c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080
- SHA256 c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080
Overview
overview
9Static
static
9Files/Stic...es.vbs
windows10-2004-x64
7Files/Stic...es.vbs
windows11-ltsc_2024-x64
5Files/nirc...md.chm
windows10-2004-x64
1Files/nirc...md.chm
windows11-ltsc_2024-x64
1Files/nirc...64.exe
windows10-2004-x64
1Files/nirc...64.exe
windows11-ltsc_2024-x64
1Files/nirc...86.exe
windows10-2004-x64
9Files/nirc...86.exe
windows11-ltsc_2024-x64
9Behavioral task
behavioral1
Sample
Files/StickyNotes/StickyNotes.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Files/StickyNotes/StickyNotes.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Files/nircmd/NirCmd.chm
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
Files/nircmd/NirCmd.chm
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
Files/nircmd/nircmd_x64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Files/nircmd/nircmd_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Files/nircmd/nircmd_x86.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
General
- Target c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080
- Size 202KB
- Sample260919-sb7laasbqa
- SHA256 c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080
- MD5 53caefdaf5a5afad94a8805cd6102445
- SHA1 5a88086becb7c8a7e4c79936e7f04b534711bd01
- SHA512 42a6181fbfceaa47cc00cf1ecb17528c565a4bc769ff1caf0494906677e993ccf2f04466611058cbf4f3ee1664370688f1711f5790e31eb836f29b49d2d2db20
- SSDEEP 6144:EZsPNa2q6zp97a2nQaUe11iVo4iKI7PcW6T+cv:EZszdj7a2nQLOKjXv
- TLSH T1F114134642D47980C186B43FACAEF107CF8991F1955602A66AFD5C39BE40CF27B4CA9F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detected Nirsoft tools 2 IoCs
Free utilities often used by attackers which can steal passwords, product keys, etc.
resource yara_rule static1/unpack001/Files/nircmd/nircmd_x64.exe Nirsoft static1/unpack002/out.upx Nirsoft - NirSoft NirCmd 2 IoCs
NirCmd is a lightweight Windows command-line tool for automating system tasks
resource yara_rule static1/unpack001/Files/nircmd/nircmd_x64.exe NirCmd static1/unpack002/out.upx NirCmd -
resource yara_rule static1/unpack001/Files/nircmd/nircmd_x86.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Files/nircmd/nircmd_x64.exe unpack001/Files/nircmd/nircmd_x86.exe unpack002/out.upx
File Explorer
-
c4d50a0a3ba2b3b776c37e07d830971de057ce1eac534bb2f98eb93aaaee9080.zip 202KB
-
Files/EcMenu.ini281KB
-
Files/Items.ini36KB
-
Files/Readme.txt631B
-
Files/StickyNotes/StickyNotes.ico1KB
-
Files/StickyNotes/StickyNotes.vbs.vbs 733B
-
Files/nircmd/NirCmd.chm.chm 44KB
-
Files/nircmd/nircmd_x64.exe.exe 113KB
-
Files/nircmd/nircmd_x86.exe.exe 43KB
-
out.upx.exe 84KB
Files/EcMenu.ini
- SHA256 a682abd6340844132b2dd2f73bcbd7a43518e22df101d2f2358be409d5346f98
- MD5 c2d96363194db5cd961b4f06c27923f8
- SHA1 bf9d4a7b68828f6fae909a112272ec59348fcbe5
- SHA512 fbd6ec81899ad72ab317f1b0bd3c1718a98c8a9f959692b7b963052777a946efb5826f123130dad5fe38820c19114afe4ec91cbaa8f48196feca0b6f8cecda32
- SSDEEP 6144:Qj4CF5qeHBeDs9x97E0zxnqWWNtNrGfpDNJqvP:iJNJqn
