nixware[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nixware.exe
Size

182KB
MD5

904a024c20f31b96886a1a81377ed8e0
SHA1

6c37d146df8ce99dd99f720e2597e82b8dac5f5a
SHA256

1402542d6c360607608d4848d314d6178b118fe89b2bc97453e94af1aaf8a315
SHA512

5aee2cf3bae522f859e22e4467083578f5d726accf242742a7c3c0c6e72f7740c3768b864da3539c5104e7255ed332380c4e07be172823fa4ca0d4487303c200
SSDEEP

3072:pwRfY3dl3BEcFpbZkytxQHwFE7qKfEbQZ4AxWqgejf2Xhk8MS+JbYAPxJhR6YPuu:pYfWnRbbZkWKIEBEMNYk8MFZJhshxhsO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nixware.exe

Files

nixware.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 177KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