D:\main\vs source\malware source\NullX\NullX\obj\Release\StopCPUThrottling.pdb
Static task
static1
Behavioral task
behavioral1
Sample
99be3637a06002cae0919848b6ad72659cb96347496e8424b507fb28bb1e7cdf.exe
Resource
win7-20240508-en
General
-
Target
99be3637a06002cae0919848b6ad72659cb96347496e8424b507fb28bb1e7cdf
-
Size
80KB
-
MD5
1e44243e26673b7fdc5f5d3c8049f89a
-
SHA1
3bd703515b2dee353c3fd7f4f7a878ea1e64b4f1
-
SHA256
99be3637a06002cae0919848b6ad72659cb96347496e8424b507fb28bb1e7cdf
-
SHA512
71a012ab94e54cbe44a2b7c3e90ea6f12ad1a09916fb339e9565fd23b80b7cddc96451016b91163ae4a32d2bdd93202d95e8c001db3348be80c01772d725e620
-
SSDEEP
1536:AWg0p2SFULbR8jLnnt/sArdzkot2XB/5kKTjSwEKBKhaJ:AWuijLttrdzQd5jTewEKBKE
Malware Config
Signatures
-
Detect binaries embedding considerable number of MFA browser extension IDs. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_Embedded_MFA_Browser_Extension_IDs -
Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99be3637a06002cae0919848b6ad72659cb96347496e8424b507fb28bb1e7cdf
Files
-
99be3637a06002cae0919848b6ad72659cb96347496e8424b507fb28bb1e7cdf.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 78KB - Virtual size: 77KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