unpacked_Nenyooo v1[.]0[.]3028[.]0[.]8[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

unpacked_Nenyooo v1.0.3028.0.8.exe
Size

19.0MB
MD5

ade598460f664bdd2670c401eabb02db
SHA1

cc51b6ac12a5a1ca725751c3fa7b74d660797a11
SHA256

1c327251603244ab49706e3cd1de60dfece5242c53b861a85af52773cda9ae48
SHA512

79fd46331721b74019a708b8baf8d82cdcdf5ff4e07622bd0de7ac11ae9ec4fd2c032529958bdac033339fe5dbd05d29aa68e2ce8497bc5904e3e174c4205271
SSDEEP

393216:gdKgXi6JSWZce4+oDnz2pZf/ZTOaKNzA5RyytE:lGZce4+oDnzQZf/ZaaKWeym

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpacked_Nenyooo v1.0.3028.0.8.exe

Files

unpacked_Nenyooo v1.0.3028.0.8.exe
.exe windows:6 windows x64 arch:x64

e4a6bffc763cad5b422e0e10e563e1d5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

d3dcompiler_47

D3DCompile

gdi32

GetDeviceCaps

imm32

ImmSetCandidateWindow
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmAssociateContextEx

kernel32

GetModuleHandleA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
GetModuleHandleW
FreeLibrary
QueryPerformanceCounter
WriteProcessMemory
RtlAddFunctionTable
Sleep
VirtualProtectEx
VirtualAllocEx
ReadProcessMemory
CreateRemoteThread
VirtualFreeEx
GetExitCodeProcess
CloseHandle
AreFileApisANSI
CopyFileW
GetFileAttributesExW
WideCharToMultiByte
GetFileInformationByHandleEx
FindNextFileW
ReleaseSRWLockExclusive
FindFirstFileExW
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
FindFirstFileW
RtlCaptureContext
RtlLookupFunctionEntry
FindClose
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
CreateDirectoryW
GetLocaleInfoEx
FormatMessageA
GetLastError
GlobalUnlock
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
OpenProcess
IsWow64Process
GetCurrentProcess
LocalFree
GetFileInformationByHandle

msvcp140

?good@ios_base@std@@QEBA_NXZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
_Query_perf_frequency
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Query_perf_counter
?uncaught_exceptions@std@@YAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ

shell32

ShellExecuteW

user32

DispatchMessageW
GetAsyncKeyState
GetCursorPos
PeekMessageW
TranslateMessage
PostQuitMessage
UpdateWindow
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
GetKeyState
DestroyWindow
GetDC
SetWindowPos
MonitorFromWindow
EnumDisplayMonitors
FindWindowA
ShowWindow
GetActiveWindow
MessageBoxW
GetWindowRect
GetWindowThreadProcessId
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
ReleaseDC
SetCursorPos
IsIconic
CreateWindowExW
SetForegroundWindow
ReleaseCapture
SetProcessDPIAware
ScreenToClient
UnregisterClassW
SetWindowTextW
RegisterClassExW
WindowFromPoint
GetCapture
GetMonitorInfoW
ClientToScreen
IsChild
TrackMouseEvent
GetForegroundWindow
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
LoadCursorW
SetCapture
GetClientRect
SetCursor
SetWindowLongW

vcruntime140

memchr
memcmp
__std_exception_destroy
memcpy
memcpy
__std_exception_copy
__std_terminate
memset
_CxxThrowException
strstr
__current_exception_context
__current_exception
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

ucrtbase

strtol
_callnewh
free
malloc
_set_new_mode
realloc
_configthreadlocale
___lc_codepage_func
acosf
ldexp
powf
sin
__setusermatherr
ceilf
sqrtf
cosf
sinf
exit
_invalid_parameter_noinfo_noreturn
abort
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_Exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p__commode
_set_fmode
ftell
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsscanf
fread
__stdio_common_vsprintf
_wfopen
fwrite
fflush
fclose
fseek
strncmp
strncpy
strcmp
qsort

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

Sections

.text
Size: 391KB - Virtual size: 392KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 583KB - Virtual size: 588KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 8.2MB - Virtual size: 8.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 402KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.imports
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 402KB - Virtual size: 404KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.themida
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.boot
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 4KB

IMAGE_SCN_MEM_READ

.SCY
Size: 6KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

e4a6bffc763cad5b422e0e10e563e1d5

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

d3dcompiler_47

gdi32

imm32

kernel32

msvcp140

shell32

user32

vcruntime140

vcruntime140_1

ucrtbase

d3d11

dwmapi

Sections

.text Size: 391KB - Virtual size: 392KB

Size: 583KB - Virtual size: 588KB

Size: 8.2MB - Virtual size: 8.2MB

Size: 17KB - Virtual size: 20KB

Size: 402KB - Virtual size: 404KB

Size: 512B - Virtual size: 4KB

.imports Size: 1KB - Virtual size: 4KB

.tls Size: 512B - Virtual size: 4KB

.rsrc Size: 402KB - Virtual size: 404KB

.themida Size: 5.7MB - Virtual size: 5.7MB

.boot Size: 3.3MB - Virtual size: 3.3MB

.reloc Size: 512B - Virtual size: 4KB

.SCY Size: 6KB - Virtual size: 8KB

.text
Size: 391KB - Virtual size: 392KB

.imports
Size: 1KB - Virtual size: 4KB

.tls
Size: 512B - Virtual size: 4KB

.rsrc
Size: 402KB - Virtual size: 404KB

.themida
Size: 5.7MB - Virtual size: 5.7MB

.boot
Size: 3.3MB - Virtual size: 3.3MB

.reloc
Size: 512B - Virtual size: 4KB

.SCY
Size: 6KB - Virtual size: 8KB