nox_setup_v7[.]0[.]5[.]1_full_intl[.]exe

Resubmissions

08/01/2023, 14:52

230108-r8ytzahc5y 8

Sharing

Copy URL

Twitter E-mail

General

Target

nox_setup_v7.0.5.1_full_intl.exe
Size

569.1MB
MD5

17b0c3ad6e971c788c94ff242eddc920
SHA1

79493952f72cd1887460892d12ea18c0ee481280
SHA256

2a01624669c76bb80c6632abacef93c076d6ddae86278b20214b1f11b9858928
SHA512

a52ca0bde0593e46e4d99cc7f6e46c5814efaeb5bcef34b183be17233cbfdf6e4248a0d480c8565cd6df6fcd8aec4a1b9c3197209910b38f201dbc398a254973
SSDEEP

12582912:gVM1JGLfGzI1T3RhJ7WNFJAHI1FQNWhRrbYIRMSrh6gye:cM1JGLBTzJ7M0AQNeRr0eXB

Score

N/A

Malware Config

Signatures

Files

nox_setup_v7.0.5.1_full_intl.exe
.exe windows x86

c4b60f8dc5548768394711b778b675fa

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:81:4e:20:f9:63:d4:e7:ba:16:59:c4:da:c0:7b:e8
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

27/10/2022, 00:00

Not After

28/11/2023, 23:59

Subject

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8d:70:ac:72:af:d4:b5:fd:36:1f:a3:5b:57:8d:3f:8e:ea:3f:33:fe:e9:0d:f9:10:0d:53:22:26:f5:cc:d8:96
Signer

Actual PE Digest

8d:70:ac:72:af:d4:b5:fd:36:1f:a3:5b:57:8d:3f:8e:ea:3f:33:fe:e9:0d:f9:10:0d:53:22:26:f5:cc:d8:96

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

03/01/2023, 10:10
Valid: true

Chain 1

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetModuleHandleExA
GetCurrentThreadId
SetThreadPriority
GetPrivateProfileStringA
lstrcpynW
GlobalMemoryStatusEx
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
lstrcmpW
GetSystemDefaultLangID
GetVersion
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLCID
GetCommandLineW
GetEnvironmentVariableA
GetDriveTypeW
DecodePointer
SetUnhandledExceptionFilter
ExitProcess
GetLocalTime
LoadLibraryExW
SetEvent
ResetEvent
CreateEventW
CreateFileA
CompareFileTime
CreateDirectoryA
GetFileTime
SetFileAttributesA
GetModuleFileNameA
SetEndOfFile
QueueUserWorkItem
GetStartupInfoW
GetSystemInfo
GetACP
FormatMessageA
InitializeCriticalSectionEx
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryW
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetModuleHandleExW
SuspendThread
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
TryEnterCriticalSection
TerminateThread
CreateThread
GetCurrentProcessId
WaitForSingleObject
GetLastError
RemoveDirectoryW
ReadFile
GetVolumeInformationW
WriteConsoleW
CopyFileW
EnterCriticalSection
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
FlushFileBuffers
HeapSize
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetConsoleCP
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCommandLineA
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetFileAttributesExW
InterlockedFlushSList
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetStringTypeW
InitializeCriticalSection
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcatW
lstrcpyW
lstrcmpiW
lstrcmpiA
LeaveCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetLongPathNameW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
WideCharToMultiByte
WritePrivateProfileStructW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
DeleteFileW
lstrlenW
MulDiv
LocalFree
LocalAlloc
CloseHandle
WriteFile
SetFileAttributesW
CreateFileW
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
SizeofResource
LockResource
OpenProcess
GetExitCodeProcess
Sleep
CreatePipe
SetHandleInformation
OutputDebugStringW
DebugBreak
RemoveDirectoryA
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
GetFileSize
FindNextFileA
FindFirstFileA
DeleteFileA
SetCurrentDirectoryW
DosDateTimeToFileTime
GetCurrentProcess
DuplicateHandle
SetFileTime
SetFilePointer
GetFileType
GetCurrentDirectoryW
lstrlenA
lstrcpyA
lstrcpynA
GetTempPathW
GetDiskFreeSpaceExW
DeviceIoControl
SystemTimeToFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTime
GetVersionExW
MultiByteToWideChar
FindFirstFileExA
MoveFileExW
GetTickCount
FindFirstFileExW
CreateProcessW
LoadResource
FormatMessageW

