General

  • Target

    ns.zip

  • Size

    5.2MB

  • MD5

    f8a1897cfdae396dd5e3dad215336131

  • SHA1

    2f0c56ebd76ce4a36a989eeecad5368b45287c88

  • SHA256

    23eae2a9d0bf842640521e8f44c240720220b8fc7fbf7e3121c0f4d0c62bf2b3

  • SHA512

    c85f3847905defe63b75beceff313afde8cb6b58c17437cbac2d1a2529ca5217e8ec81238424ee277939028d3096e7845becf922bb218e9438c6d724cb400827

  • SSDEEP

    98304:u11OYBmPlAH60o07WZpvM+X1d05smow458rdxYEpJ0yAi7j9GLb4quFSLc:u1DBmPyv7WZuM1dGRIiRTpJ0yAiCeFS4

Score
7/10

Malware Config

Signatures

  • Themida packer 1 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • ns.zip
    .zip
  • AudioCapture.dll
    .dll windows:5 windows x86 arch:x86

    b8a1db56beebf8e839dde8e0df72f492


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • NSM.LIC
  • NSM.ini
  • PCICHEK.DLL
    .dll windows:5 windows x86 arch:x86

    e05a5a3d0a2f8611baa7485a20209a99


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • PCICL32.DLL
    .dll windows:5 windows x86 arch:x86


    Headers

    Exports

    Sections

  • TCCTL32.DLL
    .dll windows:5 windows x86 arch:x86

    12502266fb3759e2dc267188b1b8003e


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • client32.exe
    .exe windows:5 windows x86 arch:x86

    a9d50692e95b79723f3e76fcf70d023e


    Code Sign

    Headers

    Imports

    Sections

  • client32.ini
  • htctl32.dll
    .dll windows:5 windows x86 arch:x86

    6ba08298dd09ea8e41ab7285d3183bba


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • msvcr100.dll
    .dll windows:5 windows x86 arch:x86

    5271d5ce8b44dd47bc92563e27585466


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • nskbfltr.inf
  • nsm_vpro.ini
  • pcicapi.DLL
    .dll windows:5 windows x86 arch:x86

    c09dcd07c8e93b972e6530c73f8ec4bf


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • remcmdstub.exe
    .exe windows:5 windows x86 arch:x86

    99c0cd957fc7334714fefa3daa61a6ea


    Code Sign

    Headers

    Imports

    Sections