nc.exe
First submission 2024-10-16 20:04:02
File details
| File type: | PE32 executable (console) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1628.5 KB (1667584 bytes) |
| Compile time: | 2011-06-30 22:47:55 |
| MD5: | 7e0df5efd2adfc7feefebe42c3a18d02 |
| SHA1: | e52433b84341f1bec29dc818b48132c045311a1f |
| SHA256: | 5e107ea10383110bd801fb7de11f59ee35f02b8e1defcadf34c0e3e769df9341 |
| Import Hash : | 6eefd92bffbfb27f378b81c09ca96786 |
| Sections 6 | .text .rdata .data .idata .rsrc .reloc |
| Directories 3 | import resource relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 44/77 VT report date: 2024-10-16 13:02:17 |
| Malware Type 3 | trojan hacktool pua |
| Threat Type 3 | netcat ncat hktl |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://154.216.20.170/nc.exe  |
154.216.20.170 |
2024-10-16 20:04:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x134804 | 1264128 | 6a3db773a33cfcccf48d1111993276cc7b0c8f34 | 20685f2ce1d981d5a3062e31151503f1 | |
| .rdata | 0x136000 | 0x496db | 301056 | e8ee20d211570a015bfe2cadfc7fe4aa0e42b05c | 0692b9a6ecb4f2810220ce7843b0334d | |
| .data | 0x180000 | 0xf6a4 | 40448 | 57ecfb1ed6965795d8b6b6816de3a326fee76686 | 4a7736628b37e67c489a713b0d6320bb | |
| .idata | 0x190000 | 0x15ad | 5632 | 078dfe37840d361d9cada49a04c992534c4a0e16 | 7e873300c6def650e547a9062f389cf7 | |
| .rsrc | 0x192000 | 0x459 | 1536 | 97b9669566ea531206c52419e126e1e2020849c0 | 9e743de7baf937fdbccd843a20b76b51 | |
| .reloc | 0x193000 | 0xd196 | 53760 | 16d9c5d0647881f34c265e8478246c93ca622a21 | b0f070bb5b968636ac11806e53a8f143 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x192170 | 406 |
Packers detected 2
| Microsoft Visual C++ 8 |
| VC8 -> Microsoft Corporation |
Anti debug functions 5
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| Bochs & QEmu CPUID Trick |
Strings analysis - File found
| Library |
| ADVAPI32.dll |
| WUSER32.DLL |
| KERNEL32.dll |
| mscoree.dll |
| WS2_32.dll |
| GDI32.dll |
| USER32.dll |
| %s.dll |
| NETAPI32.dll |
Strings analysis - Possible URLs found 3
| http://nmap.org/ncat/. |
| http://nmap.org/ncat |
| http://www.openssl.org/support/faq.html |