| File name: | nasm-2.16.03-installer-x64.exe |
| Full analysis: | https://app.any.run/tasks/fd67e2c8-9d99-418b-a9ec-3d7003b9ddd7 |
| Verdict: | Malicious activity |
| Analysis date: | May 03, 2024, 10:55:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive |
| MD5: | 4205B5973D293543E89C2069635117E3 |
| SHA1: | 1A67E9FE7605777A78096007600BFA1492AD0E9C |
| SHA256: | 657E1252676CFB26A008835C20A760F731C8E0414469A4ED0F83F0FB059CDD35 |
| SSDEEP: | 49152:wZWSBJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJR:wZWNwaT7lyT6mlLgBEJZIuoO2pS4BNWv |
MALICIOUS
Drops the executable file immediately after the start
- nasm-2.16.03-installer-x64.exe (PID: 3960)
SUSPICIOUS
Executable content was dropped or overwritten
- nasm-2.16.03-installer-x64.exe (PID: 3960)
INFO
Checks supported languages
- nasm-2.16.03-installer-x64.exe (PID: 3960)
Reads the computer name
- nasm-2.16.03-installer-x64.exe (PID: 3960)
Creates files or folders in the user directory
- nasm-2.16.03-installer-x64.exe (PID: 3960)
Create files in a temporary directory
- nasm-2.16.03-installer-x64.exe (PID: 3960)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (42.2) |
|---|---|---|
| .exe | | | Win64 Executable (generic) (37.3) |
| .dll | | | Win32 Dynamic Link Library (generic) (8.8) |
| .exe | | | Win32 Executable (generic) (6) |
| .exe | | | Generic Win/DOS Executable (2.7) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:07:20 00:00:00+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit, No debug |
| PEType: | PE32 |
| LinkerVersion: | 2.4 |
| CodeSize: | 40960 |
| InitializedDataSize: | 67584 |
| UninitializedDataSize: | 407552 |
| EntryPoint: | 0x4c30 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
32
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 3960 | "C:\Users\admin\AppData\Local\Temp\nasm-2.16.03-installer-x64.exe" | C:\Users\admin\AppData\Local\Temp\nasm-2.16.03-installer-x64.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
Total events
2 399
Read events
2 399
Write events
0
Delete events
0
Modification events
Executable files
5
Suspicious files
4
Text files
4
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\bin\NASM\ndisasm.exe | executable | |
MD5:43544DF799C5C503DC1D4D35F388825A | SHA256:CD57BE890F2D3D87189E67EB1C2537DE6B85DFC843461D7C0FDD437DC0F1270D | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\bin\NASM\LICENSE | text | |
MD5:90904486F8FBF1861CF42752E1A39EFE | SHA256:1563996C52E220E15EF2418E67D39488255AA8C28C89E617074D3AFE3EE329E0 | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\bin\NASM\nasm.exe | executable | |
MD5:7A564FD688AE791E69C360C1CF54AD61 | SHA256:A93276636266516421CC9B422F47476C21F7A2949F1AE251556B2F1D33A3BE04 | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Netwide Assembler 2.16.03\nasm.lnk | binary | |
MD5:D87858F44BCCFA134D92C7BBF79BEAB8 | SHA256:076F0759C820628424A4AA485941635E74E971A4C89B179F3879F1A0753DF3F7 | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Netwide Assembler 2.16.03\Uninstall.lnk | binary | |
MD5:ADF049D3A77909EEFC257FF6F0D69CAF | SHA256:A56EAF4D83815B2DA51003228440A616BEC0FCDB4827C45EC16A0DBE34EE9621 | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\bin\NASM\VSrules\nasm.README | text | |
MD5:F4FA66A649BA86DD88B65F3BE4F7EC3C | SHA256:0674377CFCF55A6C951A1EB60E960859D4247BE0E563C642C73C74DC806C0627 | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\Temp\nse35F8.tmp\StartMenu.dll | executable | |
MD5:AC238522827CFF2C921D83C76DEE76D4 | SHA256:95218C916FD8514CFD7FC234D44A5B0930CA5C1C8DD133E0AD18127CE5ED1D8A | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\bin\NASM\nasm.ico | image | |
MD5:E4017E050E3A359A898AA0E01364C6B9 | SHA256:C2FAB8B5C7CF43FB7E381AB39FBF625A30267646D9B6795034BFE3E610066C8D | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Netwide Assembler 2.16.03\Manual.lnk | binary | |
MD5:0A11AE4487758C8A036E691453A4B3D6 | SHA256:CE4184C671DA243C9BF2A7E605EB51D40DDA9E14AD9CE2D35FE9730888D711C6 | |||
| 3960 | nasm-2.16.03-installer-x64.exe | C:\Users\admin\AppData\Local\bin\NASM\Uninstall.exe | executable | |
MD5:5DAF94410F68F7EA5BEDA051C9F23054 | SHA256:E94531C8677F86373377E55F55BEFCA0C9BECD084F48571DB63A87AC154ED04F | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
0
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1088 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |