nfa_tool[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
nfa_tool.exe
Size 8.0MB
Sample260702-lls3badx2n
SHA256 c1cd979de6542614730e7f28d3b8907227035f9425a5e021ada44994c35cde2e
MD5 2e978d6911123396892abc9ca10f17aa
SHA1 491f510857d88599584faec7148b211a8ef60bd7
SHA512 67a55ab16dc32487af3ff9070e2fb79806070ac9c17984b7388c4e8f40d2f22b01eb95b4e7139e5e4929883cc9dc4ccce292606ce4d1bdecb502b00436dd8d0a
SSDEEP 49152:iZUKmOvdeShPzqZ3OGr0A36ng6t27KLeRd+XnFTLzLhmIxpQ/NW8QpwxZ0tTKdrC:iE82SpAdrGtmkAlAOTbRy
TLSH
T12F868C06F68BA9ECD05AC470834686736A3274CB0B35BAFF05D455392F6ABE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nfa_tool.exe

File Explorer

nfa_tool.exe

.exe 8.0MB

nfa_tool.exe

IMPHASH d309673bf7361eb421d0dc83db96f3ed
SHA256 c1cd979de6542614730e7f28d3b8907227035f9425a5e021ada44994c35cde2e
MD5 2e978d6911123396892abc9ca10f17aa
SHA1 491f510857d88599584faec7148b211a8ef60bd7
SHA512 67a55ab16dc32487af3ff9070e2fb79806070ac9c17984b7388c4e8f40d2f22b01eb95b4e7139e5e4929883cc9dc4ccce292606ce4d1bdecb502b00436dd8d0a
SSDEEP 49152:iZUKmOvdeShPzqZ3OGr0A36ng6t27KLeRd+XnFTLzLhmIxpQ/NW8QpwxZ0tTKdrC:iE82SpAdrGtmkAlAOTbRy
TLSH
T12F868C06F68BA9ECD05AC470834686736A3274CB0B35BAFF05D455392F6ABE05F38719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5059272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nfa_tool.pdb

kernel32

CloseHandle LocalFree SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent GetCurrentThreadId GetCurrentProcessId GetCurrentProcess VirtualProtect SetThreadStackGuarantee GetCurrentDirectoryW GetEnvironmentVariableW Sleep GetFileInformationByHandleEx WideCharToMultiByte MultiByteToWideChar GetModuleFileNameW GetCurrentThread GetFileInformationByHandle AddVectoredExceptionHandler CancelIo GetSystemTimePreciseAsFileTime LoadLibraryW MapViewOfFile ReadFileEx HeapAlloc HeapFree GetProcessHeap CreateWaitableTimerExW SetWaitableTimer ReadFile GetOverlappedResult CreateFileMappingW UnmapViewOfFile GetSystemInfo GetModuleHandleA GetEnvironmentStringsW RtlVirtualUnwind GetSystemDirectoryW SetThreadErrorMode SetLastError GetWindowsDirectoryW CreateProcessW LoadLibraryExW GetProcAddress DuplicateHandle LoadLibraryA GetLastError GlobalAlloc GetExitCodeProcess GlobalUnlock GlobalFree LoadLibraryExA CreateDirectoryW GlobalSize CreateEventW CreateThread FormatMessageW FindFirstFileExW RtlCaptureContext GetStdHandle WaitForMultipleObjects FindClose GlobalLock lstrlenW RtlLookupFunctionEntry FreeLibrary GetModuleHandleW ExitProcess SwitchToThread GetFileAttributesW GetConsoleOutputCP GetConsoleMode WriteConsoleW DeleteFileW WaitForSingleObjectEx CompareStringOrdinal QueryPerformanceCounter WaitForSingleObject QueryPerformanceFrequency FreeEnvironmentStringsW WriteFileEx SleepEx GetFullPathNameW ReleaseMutex CreateMutexA SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc

oleaut32

SetErrorInfo SafeArrayPutElement SafeArrayCreateVector GetErrorInfo SysAllocStringLen SysStringLen SysFreeString VariantClear

gdi32

CreateRectRgn GetDeviceCaps DeleteObject ChoosePixelFormat SwapBuffers DescribePixelFormat SetPixelFormat

user32

GetActiveWindow GetSystemMetrics SendMessageW CreateIconFromResourceEx GetWindowLongPtrW GetClientRect GetWindowPlacement GetClassNameW GetClassInfoExW DefWindowProcW RegisterClassExW CreateWindowExW ClientToScreen SetCursorPos GetForegroundWindow ToUnicodeEx GetKeyboardLayout GetKeyState GetAsyncKeyState GetKeyboardState MapVirtualKeyExW ValidateRect CloseTouchInputHandle GetTouchInputInfo TrackMouseEvent ScreenToClient CreateIcon RegisterTouchWindow SetWindowPos InvalidateRgn SetWindowTextW GetWindowTextW GetWindowTextLengthW SetForegroundWindow SendInput IsIconic GetWindowRect LoadCursorW AdjustWindowRectEx GetMenu SetCursor FlashWindowEx DispatchMessageW SetWindowLongW EnableMenuItem GetSystemMenu ShowWindow ShowCursor ClipCursor GetClipCursor ChangeDisplaySettingsExW IsProcessDPIAware GetRawInputData DestroyIcon DestroyCursor SetWindowDisplayAffinity MonitorFromRect GetCursorPos MonitorFromWindow GetMonitorInfoW MsgWaitForMultipleObjectsEx MapVirtualKeyW RegisterRawInputDevices EnumDisplayMonitors MonitorFromPoint SystemParametersInfoA ReleaseCapture SetCapture RegisterWindowMessageA RegisterClipboardFormatW IsClipboardFormatAvailable CloseClipboard SetClipboardData EmptyClipboard GetClipboardData OpenClipboard TranslateMessage PeekMessageW PostMessageW RedrawWindow SetWindowPlacement IsWindowVisible DestroyWindow RemovePropW CallWindowProcW ReleaseDC SetWindowLongPtrW SetPropW GetPropW GetDC GetWindowLongW

uiautomationcore

UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaReturnRawElementProvider UiaLookupId UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent

ole32

RevokeDragDrop CoInitializeEx CoUninitialize CoCreateInstance OleInitialize CoCreateFreeThreadedMarshaler RegisterDragDrop

shell32

DragFinish DragQueryFileW

shlwapi

AssocQueryStringW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

RegOpenKeyExW RevertToSelf ImpersonateAnonymousToken RegCloseKey RegQueryValueExW RegSetValueExW

crypt32

CryptProtectData CryptUnprotectData

opengl32

wglGetProcAddress wglDeleteContext wglMakeCurrent wglGetCurrentDC wglGetCurrentContext wglCreateContext wglShareLists

imm32

ImmAssociateContextEx ImmReleaseContext ImmGetCompositionStringW ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

ntdll

NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

vcruntime140

__current_exception_context memcpy memcmp __CxxFrameHandler3 memmove memset _CxxThrowException __C_specific_handler __current_exception

api-ms-win-crt-math-l1-1-0

log2 atan2 sin round fmod pow ceil floor acos cos acosf expf powf __setusermatherr truncf sinf tanf cbrtf cosf exp2f fmodf _hypotf atan2f floorf ceilf roundf tan trunc

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _get_initial_narrow_environment _configure_narrow_argv strerror terminate _crt_atexit _register_onexit_function _initialize_onexit_table _initterm _register_thread_local_exe_atexit_callback _c_exit _cexit _initterm_e __p___argv _initialize_narrow_environment __p___argc exit _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode