nixware[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

nixware.dll
Size

1.2MB
MD5

06a4487e282f616bd437d114fbcaa6fc
SHA1

8aaddaf50c6902649557b0af073b880ed0948aa7
SHA256

dab846f5258a1343181f5212bb8e6bc4a024983cdcacdc06cceb9257407338dd
SHA512

678951189bd33b353913d3a2800a1296d74c009a1eeb0604a983d4057d37bf9ec47f82ac2bede8e50bfb315adb9dcea09bba6e022fbe8417317b2bbb74ff6740
SSDEEP

24576:iwaBB6mymmi0ooYUSKQmJZlePUld4mY31u/nrTl0lCjc98ZjheIkEPli:5auFmmHqRKQmJ9/Y3i/SJ86Ck

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nixware.dll

Files

nixware.dll
.dll windows:6 windows x86 arch:x86

121a69848d2114a22892ed4a0946290a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\Users\User\Desktop\nixware\Debug\shonax fix.pdb

Imports

kernel32

CreateDirectoryA
GetPrivateProfileStringA
WritePrivateProfileStringA
GetModuleHandleW
GetProcAddress
GetStdHandle
SetStdHandle
Sleep
GetCurrentProcess
GetCurrentProcessId
AllocConsole
FreeConsole
AttachConsole
SetConsoleMode
ReadConsoleA
WriteConsoleA
K32GetModuleInformation
VirtualProtect
QueryPerformanceCounter
QueryPerformanceFrequency
GlobalAlloc
GetTickCount
GlobalLock
CreateThread
DisableThreadLibraryCalls
FreeLibraryAndExitThread
GetSystemTimeAsFileTime
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
CloseHandle
InitializeSListHead
MultiByteToWideChar
GlobalUnlock
GetModuleHandleA

user32

FindWindowA
CallWindowProcA
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
SetCursor
GetClientRect
GetKeyState
GetAsyncKeyState
FlashWindowEx
SetWindowLongA

msvcp140d

_Query_perf_frequency
?uncaught_exception@std@@YA_NXZ
??Bid@locale@std@@QAEIXZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QBE_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ
?width@ios_base@std@@QAE_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBEPADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXH@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IBE_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXPAPAD0PAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Xbad_alloc@std@@YAXXZ
??0_Lockit@std@@QAE@H@Z
?_Xbad_function_call@std@@YAXXZ
_Xtime_get_ticks
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
_Query_perf_counter
??1_Lockit@std@@QAE@XZ

imm32

ImmGetContext
ImmSetCompositionWindow

vcruntime140d

__std_type_info_destroy_list
_except_handler4_common
strchr
__std_exception_destroy
__std_exception_copy
_CxxThrowException
strstr
_purecall
memset
memmove
__std_terminate
memcpy
__CxxFrameHandler3

ucrtbased

__stdio_common_vsnprintf_s
strtoul
free
malloc
qsort
__acrt_iob_func
_wfopen
fclose
fflush
fread
fseek
ftell
fwrite
__stdio_common_vfprintf
__stdio_common_vsscanf
strncpy
isprint
toupper
ceil
strcpy_s
_fdtest
strncpy_s
_stricmp
realloc
strtod
strtol
strncmp
isspace
tolower
_get_stream_buffer_pointers
fgetc
fgetpos
fputc
fsetpos
_fseeki64
setvbuf
ungetc
_lock_file
_unlock_file
isdigit
_free_dbg
_malloc_dbg
_callnewh
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_cexit
_CrtDbgReportW
terminate
_except1
_initterm
_initterm_e
mbstowcs_s
__libm_sse2_atanf
__stdio_common_vsprintf_s
__stdio_common_vsprintf
atoi
atof
__libm_sse2_acosf
_CIfmod
_wassert
rand
__libm_sse2_sinf
__libm_sse2_cosf
__libm_sse2_powf
fminf
fmaxf
_CrtDbgReport
_invalid_parameter
__libm_sse2_pow

Sections

.text
Size: 641KB - Virtual size: 640KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 367KB - Virtual size: 367KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 136KB - Virtual size: 5.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.msvcjmc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

121a69848d2114a22892ed4a0946290a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140d

imm32

vcruntime140d

ucrtbased

Sections

.text Size: 641KB - Virtual size: 640KB

.rdata Size: 367KB - Virtual size: 367KB

.data Size: 136KB - Virtual size: 5.5MB

.msvcjmc Size: 4KB - Virtual size: 3KB

_RDATA Size: 1KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 42KB - Virtual size: 42KB

.text
Size: 641KB - Virtual size: 640KB

.rdata
Size: 367KB - Virtual size: 367KB

.data
Size: 136KB - Virtual size: 5.5MB

.msvcjmc
Size: 4KB - Virtual size: 3KB

_RDATA
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 42KB - Virtual size: 42KB