- TLSH T19F54772716FA4125B2F3AB50EBB08EB64B76BD51697C940D0EC25D4C04F8A10A953FFB
- MD5 SHA1 SHA512 SSDEEP TLSH
Files/Items.ini
- SHA256 308dad44055bf30390105d6ce91d11cc77172c07c4464f0846219a8356f6817f
- MD5 d184e2a90d0f14c1622e6835b4a3160d
- SHA1 faf46f6b35958e696d45d785a14264123869d806
- SHA512 bbf0b5fbedfc1fd59bc43f4029363ab17b5803ca1c550bc0c37c9dd17dccb487bfac70e0775676a5306c869d105241b1e6421c34a4594a8418323fc82a5d5420
- SSDEEP 96:t+1HaH16Jkve/Ve3jH2JI1H2wCEsH2nOvOH2JI8H2wCE7H2nOvziZH2vH2mj4VTc:tFMET2EXfFE6eAVOzDUAssx8Ugkpf
- TLSH T1DAF27B02BBFD0114B7B38B91AEB9E1345A3BFC325D2AC59D91D09A8D14E1D109922BF7
- MD5 SHA1 SHA512 SSDEEP TLSH
Files/Readme.txt
- SHA256 e58eae336522916291a3050c194a204fcd78ea970d2c4890d8b8eb8286c1084e
- MD5 5e9025b9845724d5bbb2ffa61a57e897
- SHA1 695ee1f61dad172fe05ee207b1b44b3a2a397487
- SHA512 3b23f8b1b317c29ab8128d9d5d70ea4f58218f186224353ad96e9b7480579a0523b7570b363f194db4827498ba16d1410c2e1b63890cbe36c4df7a31b149c4fc
- TLSH T1DFF0A28612451767E1E07261050F6CC67706CB6CAB504E201DB4C44D7BD3AF252FF5F0
- MD5 SHA1 SHA512 TLSH
Files/StickyNotes/StickyNotes.ico
- SHA256 08533f5cc9fbc267f212f0619411f67bb4c2960042bcd2ec869ed7cd7663c0f9
- MD5 0b1299c03d6105c6cea70e1ea9856825
- SHA1 0fa3afd52c3668b289da55617b9161d240752709
- SHA512 5f3275fa97d52061d363f05db368ce0ad5aa2e97fb5e367739eae017a78be959ab1bf875b353745f1cce16d357f5363bffb01809fd0761575e55ca2641763caa
- TLSH T1302178E0902A18FAC87237B7F1034D2999495FAC12B1361B549BB7466F10BD34CFEB85
- MD5 SHA1 SHA512 TLSH
Files/StickyNotes/StickyNotes.vbs
- SHA256 491f73ccda6ab648edee2ef6c8e0cd2695f5bb7f2e541aba9672aa05a17d840d
- MD5 a32db573e3fae8fbc7bedc203ff1d963
- SHA1 9c4508d2cb01f22c0b2bc70f77b9b76edf3099bd
- SHA512 0f0fa28d85cbd2142e57b23abc9aed1bdd033b32fb233e81ab5a482bdd253763cc6333ddb9ed0d1221b22b34c4daf59cf8d7cc303e93d531b26e0038d5d36599
- TLSH T18501C0105E05C39B107EA74117B2F4AA92F2461599A0DC0D7AD9D5ACF443D0D43715BE
- MD5 SHA1 SHA512 TLSH
Files/nircmd/NirCmd.chm
- SHA256 e050308c4a297f637a848109d719c65a62f6ab6ed0d854d026cc2df257515d32
- MD5 66729efe2819e71c060af7fd49732c28
- SHA1 c0be1545703ff0469c83688b677e7666a782160c
- SHA512 7b9b3497061e830ea8abd2b585afcb787fa41bd0028fd94673612ca8757c91c2069e3b7e2423ba66924deaef255f8bcd9ccc47c9fe7346974e38c4ecc8232047
- SSDEEP 768:Nj2qqCRLUVgNjKKAhDJltkXdWWL0w3PxYtyoObzb97z/+:NqqqUYg+D7sLL1Px2I9+
- TLSH T1D12301FE9B011018C25A6734A6E11ED76B14E934FC7A87F2B0149218E731DE19FA4DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
Files/nircmd/nircmd_x64.exe
- IMPHASH 74bca221fd0c75946165ba7a1089567f
- SHA256 14801ff8d189dcd12374101754d0212be499fcea3cd2b967d1ae21e8bd6201e0
- MD5 80cce4afc880cde9f75dc4e8b497da80
- SHA1 466cf02efdd7c1e6086c95ab4b792cd444024da3
- SHA512 ffebaa94c54d1f029a7ca6193d1d6558a56e384f4e926917b3cec29fe540f3fb958ba3cce9dbe9a54b2b1128babac9ad933fe6100cdddc5ab6a81583b3dc425b
- SSDEEP 3072:6W4EvIPzm1a6AVcLMqdPxLAztO4oSgNuEsl9fVHZHufkKCHKE:Z4EvmYA/l98eJ
- TLSH T1D7B34916B32504FEC466D876CB128707D7F1B8550576AB1F9BE08DA26F433A3BC26B12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft NirCmd
