novasys[.]exe | Triage

Sharing

General

Target

novasys.exe
Size

12.0MB
MD5

06567abd839e0162cc88f334626dce0d
SHA1

5652397d2f8e182b4d1b9f814f7ca89545c5f5d8
SHA256

3d2d80d5e634d625d73fb1f735c415399608c2ecb9156eaddee4055f48c323d5
SHA512

11ffbef85bbb42b5af840189f743f87fbcee79f48977a50fdd56f5902be50d29f20d51530799dd161339c04ccd482ad4e8d9fe26fe9d6ec6543ac5d1faf094ec
SSDEEP

24576:rEVSoOPeIZXtQlXsjdvkLTuUCPJM8PNtglWR5:oVSoOPQFsRdH/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
novasys.exe

Files

novasys.exe
.exe windows:4 windows x86 arch:x86

fe5db82acba4930d8b7ddc4dcab540b2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

pbvm80

ord137

kernel32

FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetCommandLineA
GetCPInfo
IsDBCSLeadByte
GetModuleHandleA
GetStartupInfoA
GetVersion
ExitProcess
GetACP
GetOEMCP
MultiByteToWideChar
WideCharToMultiByte
LCMapStringA
LCMapStringW
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
RtlUnwind
VirtualFree
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
HeapDestroy
HeapCreate
LoadLibraryA
WriteFile
GetStringTypeA
GetStringTypeW
HeapFree
HeapAlloc
VirtualAlloc
GetProcAddress

Sections

.text
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size:

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