWow64Process
GetExitCodeProcess
WriteConsoleW
HeapReAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
CompareStringW
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
GetFileSizeEx
SetFilePointerEx
HeapSize

user32

wsprintfW
LoadStringW

Sections

.text
Size: 90KB - Virtual size: 90KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 252B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 67.3MB - Virtual size: 67.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

c2fbdf6fe9a10d1f1101af7aaa5e4d39

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

advapi32

userenv

kernel32

user32

Sections

.text Size: 90KB - Virtual size: 90KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 3KB - Virtual size: 135KB

.pdata Size: 5KB - Virtual size: 5KB

_RDATA Size: 512B - Virtual size: 252B

.rsrc Size: 67.3MB - Virtual size: 67.3MB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 90KB - Virtual size: 90KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 3KB - Virtual size: 135KB

.pdata
Size: 5KB - Virtual size: 5KB

_RDATA
Size: 512B - Virtual size: 252B

.rsrc
Size: 67.3MB - Virtual size: 67.3MB

.reloc
Size: 2KB - Virtual size: 1KB