user32

GetWindowRect
SendMessageW
GetDesktopWindow
ReleaseDC
GetDC
LoadStringW
FillRect
EnumDisplaySettingsW
GetClipboardData
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetAsyncKeyState
SetCapture
ReleaseCapture
SetCursor
GetCursorPos
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
IntersectRect
UnionRect
PtInRect
RegisterWindowMessageW
PostThreadMessageW
FindWindowW
GetMonitorInfoW
MonitorFromWindow
TrackMouseEvent
IsIconic
IsWindowEnabled
MapWindowPoints
wsprintfW
CopyRect
SetWindowPos
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
GetParent
FindWindowExW
GetWindowThreadProcessId
TranslateMessage
DispatchMessageW
PeekMessageW
AttachThreadInput
BringWindowToTop
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
MessageBoxW
CharNextW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
IsRectEmpty
CallWindowProcW
GetClassInfoExW
IsWindow
ShowWindow
SetFocus
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
SetWindowLongW
LoadCursorW
BeginPaint
EndPaint
InvalidateRect
DrawIcon
DrawTextW
LoadImageW
DrawIconEx
GetFocus
GetKeyState
GetClientRect
UpdateWindow
GetMessagePos
IsZoomed
EnableWindow
SetWindowRgn
ScreenToClient
OffsetRect
SetClassLongW
ChangeDisplaySettingsW
GetUserObjectInformationW
SystemParametersInfoW
GetWindow
GetProcessWindowStation

gdi32

SetViewportOrgEx
SetBkColor
MoveToEx
GetObjectA
SetTextColor
RoundRect
Rectangle
LineTo
SetBkMode
GetTextExtentPoint32W
GetCurrentObject
GetClipBox
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
CreateFontIndirectW
DeleteObject
CreatePatternBrush
CreateFontW
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
SelectObject
GetDIBits
GetDeviceCaps
DeleteDC
CreateCompatibleDC
BitBlt
GetStockObject
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreateRectRgnIndirect
SelectClipRgn
GdiSetBatchLimit
CreatePen
StretchBlt

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegEnumValueW
CreateWellKnownSid
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
OpenProcessToken
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
AllocateAndInitializeSid
FreeSid
GetLengthSid
SystemFunction036
RegCloseKey

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetMalloc
CommandLineToArgvW
Shell_NotifyIconW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHGetPathFromIDListW

ole32

CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoLoadLibrary
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

OleLoadPicture
SysAllocString
VarUI4FromStr
GetErrorInfo
VariantClear
VariantInit
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString

shlwapi

PathAppendW
PathCanonicalizeW
PathFindExtensionW
PathIsDirectoryW
PathIsRootW
PathMatchSpecW
SHRegGetUSValueA
PathRemoveExtensionW
PathRemoveFileSpecW
SHGetValueW
PathIsDirectoryEmptyW
PathAppendA
PathCombineA
PathFileExistsA
PathFindFileNameA
PathIsDirectoryA
StrCmpIW
StrStrIW
StrStrW
PathFileExistsW
PathRemoveFileSpecA
PathFindFileNameW
SHRegSetUSValueA
PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt
AlphaBlend

gdiplus

GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateBitmapFromHBITMAP
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipDrawString
GdipCreateFontFromDC
GdipDrawImageRectI
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipSetTextRenderingHint
GdipReleaseDC
GdipSetImageAttributesColorKeys
GdipGetPropertyItem
GdipCreateFontFromLogfontA
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipTranslateTextureTransform
GdipCreateTexture2I
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipClonePath
GdipCreatePath
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdiplusStartup
GdipFree
GdipAlloc
GdipGetPropertyItemSize

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

HttpQueryInfoW
InternetSetOptionW
InternetSetCookieA
InternetSetCookieW
InternetErrorDlg
InternetGetCookieW
InternetOpenA
InternetConnectW
InternetOpenUrlA
HttpOpenRequestW
HttpSendRequestA
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
gethostbyname
getnameinfo
bind
send
recv
socket
WSAGetLastError
shutdown

wldap32

ord147
ord133
ord79
ord142
ord301
ord127
ord27
ord26
ord118
ord167
ord41
ord208
ord216
ord14
ord46
ord219
ord145

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 700KB - Virtual size: 699KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 560.8MB - Virtual size: 560.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

c4b60f8dc5548768394711b778b675fa

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0c:81:4e:20:f9:63:d4:e7:ba:16:59:c4:da:c0:7b:e8Certificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

8d:70:ac:72:af:d4:b5:fd:36:1f:a3:5b:57:8d:3f:8e:ea:3f:33:fe:e9:0d:f9:10:0d:53:22:26:f5:cc:d8:96Signer

Signature Validations

Verification

03/01/2023, 10:10 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wininet

netapi32

iphlpapi

psapi

dbghelp

crypt32

winmm

bcrypt

ws2_32

wldap32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 700KB - Virtual size: 699KB

.data Size: 36KB - Virtual size: 75KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 560.8MB - Virtual size: 560.8MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0c:81:4e:20:f9:63:d4:e7:ba:16:59:c4:da:c0:7b:e8
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

8d:70:ac:72:af:d4:b5:fd:36:1f:a3:5b:57:8d:3f:8e:ea:3f:33:fe:e9:0d:f9:10:0d:53:22:26:f5:cc:d8:96
Signer

03/01/2023, 10:10
Valid: true

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 700KB - Virtual size: 699KB

.data
Size: 36KB - Virtual size: 75KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 560.8MB - Virtual size: 560.8MB