nfsc[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

nfsc.exe
Size

8.5MB
MD5

c540d0fa9c6d8506e848110ff9bfa0ad
SHA1

44eac56464cc87c347cb5ac205fdc935f2e77322
SHA256

f11a321fbb20538f904863923e208edefd21ec6969393ffc956c99060793a751
SHA512

13fcd22ebd73e14ad86698cc0e7a1fe48dcdb4994377f410416f33838f525452f03f6fbed5bc4c834f51403206f1cc18b15142078d10e2a77cf818a99f4b79e1
SSDEEP

196608:rcelN3V+/c+CvkI7BHdhhr5BfstRxaDBrk+vSmD:r573I/c+CvkE9hhrfsxaDFk+R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nfsc.exe

Files

nfsc.exe
.exe windows:4 windows x86 arch:x86

bbdd61e246d3f8bb37db849738755921

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\generate-pc\Carbon\Branches\LeadPlat\Speed\PC\obj\MWCollectorsRelease\NfsMWCollectorsRelease.pdb

Imports

kernel32

GetLongPathNameA
GetDriveTypeA
GetLogicalDrives
GetVersionExA
FindClose
FindNextFileA
FindFirstFileA
CreateDirectoryA
GetModuleHandleA
Sleep
GlobalMemoryStatusEx
Process32Next
Process32First
CreateToolhelp32Snapshot
SetErrorMode
GetTickCount
GetCurrentProcessId
ReadFile
SuspendThread
MultiByteToWideChar
FatalAppExitA
CloseHandle
CreateFileA
RemoveDirectoryA
SetEndOfFile
QueueUserAPC
RaiseException
InterlockedExchange
ReleaseSemaphore
InterlockedDecrement
CreateSemaphoreA
InterlockedCompareExchange
InterlockedExchangeAdd
DebugBreak
TryEnterCriticalSection
CreateMutexA
GetPriorityClass
SetPriorityClass
ExitProcess
ResumeThread
SetThreadIdealProcessor
TlsSetValue
TlsGetValue
TlsAlloc
GetSystemInfo
VirtualProtect
GetDiskFreeSpaceExA
GetFileSize
MoveFileA
DeleteFileA
SetFilePointer
WriteFile
GetCurrentDirectoryA
CreateEventA
ResetEvent
SetEvent
CreateWaitableTimerA
GetSystemTime
SystemTimeToFileTime
WaitForSingleObject
SetWaitableTimer
GetExitCodeThread
SetThreadPriority
GetThreadPriority
SleepEx
TerminateThread
GetCurrentThreadId
GetCurrentProcess
GetCurrentThread
DuplicateHandle
GlobalFree
GlobalAlloc
CreateThread
LeaveCriticalSection
EnterCriticalSection
GetComputerNameA
QueryPerformanceCounter
QueryPerformanceFrequency
CreateProcessA
GetLastError
IsBadReadPtr
IsDebuggerPresent
ReleaseMutex
OutputDebugStringA
DeleteCriticalSection
InitializeCriticalSection
GetSystemDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
GetSystemTimeAsFileTime

d3d9

Direct3DCreate9

d3dx9_30

D3DXVec3Transform
D3DXMatrixInverse
D3DXCreateVolumeTextureFromFileInMemory
D3DXCreateCubeTextureFromFileInMemory
D3DXLoadSurfaceFromSurface
D3DXSaveSurfaceToFileA
D3DXCreateEffectPool
D3DXCreateEffectFromResourceA
D3DXVec4Transform
D3DXMatrixPerspectiveLH
D3DXMatrixTranslation
D3DXVec3TransformCoordArray
D3DXVec3Normalize
D3DXVec3TransformNormal
D3DXSaveSurfaceToFileInMemory
D3DXFillVolumeTexture
D3DXMatrixMultiply
D3DXMatrixOrthoLH
D3DXMatrixTranspose

