NBTExplorer-2.8.0.zip
- SHA256 1bf4c3e56a0e8fba911c6c73cc12fbf105c01367d92dcfb9d20b0f529a666e4b
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NBTExplorer.exe
Resource
win11-20260513-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target NBTExplorer-2.8.0.zip
- Size 294KB
- Sample260710-tc3t6aex21
- SHA256 1bf4c3e56a0e8fba911c6c73cc12fbf105c01367d92dcfb9d20b0f529a666e4b
- MD5 50a9db91f83c6c09f064385e50760a25
- SHA1 278bff3d03f71fc3b3ed84428064747c6715c7d1
- SHA512 b50e8f89bdd66b79e14103ddd37a8531c2cb0c479d88ca00dcdf940bbaf2fe991cf8eddb96515b87a8b20c8c855e6fe48da5ed836a89fca54ff271d45dcaf9c1
- SSDEEP 6144:9EnGlh8pvWHcsu1oIAExj/hnH4cg6QtGzFnXAiEuDZmS:9E6htHcsu1oIn3nYCQgiiEuDB
- TLSH T1505423915FFA6BD76AF01FE89283DF08B5B74BFD089CC905285A800B0114FD96625F2E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/NBTExplorer.exe unpack001/NBTModel.dll unpack001/NBTUtil.exe unpack001/Substrate.dll
File Explorer
-
NBTExplorer-2.8.0.zip.zip 294KB
-
NBTExplorer.exe.exe 419KB
-
NBTExplorer.exe.config.xml 268B
-
NBTModel.dll.dll 54KB
-
NBTUtil.exe.exe 30KB
-
NBTUtil.exe.config.xml 157B
-
Substrate.dll.dll 345KB
NBTExplorer.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c5e26b88085ad4aa60a434d2554eaaa4f3c4a37aa26b12f40b70fb0c7f6d6a3f
- MD5 7d39ad6228157eba3d4872afeaf042b0
- SHA1 48af98d067af2417901a29151ff486ff11cf1bfa
- SHA512 0a730945d2194e3fe82620cd5ae8fdd8bac887b42a08aa85ca1eb06f34591c29b2656fa5c30105cbcb938b299741ec3ee4fb5682b58e9d5ef741b1470e365cf5
- SSDEEP 6144:HT3HMf+RNxc8/y7ALvLLLIgjjgL6FlvLLLYgjjgL:HG8
- TLSH T147943B013768CD3BC56D4379146541C447BF6C5B909AD68FB880F2EE3AF37626A8B293
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
332374
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Workspace\Managed\NBTExplorer\NBTExplorer\obj\Release\NBTExplorer.pdb
mscoree
_CorExeMain
Name
.text
Size
317KB
Virtual Size
316KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NBTExplorer.exe.config
- SHA256 cbd941ca8c1e1171a21054eb9d6795ec6d677c5a06ebb33850c1547d3d051d8a
- MD5 b241c600a41add92f22dba80d4ced85f
- SHA1 e20045acd57a0f37a2186db24fe31eb4bf88e376
- SHA512 3758d9b067782b960d2e67f47e5c6b1eb3820d9fe5ab8d7b5b1a69351ec455d927cb8e88da456fc297e8b8692204993b6d79d75a93dcde0d9d28dcdd4062ef38
- TLSH T18FD05E1A96ACFE2799339E53B7120652FF70C2D25066140CB05F679B063318F434B31A
- MD5 SHA1 SHA512 TLSH
NBTModel.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 482a8f6810c8d2b659fcf313bea15e914b54923f9cfe5d0a11508cd16c81aeae
- MD5 4f6755f0adcceceebdf45c056b5a885a
- SHA1 e88411cc6b8faf231266317b5d0c4dd2db58c994
- SHA512 6b7c0da0f75f13d6e631779f2dfac027c8e868c04a124bca675ec3d3bcf30d88ff5e837fd6280c8940b0d2814b6b35b8198de36e0bf5bc17d191ba17d917202d
- SSDEEP 1536:I8GG0amIS9VvPtEIGwjqKA9WxQtSv8Ce7:7S9BwSAO+h7
- TLSH T1C5435C35538CCF6BE3AF47BDF464102143F5CA523683DB69AD84BAD6AC17382265206B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
61142
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Workspace\Managed\NBTExplorer\NBTModel\obj\Release\NBTModel.pdb
mscoree
_CorDllMain
Name
.text
Size
52KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
888B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NBTUtil.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 c26a46e87e270a168e55429588bee2839b702c0c5c57ef25c6515f38f2d7d0da
- MD5 5ce4b1b7ad0bf2d489133bc1cd91fad2
- SHA1 406ec6e97bc4a3daac3412e3154fdbf73e5d0c05
- SHA512 0ee1b105208cc0b7a82720c082d67ce2b544fb644841326041b1587619df2a71c89d5d5275c3c51fcabed9ec2a919d565df6efde0f5869ca34bc43cd6c9b8565
- SSDEEP 768:V5/X2oL6kNQtO1i71etzsgw4SB1SIVogUNdf:V5eoL6ketH7kC4STzVogUb
- TLSH T1C1D20805B7ECD735EAFF173578B2010402F6ED9A3A32DB1E1C88A09A4D2374587927A7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
35358
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\Workspace\Managed\NBTExplorer\NBTUtil\obj\Release\NBTUtil.pdb
mscoree
_CorExeMain
Name
.text
Size
27KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
NBTUtil.exe.config
- SHA256 309e6fedb75edb45dff3937efb1565f19443ec2cdb8ea20b91254701c3e7ac6d
- MD5 357b302903f3fd55c20ddf876835ae35
- SHA1 eb4fa9f4d5c2d5fc72a5ce60ddd307e04386a1c5
- SHA512 0a5ff53cd6adf185ada5a76c0a9bb4a1d78f6779f263c4da642aff0fa28f5c93a3d650a4844bfc4fd32e98aff924c60e57eabd897844c2fadd6a57c666c58e4e
- TLSH T14EC08C420124FC1B6C334B3343644900FF3032925025080CF09F2A220B310AE4B47315
- MD5 SHA1 SHA512 TLSH
Substrate.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 bd27f3309530a1937b068e6b9f1b5663bf5e28e4619ef25724a3290eb491e765
- MD5 1368be03adec59d273442910abdd8741
- SHA1 e3a6452b9900235757cbcd58f8b59480b9471654
- SHA512 a8ddc15b49bba7853e4c24ced61b646393b98a06fb3563219b4789dd2f761dbe1a0096c91bf32ba2a7f3b7f0bc03d9c7dfe8e31e2d8dc0ae5e14b495568d79d6
- SSDEEP 6144:vFoCsa3XtU5wRCx/Qfe2eupFvAFsTeZifpb2jd7SD:3X6Qf06hb2j4
- TLSH T15C744B0A63F856ADE1EE86B9D060146C57F0E856A5A3FF4D65C0FAED5C63310EE02273
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
349946
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
E:\Workspace\Managed\Substrate\SubstrateCS\obj\Release\Substrate.pdb
mscoree
_CorDllMain
Name
.text
Size
343KB
Virtual Size
343KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1008B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