Behavioral task
behavioral1
Sample
Nenyooo v1.0.3028.0.9.exe
Resource
win7-20240215-en
General
-
Target
Nenyooo.zip
-
Size
18.7MB
-
MD5
749a8b11060b5a3d15077766dddc7734
-
SHA1
edf32c65c67d12ecdd2563207edbb9be02869372
-
SHA256
d5223bc2ccbe23eb2a4581904a96e486f9a27caab921fa27c3eb40db7f7cfd6a
-
SHA512
734be2acc42ce471d8afcd26bba8557ebe0db1fcad4933ac79f6acd2da63145bb8386e69987f9898c49c589dc72efe89f00efcc5a149be342be9952903ce95e8
-
SSDEEP
393216:lBvetXObpf8zZQo70vev43nU0K0pLfoYIa2f746wiVi+JrEhOe1M0vK:/vwXOtf8zT4k0K094a2f746wig+lEhOx
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Nenyooo v1.0.3028.0.9.exe themida -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nenyooo v1.0.3028.0.9.exe
Files
-
Nenyooo.zip.zip
-
Nenyooo v1.0.3028.0.9.exe.exe windows:6 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 209KB - Virtual size: 402KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Size: 208KB - Virtual size: 589KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 10.6MB - Virtual size: 10.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 9KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Size: 296B - Virtual size: 316B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.imports Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.themida Size: - Virtual size: 5.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.boot Size: 3.4MB - Virtual size: 3.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 16B - Virtual size: 4KB
IMAGE_SCN_MEM_READ
-
Nenyooo/Extra/Appearance/Barbie Barb.xml.xml
-
Nenyooo/Extra/Appearance/Barbie.xml.xml
-
Nenyooo/Extra/Maps/Aerial_Islands.xml
-
Nenyooo/Extra/Maps/Upside_Down_World.xml
-
Nenyooo/Extra/Object/Objects.ini
-
Nenyooo/Extra/Vehicle/All_Vehicle.ini
-
Nenyooo/Extra/Vehicle/XML/Birthday sex by Spine.xml.xml
-
Nenyooo/Extra/Vehicle/XML/Carrier Invader (by Spine).xml.xml
-
Nenyooo/Extra/Vehicle/XML/Rolling Destruction by Spine - Copy.xml.xml
-
Nenyooo/Extra/Vehicle/XML/Spinethetic-FuckT2Blimp.xml.xml
-
Nenyooo/Extra/Vehicle/XML/Spinethetic-HamburgersRevenge.xml.xml
-
Nenyooo/Extra/Vehicle/XML/Spinethetic-XmasSleighBoat.xml.xml
-
Nenyooo/Extra/Vehicle/XML/Spinethetic-ZombieSabreGT.xml.xml
-
Nenyooo/User Interface/Audio/Xmas.wav
-
Nenyooo/User Interface/Caching/lsc.dat.xml
-
Nenyooo/User Interface/Caching/lsc_wheels.dat.xml
-
Nenyooo/User Interface/Fonts/Option/Chalet London.ttf
-
Nenyooo/User Interface/Fonts/Option/Default.ttf
-
Nenyooo/User Interface/Fonts/Title/Chalet London.ttf
-
Nenyooo/User Interface/Fonts/Title/Default.ttf
-
Nenyooo/User Interface/Textures/Header.gif.gif
-
Nenyooo/User Interface/Textures/Header.png.png
-
Nenyooo/User Interface/Textures/Options.png.png
-
Nenyooo/User Interface/Textures/Right Arrow.png.png