nxlog[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nxlog.exe
Size

58KB
MD5

e163f3bd18113ce9e607ddbe5afd6814
SHA1

48ddb51299773918137f37ba4b868bf756a9f2b1
SHA256

1855dff9ebf35ca9aa7debb7e7fdfe233812c521abf8824b3cdeeacc1c20c519
SHA512

4fb1e63c1ffa175cc5ce8ca2547429c97ec54077d47a25552a2ed7df3705da7bd30fe9b7e81d33ad8669e4c70c20accbb0fa931fdc0096592a3a01a50eaad843
SSDEEP

768:ZB2R77+vgKc7IbcUBSIRMbAk6Fv+30haJmfBoOYI8xh6EbVZxcCS3YZdT0s+c+9H:yuIPcSjMk6B+30hacfB7Sh6ET6RLnXx

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nxlog.exe

Files

nxlog.exe
.exe windows:4 windows x86 arch:x86

6f411a4bbbcaaa97d786867c1f7eaa91

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED

Imports

libnx-0

_nx_conf_error
_nx_panic
nx_api_declarations_core_funcs
nx_api_declarations_core_procs
nx_assertion_failed
nx_cfg_get_boolean
nx_cfg_get_value
nx_cfg_open_file
nx_cfg_parse
nx_config_cache_free
nx_config_cache_read
nx_config_cache_write
nx_ctx_get
nx_event_free
nx_event_next
nx_event_process
nx_event_to_jobqueue
nx_event_type_to_string
nx_exception_init
nx_exception_rethrow
nx_expr_func_lookup
nx_expr_func_register
nx_expr_proc_lookup
nx_expr_proc_register
nx_get_context_key
nx_get_exception_context
nx_init_context
nx_lock
nx_log
nx_log_aprerror
nx_log_exception
nx_logger_disable_foreground
nx_logger_mutex_set
nx_logqueue_from_file
nx_logqueue_init
nx_logqueue_new
nx_logqueue_size
nx_logqueue_to_file
nx_module_config
nx_module_data_available
nx_module_get_status
nx_module_init
nx_module_input_func_binaryreader
nx_module_input_func_dgramreader
nx_module_input_func_linereader
nx_module_input_func_register
nx_module_output_func_binarywriter
nx_module_output_func_dgramwriter
nx_module_output_func_linewriter
nx_module_output_func_register
nx_module_shutdown
nx_module_shutdown_self
nx_module_start
nx_module_status_to_string
nx_module_stop
nx_module_stop_self
nx_module_type_to_string
nx_pool_create_child
nx_pool_create_core
nx_string_append
nx_string_free
nx_string_new
nx_string_sprintf_append
nx_unlock
nxlog_get
nxlog_set
strcasecmp
nx_api_declarations_core_funcs
nx_api_declarations_core_funcs
nx_api_declarations_core_funcs
nx_api_declarations_core_funcs
nx_api_declarations_core_funcs
nx_api_declarations_core_funcs
nx_api_declarations_core_procs
nx_api_declarations_core_procs
nx_api_declarations_core_procs
nx_api_declarations_core_procs
nx_api_declarations_core_procs

advapi32

CloseServiceHandle
ControlService
CreateServiceA
DeleteService
OpenSCManagerA
OpenServiceA
QueryServiceStatus
RegCloseKey
RegOpenKeyA
RegQueryValueExA
RegisterServiceCtrlHandlerA
SetServiceStatus
StartServiceA
StartServiceCtrlDispatcherA

libapr-1-0

apr_app_initialize
apr_array_make
apr_array_push
apr_atomic_read32
apr_atomic_set32
apr_atomic_sub32
apr_cpystrn
apr_dso_error
apr_dso_load
apr_dso_sym
apr_file_close
apr_file_open
apr_file_printf
apr_filepath_set
apr_getopt_init
apr_getopt_long
apr_hash_make
apr_os_thread_current
apr_palloc
apr_pool_destroy
apr_psprintf
apr_pstrdup
apr_sleep
apr_snprintf
apr_strerror
apr_terminate
apr_thread_cond_broadcast
apr_thread_cond_create
apr_thread_cond_destroy
apr_thread_cond_signal
apr_thread_cond_timedwait
apr_thread_cond_wait
apr_thread_create
apr_thread_exit
apr_thread_mutex_create
apr_thread_mutex_destroy
apr_thread_mutex_lock
apr_thread_mutex_unlock
apr_threadkey_private_set
apr_time_now

kernel32

AddAtomA
ExitProcess
FindAtomA
GetAtomNameA
GetConsoleDisplayMode
GetLastError
SetUnhandledExceptionFilter
Sleep
VirtualProtect
VirtualQuery

msvcrt

_getpid
__getmainargs
__p__environ
__p__fmode
__set_app_type
_assert
_cexit
_iob
_onexit
_setjmp
_setmode
abort
atexit
atoi
exit
free
fwrite
isspace
longjmp
malloc
memcpy
memset
printf
signal
sscanf
strcmp
strlen
strncmp
vfprintf

Sections

.text
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 404B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

6f411a4bbbcaaa97d786867c1f7eaa91

Headers

File Characteristics

Imports

libnx-0

advapi32

libapr-1-0

kernel32

msvcrt

Sections

.text Size: 41KB - Virtual size: 41KB

.data Size: 512B - Virtual size: 172B

.rdata Size: 9KB - Virtual size: 9KB

.bss Size: - Virtual size: 404B

.idata Size: 5KB - Virtual size: 5KB

.text
Size: 41KB - Virtual size: 41KB

.data
Size: 512B - Virtual size: 172B

.rdata
Size: 9KB - Virtual size: 9KB

.bss
Size: - Virtual size: 404B

.idata
Size: 5KB - Virtual size: 5KB