003808d2415136743bc334314142c64c871582d58636511d4aede152a034126d

Sharing

Copy URL

Twitter E-mail

General

Target

003808d2415136743bc334314142c64c871582d58636511d4aede152a034126d
Size

10.0MB
MD5

f955166b298f6db7d18872ec50ac100c
SHA1

48af3d89918a259bffcdc77d5adb8e13671f4a78
SHA256

003808d2415136743bc334314142c64c871582d58636511d4aede152a034126d
SHA512

508ef58bce6dca15b673b31f4ed71d96be2772c4d33c55d2f197cc5ac8024930363569197586ba6496ffbe28f8da283efdf4024e68f43836b171dc7219bce400
SSDEEP

196608:jbiIILEdIcCH9pz5FnqcwzUBwSko1Kmj1YvskWpJsPyYk0TFVPBbl:f5ILDjMzpSkos28skWEyATjPBbl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
003808d2415136743bc334314142c64c871582d58636511d4aede152a034126d

Files

003808d2415136743bc334314142c64c871582d58636511d4aede152a034126d
.exe windows:6 windows x86 arch:x86

095308d7b7e19697e8d43e81069c27d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\packingworkspace\1627039414740\appsInstall\apps\bin\OutPut\Nox\NoxPack.pdb

Imports

kernel32

TryEnterCriticalSection
DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetModuleHandleExA
GetCurrentThreadId
SetThreadPriority
GetPrivateProfileStringA
lstrcpynW
GlobalMemoryStatusEx
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
lstrcmpW
GetSystemDefaultLangID
GetVersion
GetUserDefaultLCID
GetCommandLineW
GetEnvironmentVariableA
GetDriveTypeW
DecodePointer
SetUnhandledExceptionFilter
ExitProcess
GetLocalTime
LoadLibraryExW
SetEvent
ResetEvent
CreateEventW
CreateFileA
CompareFileTime
CreateDirectoryA
GetFileTime
SetFileAttributesA
GetModuleFileNameA
SetEndOfFile
QueueUserWorkItem
GetStartupInfoW
GetSystemInfo
GetACP
FormatMessageA
InitializeCriticalSectionEx
SleepEx
VerSetConditionMask
QueryPerformanceFrequency
GetSystemDirectoryW
VerifyVersionInfoW
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetModuleHandleExW
TerminateThread
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
LeaveCriticalSection
CreateThread
GetCurrentProcessId
WaitForSingleObject
GetLastError
RemoveDirectoryW
ReadFile
GetVolumeInformationW
WriteConsoleW
GetModuleHandleW
InitializeCriticalSection
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindFirstFileExW
FindFirstFileExA
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
FlushFileBuffers
HeapSize
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetConsoleCP
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCommandLineA
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetFileAttributesExW
InterlockedFlushSList
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetStringTypeW
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcatW
lstrcpyW
lstrcmpiW
lstrcmpiA
OpenProcess
ConvertThreadToFiber
EnterCriticalSection
GetModuleFileNameW
GetTickCount
GetLongPathNameW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
WideCharToMultiByte
WritePrivateProfileStructW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
DeleteFileW
lstrlenW
MulDiv
LocalFree
LocalAlloc
CloseHandle
WriteFile
SetFileAttributesW
CreateFileW
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
SizeofResource
FreeResource
LockResource
LoadResource
GetExitCodeProcess
Sleep
CreatePipe
SetHandleInformation
OutputDebugStringW
DebugBreak
RemoveDirectoryA
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
GetFileSize
FindNextFileA
FindFirstFileA
DeleteFileA
SetCurrentDirectoryW
DosDateTimeToFileTime
GetCurrentProcess
DuplicateHandle
SetFileTime
SetFilePointer
GetFileType
GetCurrentDirectoryW
lstrlenA
lstrcpyA
lstrcpynA
GetTempPathW
GetDiskFreeSpaceExW
DeviceIoControl
SystemTimeToFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTime
GetVersionExW
MultiByteToWideChar
MoveFileExW
SetEnvironmentVariableW
CopyFileW
CreateProcessW
OutputDebugStringA
SuspendThread
FormatMessageW

