NyrexLol.zip
- SHA256 242da22e6e982c67bbf815f07f37e34d65f5cb10fb75aa421c3f63cddb5ba3ea
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7af723qerasfjh.exe
Resource
win11-20240419-en
windows11-21h2-x64
13 signatures
150 seconds
General
- Target NyrexLol.zip
- Size 18.3MB
- Sample240512-fe1wpace79
- SHA256 242da22e6e982c67bbf815f07f37e34d65f5cb10fb75aa421c3f63cddb5ba3ea
- MD5 c6a0b8ad55d1d6ccee742c129350ea05
- SHA1 b1739cc111a082e8193d05d09283965a0da6bb12
- SHA512 27910a8570884f2f8bd3bde0dc29b8e68eb5334d056bf6b7cdefdf2320066b598512e3076f705475195176925a4a601306a6ffacf67f2a8f1f9a60b38fbe533f
- SSDEEP 393216:VIVp3hZ16xM+FD+lg6S01MoPaGwMbJ6unbJtICPuUZyRcFayqLD:VIVB/1BBgJ0eOaxMbVlNu6yRl
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/7af723qerasfjh.exe
File Explorer
-
NyrexLol.zip.zip 18.3MB
-
7af723qerasfjh.exe.exe 19.9MB
7af723qerasfjh.exe
- IMPHASH 9e953f7bfc321fc82ab5086f36a135f3
- SHA256 064a251ebc40196671442bb37f305de56bfab684bf7e6a83fa7dd9cfc2d22b61
- MD5 743f1aa0734107e337b832d0d4282639
- SHA1 b93375432422e325761dee489f43a30146b5938a
- SHA512 cd23c77faa8a6ea8db2322255afa40e503bcb436c2f184ff932fafef3ef086246e3b0694018885f2e48b7f4fd7f7d107f8c22b1ccf474a02937313d8363c03d5
- SSDEEP 393216:ASk1BFNPOs9enOfC4g+DooHmoiUZJW07/c7T+SekU1lm+Ky9v:InvPnZC/+UIm/UZrzJe+Nl
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
35535914
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
ntdll
VerSetConditionMask
urlmon
URLDownloadToFileW
normaliz
IdnToAscii
wldap32
ord217
crypt32
CertFreeCertificateChain
ws2_32
recvfrom
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memcpy
api-ms-win-crt-stdio-l1-1-0
fopen
api-ms-win-crt-heap-l1-1-0
malloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
rename
api-ms-win-crt-string-l1-1-0
tolower
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
Virtual Size
458KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
9.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.n2Q
Size
Virtual Size
11.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.LHf
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.Koc
Size
19.9MB
Virtual Size
19.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
292B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