check ip[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

check ip.exe
Size

171KB
MD5

3091265b6faf6978db90d875d8a2dc34
SHA1

d58191b63735fccd3c204fcf32c90ed26124b7ae
SHA256

96e22eea74ee9b3170c35cf4b46e29e88c1c3f3d8dbf5a4a775ea465335ae9f8
SHA512

b5d211941797ec360eb343528e450a45b071a08f7b032d14c58070d6996b7fc108cdf38ef8cec004b50dd172fb4889d0d6eb0c1d1a90e35d189b8eaaa79cc773
SSDEEP

3072:piU+c4jlhYCx0rrFARt7HHh2WRcTX5c9wnaPocoBI7x7w1TutJ:ph+a1AnnuSPoo2SH

Score

9^/10

Malware Config

Signatures

Detected Nirsoft tools 1 IoCs

Free utilities often used by attackers which can steal passwords, product keys, etc.

resource	yara_rule
sample	Nirsoft

Files

check ip.exe
.exe windows:4 windows x64 arch:x64

04672894112ba831be24bb21dd4ebed1

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/09/2019, 00:00

Not After

09/09/2023, 23:59

Subject

CN=Nir Sofer,O=Nir Sofer,POSTALCODE=7135117,STREET=Dakar 21\, Unit 82,L=Lod,C=IL

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/11/2018, 00:00

Not After

31/12/2030, 23:59

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning
ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

03/05/2023, 00:00

Not After

02/08/2034, 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02/05/2019, 00:00

Not After

18/01/2038, 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

75:fd:7e:fa:57:ba:40:e7:23:a5:bf:c1:1e:e5:59:d3:40:af:9f:3d:2e:d5:c5:c7:5a:4a:27:4a:c1:78:a9:8b
Signer

Actual PE Digest

75:fd:7e:fa:57:ba:40:e7:23:a5:bf:c1:1e:e5:59:d3:40:af:9f:3d:2e:d5:c5:c7:5a:4a:27:4a:c1:78:a9:8b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

c:\Projects\VS2005\LiveTcpUdpWatch\x64\Release\LiveTcpUdpWatch.pdb

Imports

msvcrt

__wgetmainargs
_wcmdln
exit
_wcslwr
strlen
qsort
_itow
strchr
_atoi64
strcmp
_strcmpi
_wcsnicmp
_cexit
_initterm
malloc
free
modf
wcstoul
wcscmp
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
wcslen
wcsrchr
_memicmp
__setusermatherr
_commode
_fmode
__set_app_type
strcpy
_wtoi
memcmp
_ultow
_wcsicmp
wcschr
memcpy
_purecall
wcscpy
memset
wcscat
_snwprintf
_exit
_c_exit
_XcptFilter
__C_specific_handler
wcsncat
_onexit
__dllonexit
memmove

comctl32

ord17
ImageList_Add
ImageList_SetImageCount
ImageList_AddMasked
CreateStatusWindowW
CreateToolbarEx
ImageList_Create

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

ws2_32

WSASetLastError
WSAAsyncSelect
gethostbyaddr
WSAGetLastError
htons
WSAStartup
closesocket
connect
getservbyport
WSACleanup

kernel32

Process32FirstW
CreateThread
ResumeThread
ReadProcessMemory
ExitProcess
GetCurrentDirectoryW
CreateProcessW
SetErrorMode
Sleep
ExpandEnvironmentStringsW
Process32NextW
CreateToolhelp32Snapshot
EnumResourceTypesW
GetStartupInfoW
OpenProcess
GetCurrentProcessId
DeleteFileW
GetStdHandle
GetPrivateProfileIntW
EnumResourceNamesW
WritePrivateProfileStringW
GetPrivateProfileStringW
DosDateTimeToFileTime
FileTimeToDosDateTime
GetTickCount
FormatMessageW
GetLastError
SizeofResource
FindFirstFileW
GetLocaleInfoW
GlobalLock
GetTempPathW
lstrcpyW
GlobalUnlock
FileTimeToSystemTime
SystemTimeToFileTime
CompareFileTime
GetSystemTimeAsFileTime
MultiByteToWideChar
GetFileSize
CloseHandle
LoadLibraryW
GetProcAddress
FreeLibrary
GetModuleHandleW
GetVersionExW
FindNextFileW
GetTimeFormatW
FindClose
FindResourceW
GetFileAttributesW
LoadResource
WriteFile
SystemTimeToTzSpecificLocalTime
ReadFile
LoadLibraryExW
GetModuleFileNameW
CreateFileW
GlobalAlloc
GetWindowsDirectoryW
GetSystemDirectoryW
FileTimeToLocalFileTime
GetDateFormatW
GetTempFileNameW
GetCurrentProcess
lstrlenW
WideCharToMultiByte
GetNumberFormatW
LocalFree
LockResource

