AdskNLM[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
AdskNLM.exe
Size 29.1MB
Sample260706-v55d5aes2n
SHA256 62998d8ea862d6cdce7dca23006b423b5a32fdc4e85ae675010abb3c19279b25
MD5 6431fc6c593c673c266662b9f57e0787
SHA1 f3b4182b410b1e996d1f7ba9aa4c881381b6deb1
SHA512 e39ee0324a126c02f6f553b1a3e0eab11f0a17638f985e9cb530f3afb0f29c4a9f93293b550161e74d7f073b3788cc38ceba9d831a9349828fed1149f2962ada
SSDEEP 393216:rBb76kr6yhWXHJ2byrLTllz+BtYHSsjFw3qwnsab4ZMpSO85uH:r96kdY3J0y5lz+BtgFw3qwnFfx
TLSH
T17A673363F2BDE9D5E8E64F3845A7C721C63328031B4402FB3585777A8D738496A2DB62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AdskNLM.exe

File Explorer

AdskNLM.exe

.exe 29.1MB

AdskNLM.exe

IMPHASH d3bbfd624fcfeb095c7bf0242b723cee
SHA256 62998d8ea862d6cdce7dca23006b423b5a32fdc4e85ae675010abb3c19279b25
MD5 6431fc6c593c673c266662b9f57e0787
SHA1 f3b4182b410b1e996d1f7ba9aa4c881381b6deb1
SHA512 e39ee0324a126c02f6f553b1a3e0eab11f0a17638f985e9cb530f3afb0f29c4a9f93293b550161e74d7f073b3788cc38ceba9d831a9349828fed1149f2962ada
SSDEEP 393216:rBb76kr6yhWXHJ2byrLTllz+BtYHSsjFw3qwnsab4ZMpSO85uH:r96kdY3J0y5lz+BtgFw3qwnFfx
TLSH
T17A673363F2BDE9D5E8E64F3845A7C721C63328031B4402FB3585777A8D738496A2DB62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130684

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

ord17

shell32

ShellExecuteW SHBrowseForFolderW ShellExecuteExW SHGetPathFromIDListW SHGetFileInfoW SHGetSpecialFolderPathW SHGetMalloc

gdi32

CreateCompatibleDC CreateFontIndirectW DeleteObject DeleteDC GetCurrentObject StretchBlt GetDeviceCaps CreateCompatibleBitmap SelectObject SetStretchBltMode GetObjectW

advapi32

FreeSid AllocateAndInitializeSid CheckTokenMembership

user32

EnableMenuItem IsWindow EnableWindow MessageBeep LoadIconW LoadImageW SetWindowsHookExW PtInRect CallNextHookEx DefWindowProcW CallWindowProcW DrawIconEx DialogBoxIndirectParamW GetWindow ClientToScreen GetDC DrawTextW SystemParametersInfoW GetSystemMetrics SetFocus UnhookWindowsHookEx GetWindowLongPtrW SetWindowLongPtrW GetClientRect GetDlgItem GetKeyState GetSystemMenu DestroyWindow GetSysColor SetWindowTextW GetWindowTextLengthW GetWindowTextW wsprintfA GetClassNameA GetWindowLongW GetMenu GetWindowDC ReleaseDC CopyImage GetParent ScreenToClient CreateWindowExW GetDesktopWindow GetWindowRect SetWindowPos SetTimer GetMessageW CreateWindowExA KillTimer CharUpperW SendMessageW DispatchMessageW ShowWindow BringWindowToTop wsprintfW MessageBoxW wvsprintfW MessageBoxA EndDialog

ole32

CreateStreamOnHGlobal CoInitialize CoCreateInstance

oleaut32

SysFreeString VariantClear SysAllocStringLen OleLoadPicture SysAllocString

kernel32

GetFileInformationByHandle WaitForMultipleObjects VirtualAlloc SetUnhandledExceptionFilter QueryPerformanceCounter GetTickCount VirtualFree SetEndOfFile SetFileTime ReadFile SetFilePointer GetFileSize LeaveCriticalSection EnterCriticalSection DeleteCriticalSection FormatMessageW lstrcpyW LocalFree IsBadReadPtr SuspendThread TerminateThread GetSystemDirectoryW GetCurrentThreadId InitializeCriticalSection ResetEvent SetEvent CreateEventW GetVersionExW GetModuleFileNameW GetCurrentProcess SetProcessWorkingSetSize SetEnvironmentVariableW GetDriveTypeW CreateFileW LoadLibraryA SetThreadLocale GetSystemTimeAsFileTime ExpandEnvironmentStringsW CompareFileTime WideCharToMultiByte GetTempPathW GetCurrentDirectoryW FindFirstFileW lstrcmpW DeleteFileW FindNextFileW FindClose RemoveDirectoryW SetCurrentDirectoryW GetEnvironmentVariableW lstrcmpiW GetLocaleInfoW MultiByteToWideChar GetUserDefaultUILanguage GetSystemDefaultUILanguage GetSystemDefaultLCID lstrcmpiA GlobalAlloc GlobalFree MulDiv FindResourceExA SizeofResource LoadResource LockResource GetProcAddress GetModuleHandleW GetStdHandle WriteFile lstrlenA CreateDirectoryW GetFileAttributesW lstrlenW GetLocalTime SystemTimeToFileTime CreateThread GetExitCodeThread Sleep ExitProcess lstrcatW AddVectoredExceptionHandler RemoveVectoredExceptionHandler CloseHandle WaitForSingleObject GetExitCodeProcess GetQueuedCompletionStatus ResumeThread SetInformationJobObject CreateIoCompletionPort AssignProcessToJobObject CreateJobObjectW GetLastError CreateProcessW GetStartupInfoW GetCommandLineW SetLastError GetDiskFreeSpaceExW SetFileAttributesW GetCurrentProcessId

msvcrt

__CxxFrameHandler ??3@YAXPEAX@Z memset _wtol _purecall memcmp ??2@YAPEAX_K@Z _wcsnicmp memmove memcpy strncpy wcsncpy wcsncmp strncmp ?_set_new_handler@@YAP6AH_K@ZP6AH0@Z@Z _beginthreadex wcscmp _CxxThrowException wcsstr free malloc __C_specific_handler _unlock __dllonexit _lock _onexit ??1type_info@@UEAA@XZ __getmainargs _XcptFilter _exit _ismbblead _cexit exit _acmdln _initterm _amsg_exit __setusermatherr _commode _fmode __set_app_type ?terminate@@YAXXZ