user32

GetWindowRect
SendMessageW
GetDesktopWindow
ReleaseDC
GetDC
LoadStringW
FillRect
GetMonitorInfoW
EnumDisplaySettingsW
GetClipboardData
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetAsyncKeyState
SetCapture
ReleaseCapture
SetCursor
GetCursorPos
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
IntersectRect
UnionRect
PtInRect
RegisterWindowMessageW
PostThreadMessageW
FindWindowW
MonitorFromWindow
SystemParametersInfoW
TrackMouseEvent
IsIconic
IsWindowEnabled
wsprintfW
MapWindowPoints
CopyRect
SetWindowPos
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
GetParent
FindWindowExW
GetWindowThreadProcessId
TranslateMessage
DispatchMessageW
PeekMessageW
AttachThreadInput
BringWindowToTop
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
MessageBoxW
CharNextW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
IsRectEmpty
CallWindowProcW
GetClassInfoExW
IsWindow
ShowWindow
SetFocus
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
SetWindowLongW
LoadCursorW
BeginPaint
EndPaint
InvalidateRect
DrawIcon
DrawTextW
LoadImageW
DrawIconEx
GetFocus
GetKeyState
GetClientRect
UpdateWindow
GetMessagePos
IsZoomed
EnableWindow
SetWindowRgn
ScreenToClient
OffsetRect
ChangeDisplaySettingsW
GetProcessWindowStation
GetUserObjectInformationW
GetWindow
SetClassLongW

gdi32

SetViewportOrgEx
SetBkColor
MoveToEx
GetObjectA
SetTextColor
RoundRect
Rectangle
LineTo
SetBkMode
GetTextExtentPoint32W
GetCurrentObject
GetClipBox
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
CreateFontIndirectW
DeleteObject
CreatePatternBrush
CreateFontW
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
SelectObject
GetDIBits
GetDeviceCaps
DeleteDC
CreateCompatibleDC
BitBlt
GetStockObject
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreateRectRgnIndirect
SelectClipRgn
GdiSetBatchLimit
CreatePen
StretchBlt

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegDeleteValueW
RegCloseKey
RegCreateKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
OpenProcessToken
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
AllocateAndInitializeSid
FreeSid
GetLengthSid
CreateWellKnownSid

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetPathFromIDListW
CommandLineToArgvW
Shell_NotifyIconW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHGetMalloc

ole32

CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoLoadLibrary
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

OleLoadPicture
SysFreeString
VarUI4FromStr
GetErrorInfo
VariantClear
VariantInit
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysAllocString

shlwapi

SHRegSetUSValueA
PathAppendW
PathCanonicalizeW
PathFindExtensionW
PathIsDirectoryW
PathIsRootW
SHRegGetUSValueA
PathMatchSpecW
PathRemoveExtensionW
PathRemoveFileSpecW
SHGetValueW
PathIsDirectoryEmptyW
PathAppendA
PathCombineA
PathFileExistsA
PathFindFileNameA
PathIsDirectoryA
StrStrIW
StrStrW
PathFileExistsW
PathRemoveFileSpecA
PathFindFileNameW
StrCmpIW
PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt
AlphaBlend

gdiplus

GdipSetStringFormatFlags
GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDrawString
GdipCreateBitmapFromHBITMAP
GdipDeleteFont
GdipCreateFontFromDC
GdipDrawImageRectI
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipSetTextRenderingHint
GdipReleaseDC
GdipSetImageAttributesColorKeys
GdipGetPropertyItem
GdipCreateFontFromLogfontA
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipTranslateTextureTransform
GdipCreateTexture2I
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipClonePath
GdipCreatePath
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdiplusStartup
GdipFree
GdipAlloc
GdipGetPropertyItemSize

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

InternetReadFile
HttpQueryInfoW
InternetSetOptionW
InternetSetCookieA
InternetSetCookieW
InternetErrorDlg
InternetGetCookieW
InternetOpenA
InternetConnectW
InternetOpenUrlA
HttpOpenRequestW
HttpSendRequestA
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

bind
closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
gethostbyname
getnameinfo
send
recv
socket
WSAGetLastError
shutdown

wldap32

ord147
ord133
ord79
ord142
ord301
ord127
ord27
ord26
ord118
ord41
ord167
ord208
ord216
ord14
ord46
ord219
ord145

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 706KB - Virtual size: 706KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 448.0MB - Virtual size: 448.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

095308d7b7e19697e8d43e81069c27d4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wininet

netapi32

iphlpapi

psapi

dbghelp

crypt32

winmm

bcrypt

ws2_32

wldap32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 706KB - Virtual size: 706KB

.data Size: 36KB - Virtual size: 74KB

.gfids Size: 2KB - Virtual size: 2KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 448.0MB - Virtual size: 448.0MB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 706KB - Virtual size: 706KB

.data
Size: 36KB - Virtual size: 74KB

.gfids
Size: 2KB - Virtual size: 2KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 448.0MB - Virtual size: 448.0MB