1231232f82h.zip
- SHA256 8288d94f7db9c1d99ec5bfc0ae206d28bc8489b8276d2b638ab50eafd65469f7
Behavioral task
behavioral1
Sample
Nezur.exe
Resource
win7-20240221-en
windows7-x64
13 signatures
150 seconds
General
- Target 1231232f82h.zip
- Size 4.4MB
- Sample240412-ct89tsce24
- SHA256 8288d94f7db9c1d99ec5bfc0ae206d28bc8489b8276d2b638ab50eafd65469f7
- MD5 55d74aa1e62a0d6672417427c63d9c14
- SHA1 a9cad5810a6491408bcbdc004933f54872fd189b
- SHA512 bfff4d71c7b839261b5eefa0ca767675d95caf2d3266cf2185bade8cb642d3baab1397d112a0a1ffb8363f8d8c8f9aec6a61b2be4de197c1978d72a824613358
- SSDEEP 98304:8ftBs1DsFffkdYryeFf58Gz73Kq5Celsd4bH35YH534L:8fvs1DsFf/pFRn7H5Cel/Ni3k
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Nezur.exe themida - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nezur.exe
File Explorer
-
1231232f82h.zip.zip 4.4MB
-
Nezur.exe.exe 4.6MB
Nezur.exe
- SHA256 42317a2bf653554d75fee360889868dca0d1fa4cd8db24dac5e616e4ea6208c3
- MD5 483bc175a855a89d93cb00577bbb7920
- SHA1 55b1ca916684328da9b004083189bf92ccd29138
- SHA512 3b186a5f644711634a331d7bf771cb7247a889fe65c3fc138de20cbb45f2f83bf060e6257444812d681015b8fddf1af03282a941ebd3019c5673a79cc1cc4ea7
- SSDEEP 98304:URkvYI8Xa9jB6TKw/h4z+sLDuOl/+ooXE9jwzb6G:USvUa9jwk+sew/+ooXE4
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8450136
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
Size
497KB
Virtual Size
1016KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
263KB
Virtual Size
626KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
23KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
15KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
1024B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
6.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=253, version=33218,
count=10, id=260, version=33218,
count=4, id=259, version=33218,
count=39, id=261, version=33218,
count=6, id=257, version=33218,
count=105, id=260, productName=VS2019 v16.6.2 build 28806, version=28806,
count=2, id=260, version=32532,
count=2, id=261, version=32532,
count=579, id=1, productName=Unmarked objects,
count=43, id=257, version=30795,
count=35, id=265, version=33521,
count=1, id=255, version=33521,
count=1, id=151,
count=1, id=258, version=33521,