user32

SetForegroundWindow
PeekMessageW
FindWindowW
SetTimer
DrawTextExW
RemoveMenu
GetMessageW
PostQuitMessage
InsertMenuW
TrackPopupMenu
RegisterWindowMessageW
TranslateMessage
IsDialogMessageW
KillTimer
GetMonitorInfoW
MonitorFromWindow
DispatchMessageW
CreatePopupMenu
GetKeyState
SetMenuItemInfoW
LoadIconW
DestroyMenu
GetDlgCtrlID
GetMenuItemInfoW
ModifyMenuW
LoadMenuW
GetWindowTextW
DestroyWindow
GetDC
ReleaseDC
SetCursor
LoadCursorW
GetSysColorBrush
ShowWindow
ChildWindowFromPoint
EndDialog
GetDlgItem
DrawFrameControl
SetWindowTextW
UpdateWindow
InvalidateRect
SendMessageW
GetWindowRect
SetDlgItemTextW
GetDlgItemTextW
GetDlgItemInt
SetWindowLongPtrW
GetWindowPlacement
SetDlgItemInt
GetSystemMetrics
SetWindowPlacement
EndPaint
DeferWindowPos
BeginPaint
CreateWindowExW
GetClientRect
SendDlgItemMessageW
GetWindow
GetForegroundWindow
LoadAcceleratorsW
DefWindowProcW
RegisterClassW
PostMessageW
MessageBoxW
SetMenu
TranslateAcceleratorW
SetWindowPos
LoadImageW
GetSysColor
SetWindowLongW
GetWindowLongW
DestroyIcon
EndDeferWindowPos
BeginDeferWindowPos
SetFocus
EnableWindow
MapWindowPoints
GetCursorPos
CheckMenuRadioItem
GetMenuStringW
CloseClipboard
MoveWindow
GetParent
GetMenu
EmptyClipboard
OpenClipboard
EnableMenuItem
GetClassNameW
CheckMenuItem
GetSubMenu
InsertMenuItemW
GetMenuItemCount
SetClipboardData
CreateDialogParamW
DialogBoxParamW
EnumChildWindows
LoadStringW
GetDesktopWindow

gdi32

SetStretchBltMode
SetBkColor
StretchBlt
GetObjectW
DeleteDC
GetPixel
SetPixel
SelectObject
CreateCompatibleDC
SetTextColor
CreateFontIndirectW
GetDeviceCaps
SetBkMode
DeleteObject
GetStockObject
GetTextExtentPoint32W
CreateCompatibleBitmap

comdlg32

FindTextW
GetSaveFileNameW
ChooseFontW

shell32

Shell_NotifyIconW
SHGetFileInfoW
ShellExecuteW

Sections

.text
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

04672894112ba831be24bb21dd4ebed1

Code Sign

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7Certificate

Extended Key Usages

Key Usages

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6aCertificate

Extended Key Usages

Key Usages

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4Certificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

75:fd:7e:fa:57:ba:40:e7:23:a5:bf:c1:1e:e5:59:d3:40:af:9f:3d:2e:d5:c5:c7:5a:4a:27:4a:c1:78:a9:8bSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

comctl32

version

ws2_32

kernel32

user32

gdi32

comdlg32

shell32

Sections

.text Size: 106KB - Virtual size: 105KB

.rdata Size: 21KB - Virtual size: 21KB

.data Size: 2KB - Virtual size: 9KB

.pdata Size: 5KB - Virtual size: 4KB

.rsrc Size: 27KB - Virtual size: 27KB

f7:a0:a7:30:c8:7d:94:cd:83:02:e3:ea:7f:66:1b:b7
Certificate

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a
Certificate

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

75:fd:7e:fa:57:ba:40:e7:23:a5:bf:c1:1e:e5:59:d3:40:af:9f:3d:2e:d5:c5:c7:5a:4a:27:4a:c1:78:a9:8b
Signer

.text
Size: 106KB - Virtual size: 105KB

.rdata
Size: 21KB - Virtual size: 21KB

.data
Size: 2KB - Virtual size: 9KB

.pdata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 27KB - Virtual size: 27KB