Static task
static1
General
-
Target
Nezur.exe
-
Size
24.8MB
-
MD5
dfffaa411cf8d698f9e4926b9db7f6ce
-
SHA1
740efbb4e15f48a5c5572a84927aea173e39f6f9
-
SHA256
6673bf86a2752df63fcbb31ce802b55a3c60a5e46271e3d0b7fe179edd6870ca
-
SHA512
95db90d7461175b98d2690214802cbddf615255939784125927dd4e035fb57d5f139ddbe04eef596a6815239c8a3ccf2539995add162b1622465db13f1d2ce00
-
SSDEEP
786432:Kb92KSyt/y5keOCJ2zYuuIuAWOQAYimipVQpd6:KYKSI65qrY/IFWOJYim2Qy
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Nezur.exe
Files
-
Nezur.exe.exe windows:6 windows x64 arch:x64
58f6d826d88f7604cd7bf4f7213d1411
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress
user32
GetWindowRect
gdi32
CreateSolidBrush
advapi32
CopySid
shell32
SHGetFolderPathW
msvcp140
_Query_perf_counter
d3d11
D3D11CreateDeviceAndSwapChain
ntdll
RtlLookupFunctionEntry
dbghelp
ImageRvaToVa
d3dx11_43
D3DX11CreateShaderResourceViewFromMemory
imm32
ImmReleaseContext
d3dcompiler_43
D3DCompile
dwmapi
DwmExtendFrameIntoClientArea
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fgetc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-filesystem-l1-1-0
_stat64
api-ms-win-crt-convert-l1-1-0
strtof
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
ws2_32
WSAIoctl
normaliz
IdnToAscii
crypt32
CertEnumCertificatesInStore
wldap32
ord217
Sections
.text Size: - Virtual size: 991KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 236KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1008KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.Z){ Size: - Virtual size: 16.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ps* Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.T_3 Size: 24.7MB - Virtual size: 24.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 176KB - Virtual size: 176KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