NirCmd is a lightweight Windows command-line tool for automating system tasks
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
87392
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
f:\Projects\VS2005\NirCmd\x64\release\NirCmd.pdb
winmm
waveOutSetVolume
mixerOpen
mciSendStringA
mixerGetLineInfoA
mixerGetControlDetailsA
mixerGetLineControlsA
mixerSetControlDetails
waveOutGetVolume
waveOutGetNumDevs
waveOutGetDevCapsA
mixerClose
msvcrt
_initterm
__getmainargs
_acmdln
exit
_cexit
_exit
_c_exit
_XcptFilter
__C_specific_handler
_onexit
__dllonexit
__setusermatherr
_itoa
_strlwr
printf
atof
_mbsicmp
_snprintf
_strnicmp
memcmp
strrchr
strtol
atoi
_commode
_fmode
__set_app_type
wcslen
_stricmp
strcmp
strtoul
strchr
strcpy
_memicmp
malloc
wcscpy
free
wcscmp
wcsrchr
_wcsicmp
strlen
memcpy
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
memset
_strcmpi
sprintf
strcat
kernel32
GetSystemDirectoryA
SetConsoleTextAttribute
ReadProcessMemory
GetSystemTime
SetProcessAffinityMask
DeleteFileA
Beep
WinExec
LocalFileTimeToFileTime
GetStdHandle
GetCurrentProcess
Process32Next
TerminateProcess
CreateToolhelp32Snapshot
Process32First
GetCurrentThreadId
GetStartupInfoA
WaitForSingleObject
SetPriorityClass
OutputDebugStringA
Sleep
OpenProcess
WritePrivateProfileStringA
DeviceIoControl
GetEnvironmentVariableA
SetComputerNameA
CreateProcessA
GetFileAttributesA
GetWindowsDirectoryA
CopyFileA
FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
GlobalSize
GlobalLock
GlobalUnlock
GlobalAlloc
SystemTimeToFileTime
MultiByteToWideChar
ReadFile
GetModuleFileNameA
GetTimeFormatA
FindNextFileA
GetModuleHandleA
LoadLibraryExA
FormatMessageA
SetFileTime
GetDateFormatA
CreateDirectoryA
GetFileTime
WriteFile
FindFirstFileA
GetLastError
GetVersionExA
CreateFileA
GetFileSize
SetFileAttributesA
WideCharToMultiByte
FindClose
SetFilePointer
LocalFree
user32
GetForegroundWindow
SystemParametersInfoA
TrackPopupMenu
SendMessageTimeoutA
GetActiveWindow
GetSystemMetrics
IsWindowVisible
SetWindowPos
DestroyIcon
SetTimer
PostMessageA
AttachThreadInput
InvalidateRect
SetCursorPos
MessageBeep
GetWindowThreadProcessId
ChangeDisplaySettingsA
RegisterClassA
EnumChildWindows
DispatchMessageA
TranslateMessage
IsWindowEnabled
GetMessageA
GetWindowTextA
FindWindowA
ShowWindow
GetParent
KillTimer
SetDlgItemTextA
GetSysColorBrush
ChildWindowFromPoint
DialogBoxParamA
LoadCursorA
SetCursor
EndDialog
SendMessageA
GetDlgItem
SetWindowTextA
MessageBoxA
CreateWindowExA
GetWindowTextLengthA
GetDlgItemTextA
RegisterClipboardFormatA
SetClipboardData
CloseClipboard
OpenClipboard
GetClipboardFormatNameA
EmptyClipboard
SetWindowLongA
GetWindowLongA
ReleaseDC
GetDC
GetWindowPlacement
GetCursorPos
GetWindowRect
MoveWindow
SetFocus
GetClassNameA
SetWindowPlacement
GetClipboardData
SetForegroundWindow
EnableWindow
MapWindowPoints
EnumDisplaySettingsA
GetDesktopWindow
EnumDisplayMonitors
EnumDisplayDevicesA
GetMonitorInfoA
EnumWindows
DefWindowProcA
PostQuitMessage
SendInput
ExitWindowsEx
gdi32
BitBlt
DeleteDC
CreateCompatibleBitmap
CreateCompatibleDC
