Static task
static1
Behavioral task
behavioral1
Sample
nos.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
nos.exe
Resource
win10v2004-20230915-en
General
-
Target
nos.exe
-
Size
18KB
-
MD5
c763bf0b7d716116ba64fb78aef4af77
-
SHA1
f388dd5bb3007b93702c2c94187cca13d29535f1
-
SHA256
d1aa66a0994cf6071f9558b1a466f3122fc39a6cd1548c79702374c9d931a0c3
-
SHA512
1f7e44e8f9ee1616db65ac2cdfb881fb58ab63038dec208228436e7e09ed3bfe8e9dcb7bc8e699b9c051d641c7e5f67738f6daac5e3f9bdbec6c68f2e4456cab
-
SSDEEP
384:p3ZaAxPydXQHUGHJEV3ZH6IHsxCXAZIb3:pIWPvH1pIpHTHsxCQZU3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource nos.exe
Files
-
nos.exe.exe windows:6 windows x64
4154ff19d2a43c50a9bce4e9cc766f79
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
RemoveVectoredExceptionHandler
TerminateProcess
InitializeProcThreadAttributeList
GetModuleHandleA
OpenProcess
CreateToolhelp32Snapshot
GetLastError
UpdateProcThreadAttribute
Process32NextW
GetCurrentThread
Process32FirstW
CloseHandle
HeapAlloc
AddVectoredExceptionHandler
ReadProcessMemory
GetProcessHeap
CreateProcessA
RtlLookupFunctionEntry
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
ntdll
NtAllocateVirtualMemory
NtCreateThreadEx
NtProtectVirtualMemory
vcruntime140
__C_specific_handler
wcsstr
__current_exception
__current_exception_context
memset
memcpy
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
getchar
puts
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-string-l1-1-0
_stricmp
api-ms-win-crt-runtime-l1-1-0
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_exit
exit
_get_initial_narrow_environment
__p___argv
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_initterm_e
_initialize_onexit_table
__p___argc
_seh_filter_exe
_initterm
_initialize_narrow_environment
_configure_narrow_argv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 1024B - Virtual size: 612B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