Windows Analysis Report
client32.exe

Overview

General Information

Sample name: client32.exe
Analysis ID: 1427727
MD5: aca274219070da800e92a8cae61235bc
SHA1: 7347b65bb6eaf0931220bb201c39a66206f0d2c4
SHA256: 21903b51f23f7af681a9f69aa066753b202af6c537b97a247d98cfbdec150d63
Infos:

Detection

NetSupport RAT
Score: 48
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Program does not show much activity (idle)
Uses 32bit PE files
Yara detected NetSupport remote tool

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: client32.exe ReversingLabs: Detection: 29%
Source: client32.exe Virustotal: Detection: 22% Perma Link
Uses 32bit PE files
Source: client32.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: client32.exe Static PE information: certificate valid
Source: client32.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: E:\nsmsrc\nsm\1250\1250\client32\release_unicode\client32.pdb source: client32.exe
Source: client32.exe String found in binary or memory: http://crl.globalsign.com/gs/gscodesignsha2g2.crl0
Source: client32.exe String found in binary or memory: http://crl.globalsign.net/root-r3.crl0
Source: client32.exe String found in binary or memory: http://ocsp2.globalsign.com/gscodesignsha2g20
Source: client32.exe String found in binary or memory: http://secure.globalsign.com/cacert/gscodesignsha2g2.crt08
Source: client32.exe String found in binary or memory: https://www.globalsign.com/repository/0
Source: client32.exe String found in binary or memory: https://www.globalsign.com/repository/06
Uses 32bit PE files
Source: client32.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: classification engine Classification label: mal48.winEXE@1/0@0/0
Source: client32.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\client32.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: client32.exe ReversingLabs: Detection: 29%
Source: client32.exe Virustotal: Detection: 22%
Source: C:\Users\user\Desktop\client32.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\client32.exe Section loaded: pcicl32.dll Jump to behavior
Source: client32.exe Static PE information: certificate valid
Source: client32.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: client32.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: E:\nsmsrc\nsm\1250\1250\client32\release_unicode\client32.pdb source: client32.exe
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Program does not show much activity (idle)
Source: all processes Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected
Yara detected NetSupport remote tool
Source: Yara match File source: client32.exe, type: SAMPLE
Source: Yara match File source: 0.2.client32.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.0.client32.exe.810000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.3259078963.0000000000812000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000000.2010301615.0000000000812000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: client32.exe PID: 3380, type: MEMORYSTR
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1427727 Sample: client32.exe Startdate: 18/04/2024 Architecture: WINDOWS Score: 48 7 Multi AV Scanner detection for submitted file 2->7 5 client32.exe 2->5         started        process3
⊘No contacted IP infos