GetDeviceCaps
SelectObject
CreateDIBitmap
GetObjectA
SetTextColor
CreateFontIndirectA
SetBkMode
DeleteObject
advapi32
RegQueryValueExA
RegSetValueExA
RegDeleteValueA
RegQueryInfoKeyA
RegOpenKeyExA
RegCreateKeyExA
RegDeleteKeyA
RegCloseKey
shell32
ShellExecuteExA
SHChangeNotify
ExtractIconExA
SHFileOperationA
ShellExecuteA
Shell_NotifyIconA
ole32
OleGetClipboard
ReleaseStgMedium
CoUninitialize
CoInitialize
CoCreateInstance
CoTaskMemFree
CoTaskMemAlloc
PropVariantClear
Name
.text
Size
82KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=128, version=50727,
count=1, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=10, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=19, id=123, productName=VS2005 build 50727, version=50727,
count=278, id=1, productName=Unmarked objects,
count=29, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
Files/nircmd/nircmd_x86.exe
- SHA256 11f02159cd9e001e9c8eb6ab3875132f77b9e9e8af981d45d182ec71ce68c5ad
- MD5 ba2cf7d2d09ae9a29445704bd1b4f67b
- SHA1 919250240e4cf978603ddf6944719fe35acdb668
- SHA512 4e5a68540cb00421ed66cb24d30a9ec28f2eb1d632edcc3f348c299b82240f7d2ae8a568f37a7cf9b13e455f7382c7dd4777bc507130e5c9d7b3e975f1db5147
- SSDEEP 768:O1FaQ57qJIUnwiCr5FQrnrLQ5gz8mpFHFsHNXVzflcipN0h7QEC0SJrcV:kFl7qeUnwiwmvZFtKNhFpa7QKSJrcV
- TLSH T13E13012999A4A81CFA724EB2373825073385BB1D9A1427AF3D7F7591BED01710DE2B00
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
105648
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
40KB
Virtual Size
40KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=64, version=9210,
count=12, id=28, version=9178,
count=2, id=25, version=9210,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=280, id=1, productName=Unmarked objects,
count=29, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,
out.upx
- SHA256 e0bf4e9fb3c01a7c54bb399cdd2acc1b80158d1d3ac6172cdefcfc373cffe70c
- MD5 3ceee263cd3888f8e4f31862dbd9cf4a
- SHA1 4ebf575fa61425d55c989018e5481a6025d35a26
- SHA512 6e14979ce09a360e82ae6b0386aedecd31374f935794a24800c422ff23ff523968b53f6416f381c9efeec91a75890e87118a2c8d5716cd4b32b2cf9972bb5b25
- SSDEEP 1536:NX3HWbYw8cauzxNHYfA+ALSdTx5NYNv3N/yAviHSg5vOaTbTTZHyvG:N2bB8BMxNHYfA+ALuTLNYFJyAvoNvOaz
- TLSH T19D836D42B162A8F6E9921132352886729BF75E700E36660FFB416D865DF50D3FA2F343
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detected Nirsoft tools
Free utilities often used by attackers which can steal passwords, product keys, etc.
-
NirSoft NirCmd
NirCmd is a lightweight Windows command-line tool for automating system tasks
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
66890
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
62KB
Virtual Size
62KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=4, id=64, version=9210,
count=12, id=28, version=9178,
count=2, id=25, version=9210,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=280, id=1, productName=Unmarked objects,
count=29, id=114, version=50727,
count=1, id=124, productName=VS2005 build 50727, version=50727,
count=1, id=120, productName=VS2005 build 50727, version=50727,