dinput8

DirectInput8Create

user32

SetWindowPos
SetWindowLongA
DestroyWindow
DefWindowProcA
BeginPaint
EndPaint
PostMessageA
IsIconic
PostQuitMessage
SetCapture
ReleaseCapture
PeekMessageA
ShowCursor
ShowWindow
TranslateMessage
DispatchMessageA
SendInput
GetWindowRect
GetClientRect
MapVirtualKeyA
ToUnicode
MessageBoxA
LoadCursorA
LoadIconA
GetCursorPos
wvsprintfA
SetFocus
SetForegroundWindow
SetCursor
UpdateWindow
CreateWindowExA
AdjustWindowRect
GetForegroundWindow
GetMessageA
GetDesktopWindow
GetKeyboardLayout
MapVirtualKeyExA
RegisterClassExA
GetKeyState

advapi32

CheckTokenMembership
FreeSid
RegCreateKeyA
RegOpenKeyExA
RegCloseKey
RegSetValueExA
RegQueryValueExA
AllocateAndInitializeSid
CryptReleaseContext
CryptGenRandom
CryptAcquireContextA

shfolder

SHGetFolderPathA

ws2_32

ntohl
send
socket
ioctlsocket
recv
connect
setsockopt
ntohs
WSACreateEvent
shutdown
WSACloseEvent
WSASetEvent
WSARecv
WSARecvFrom
WSAResetEvent
WSAWaitForMultipleEvents
WSAGetOverlappedResult
bind
listen
accept
sendto
recvfrom
getpeername
getsockname
gethostname
WSAIoctl
select
closesocket
getservbyport
gethostbyaddr
getservbyname
inet_ntoa
gethostbyname
WSAGetLastError
inet_addr
WSAStartup
WSACleanup
htonl
getsockopt
htons

rpcrt4

UuidToStringA
RpcStringFreeA

ole32

CoCreateGuid

msvcr71

_mkdir
_findfirst
_findnext
_findclose
getenv
_vsnwprintf
bsearch
_beginthreadex
_endthreadex
_write
_open
_lseek
_read
_filelength
_rmdir
remove
isdigit
__security_error_handler
_localtime64
_CIacos
_CIasin
_CIpow
_purecall
__CxxFrameHandler
qsort
memmove
sprintf
??1exception@@UAE@XZ
??0exception@@QAE@XZ
tolower
atoi
strncpy
strstr
_CxxThrowException
??0exception@@QAE@ABV0@@Z
ceil
printf
malloc
free
floor
vfprintf
_iob
strncmp
_CIcosh
_CIfmod
_CIsinh
_CItanh
_control87
fclose
fopen
strchr
_isnan
exit
vsprintf
longjmp
_setjmp3
isspace
strncat
strcspn
_getdiskfree
fread
strerror
_errno
fprintf
isprint
ungetc
getc
_exit
fwrite
_aligned_malloc
_controlfp
_ftime
strrchr
rand
strtok
_strnicmp
_stricmp
_vsnprintf
strlen
_snprintf
memset
memcmp
memcpy
srand
localtime
fflush
strcpy
calloc
strcmp
strtoul
strcat
sqrt
sscanf
cos
raise
realloc
abs
fgetc
toupper
fputc
clock
_c_exit
_XcptFilter
_cexit
__p___initenv
_amsg_exit
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UAE@XZ
_getdrive
_fullpath
strcoll
_getcwd
_aligned_realloc
_aligned_free
_mktime64
_gmtime64
wcslen
_time64
wcscpy
time
mktime
gmtime
strtol
_close

msvcp71

??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z

dsound

ord1

winmm

timeEndPeriod
timeGetTime
timeBeginPeriod

netapi32

Netbios

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 548KB - Virtual size: 548KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 1.5MB - Virtual size: 1.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 376KB - Virtual size: 376KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

bbdd61e246d3f8bb37db849738755921

Headers

File Characteristics

PDB Paths

Imports

kernel32

d3d9

d3dx9_30

dinput8

user32

advapi32

shfolder

ws2_32

rpcrt4

ole32

msvcr71

msvcp71

dsound

winmm

netapi32

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 548KB - Virtual size: 548KB

.data Size: 1.5MB - Virtual size: 1.5MB

.rsrc Size: 376KB - Virtual size: 376KB

Size: 328KB - Virtual size: 328KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 548KB - Virtual size: 548KB

.data
Size: 1.5MB - Virtual size: 1.5MB

.rsrc
Size: 376KB - Virtual size: 376KB