nxhwid_show[.]exe | Triage™

General

Target
nxhwid_show.exe
Size 151KB
Sample260930-sj2p1abb65
SHA256 4d06d92a1232ef5de7c89ccce93c79d2dc4fee5c724869abacba1ac462b536f1
MD5 da821a9eb342437f943687fb077cd40b
SHA1 39cd7707471a96f7f53b351c6b74f28ef6a12ddc
SHA512 ce191b4af75294ca845a28d2275a71a397ea7b9c0ad046a1216622dbfeeac3da674a4689b33a155ca79811da2e849029128d72fad14a039141f2b5e4453b7652
SSDEEP 3072:7tvtEmPoy66JZ0Lsa2gFFKoQHi6Cwi+cAxwFjeg:9Poy66JZkl2g3Yi34ud
TLSH
T1DAE36C5BB3E531F9E177823889924646F7B6783617208BEF07A443752F236D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nxhwid_show.exe

File Explorer

nxhwid_show.exe

.exe 151KB

nxhwid_show.exe

IMPHASH 9007c2c94d26f56e40760b27511d1c79
SHA256 4d06d92a1232ef5de7c89ccce93c79d2dc4fee5c724869abacba1ac462b536f1
MD5 da821a9eb342437f943687fb077cd40b
SHA1 39cd7707471a96f7f53b351c6b74f28ef6a12ddc
SHA512 ce191b4af75294ca845a28d2275a71a397ea7b9c0ad046a1216622dbfeeac3da674a4689b33a155ca79811da2e849029128d72fad14a039141f2b5e4453b7652
SSDEEP 3072:7tvtEmPoy66JZ0Lsa2gFFKoQHi6Cwi+cAxwFjeg:9Poy66JZkl2g3Yi34ud
TLSH
T1DAE36C5BB3E531F9E177823889924646F7B6783617208BEF07A443752F236D09D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey

iphlpapi

GetAdaptersInfo

kernel32

GetVolumeInformationA GetWindowsDirectoryA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW WriteConsoleW CreateFileW CloseHandle HeapReAlloc HeapSize GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx

ntdll

RtlCaptureContext RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nxhwid_show.exe

advapi32

iphlpapi

kernel32

ntdll

generic