nyt_cli-x86_64-pc-windows-msvc.zip
- SHA256 96f405e5fd0ada549df9d898c7e4dec4a721e4b989e83c4688f469b79e511d76
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nyt_cli.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
nyt_cli.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target nyt_cli-x86_64-pc-windows-msvc.zip
- Size 1.2MB
- Sample261029-wfeylsdv4y
- SHA256 96f405e5fd0ada549df9d898c7e4dec4a721e4b989e83c4688f469b79e511d76
- MD5 218649501e4b52a554a670afe8847c19
- SHA1 09083958da3c937847e050a8263ac02078430ca6
- SHA512 8640f7d01f695b50c3ebbaaaae4be0bdd1c75845e19dd283bdf9163679eadf0fa1681a55e9d0f6d30e23674d75bde9338764ee1c107ef19ac2d92a1c17cd065d
- SSDEEP 24576:+JyuvezHlVSSd3yD/ujiA+RZfRiRbSqA8xCW7Dg/F0yEV2QQ+r30Gt:+EuGjTSSdCDRf5io7pWng/M2QQ4d
- TLSH T1A54533B57591734FE246C8E533E84062222E38FB63BA74757634FEE9946B3011674B32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nyt_cli.exe
File Explorer
-
nyt_cli-x86_64-pc-windows-msvc.zip.zip 1.2MB
-
.env.example12B
-
README.md478B
-
nyt_cli.exe.exe 2.8MB
.env.example
- SHA256 8da73c664e9b738b9e7b7dd678f0942ac376e5209d114fe0c5f232d45e299298
- MD5 3da13ebd4bb9caaee5c9d380f8870054
- SHA1 5965324641dfcd0228153728aa5c4ad04474e41d
- SHA512 d0213166618031bdc8463d1e5deb2d1573349b7724597a4fb2010eb692c3058e237d20a83a87bc07fa5daf1c19d61b82df2d3f2eb2278e2fba57b886bb6d7d32
- MD5 SHA1 SHA512
README.md
- SHA256 f6d56c917198e54a034a1956fafd30dbf914a1b6fe1be355b4e7f13a64b43c1b
- MD5 2502eebd88d5c5f872ff1e79697fdd3b
- SHA1 f91506427588895d8b4fd6fd2f7618b8e4031630
- SHA512 5c236279b3d004a24670954e2a13795c8a45f771d2439187548b7e8281a7d7fa744e21da6ec72f1953f809a58128160d1c74535a649a86214b2c91cd61923185
- TLSH T11AF00E6F069211BE02B13084806D30A5F12A80BE55B3ACB85079042C63245A1D3FF2E7
- MD5 SHA1 SHA512 TLSH
nyt_cli.exe
- IMPHASH 87f34f486da571623e5db7ab0ca435a7
- SHA256 385b9fe507cbf9741ece7b53ad8dae2920cb26ef0937b74e65d346005a64e5fa
- MD5 ec4caff89f7e4ce0cd6934c218142a4a
- SHA1 0b23a6797b0edf89a3809193c2615439743e11a2
- SHA512 f308dbfa82c1b58d4424e5d37ddbdfac7005b2597d0b24a37c70fb03dee8b70fdd47affafd7fcfc93a403968a74d8c2a9262b322b9a75517138c68628f67b188
- SSDEEP 49152:EfH+bIWWFEIbDNoVLT2QTmfN1rAfC8V6S9yV0a7Hv5l:E95xH1Ipa7Hv
- TLSH T1A3D528217B5A99FDC55AC074C3464AA21D6270CB0F35BAFF448896383E7AAF51E3C358
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
1858188
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
nyt_cli.pdb
kernel32
SetLastError
ReleaseMutex
CreateMutexA
SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileExW
FindClose
SetHandleInformation
GetCurrentProcessId
SetFileCompletionNotificationModes
GetModuleHandleA
GetCurrentThread
GetQueuedCompletionStatusEx
CreateIoCompletionPort
GetProcessHeap
GetFullPathNameW
LoadLibraryA
CancelIoEx
GetCurrentThreadId
GetFinalPathNameByHandleW
WaitForSingleObjectEx
GetCurrentProcess
WriteFile
SetFilePointerEx
ExitProcess
ReadFile
PostQueuedCompletionStatus
GetOverlappedResult
SwitchToThread
GetProcAddress
GetModuleHandleW
HeapReAlloc
FormatMessageW
GetLastError
WaitForSingleObject
CreateThread
SetNamedPipeHandleState
HeapAlloc
SetThreadStackGuarantee
CloseHandle
HeapFree
CreateFileW
GetSystemTimeAsFileTime
GetStartupInfoW
IsProcessorFeaturePresent
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetModuleFileNameW
TerminateProcess
GetModuleHandleExW
FindNextFileW
GetFileType
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
HeapSize
FlushFileBuffers
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetConsoleOutputCP
GetConsoleMode
GetStdHandle
WriteConsoleW
MultiByteToWideChar
QueryPerformanceFrequency
SetEnvironmentVariableW
GetEnvironmentVariableW
GetCurrentDirectoryW
AddVectoredExceptionHandler
LCMapStringW
CompareStringW
WideCharToMultiByte
lstrlenW
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
InitializeCriticalSectionEx
SetUnhandledExceptionFilter
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
RtlUnwindEx
GetCPInfo
GetOEMCP
RtlPcToFileHeader
RaiseException
EncodePointer
GetCommandLineW
EnterCriticalSection
GetACP
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
IsValidCodePage
GetCommandLineA
advapi32
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WakeByAddressAll
WakeByAddressSingle
WaitOnAddress
ws2_32
connect
getaddrinfo
shutdown
getsockopt
freeaddrinfo
recv
send
WSASend
WSAGetLastError
WSAIoctl
getsockname
getpeername
WSAStartup
closesocket
bind
setsockopt
ioctlsocket
WSASocketW
WSACleanup
ntdll
NtCancelIoFileEx
NtDeviceIoControlFile
NtWriteFile
NtCreateFile
NtReadFile
RtlNtStatusToDosError
crypt32
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertFreeCertificateChain
CertDuplicateStore
CertGetCertificateChain
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertOpenStore
CertEnumCertificatesInStore
secur32
DecryptMessage
DeleteSecurityContext
AcquireCredentialsHandleA
FreeCredentialsHandle
AcceptSecurityContext
ApplyControlToken
QueryContextAttributesW
FreeContextBuffer
InitializeSecurityContextW
EncryptMessage
Name
.text
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
828KB
Virtual Size
827KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
98KB
Virtual Size
98KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=141, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=41, id=261, version=35207,
count=3, id=257, version=33145,
count=173, id=1, productName=Unmarked objects,
count=352, productName=Unmarked objects (old),
count=1, id=258, version=35223,