nu[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

nu.exe
Size

26.9MB
MD5

b7ea0d87ccb894b6db357c27c12367ff
SHA1

03103eaaa8ea1ae12b994968a9cf347166eb5f8c
SHA256

69537f1d56bfd07e51b4cbd37f628cee5edc10e9bbea979e7e0a4ccc0c15aaf8
SHA512

7b2508d026b2bad4418603103575b85cf85ddffc8f42b18dd355c16d4b5e8c4fa0c16c3bd740fa5834d8ed3db374a5f355e682c0568a22cdc0d8d0ee1faf3c51
SSDEEP

393216:B9ETOgWdDMKBGxyi/JKoJ7JTJuntbHsf:B0Og0oxyKJKoJ7JTsbMf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nu.exe

Files

nu.exe
.exe windows:6 windows x64 arch:x64

56c5d1c85ad00b712a68cd0fc105559d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

ToUnicodeEx
RegisterClipboardFormatW
GetKeyboardLayout
EmptyClipboard
IsClipboardFormatAvailable
SetClipboardData
GetForegroundWindow
CloseClipboard
GetWindowThreadProcessId
GetClipboardData
OpenClipboard

kernel32

SetConsoleTextAttribute
ReleaseSemaphore
GetTimeZoneInformation
FormatMessageW
WideCharToMultiByte
TryAcquireSRWLockExclusive
GetFileInformationByHandle
SetFileTime
IsValidCodePage
SetConsoleMode
FindClose
WakeConditionVariable
SwitchToThread
GetConsoleMode
GetStdHandle
GetCPInfo
GetCurrentThread
SetEnvironmentVariableW
SetStdHandle
MultiByteToWideChar
GlobalFree
GetStringTypeW
LocalAlloc
GlobalAlloc
LocalFree
GetTimeZoneInformationForYear
AcquireSRWLockExclusive
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SetNamedPipeHandleState
ReleaseSRWLockExclusive
ReleaseMutex
lstrlenW
ReadFile
WriteFile
DisconnectNamedPipe
FlushFileBuffers
CreateNamedPipeW
GetCurrentProcess
GetProcAddress
ConnectNamedPipe
GetBinaryTypeW
GetACP
GetOEMCP
AcquireSRWLockShared
CreateSemaphoreW
CancelIo
ReadDirectoryChangesW
WaitForSingleObject
CreateSemaphoreA
SetConsoleCtrlHandler
FreeEnvironmentStringsW
ExpandEnvironmentStringsW
GetCompressedFileSizeW
CloseHandle
CreateMutexA
WakeAllConditionVariable
GetCurrentProcessId
LoadLibraryA
FindFirstFileW
GetTickCount64
GetCurrentThreadId
SleepConditionVariableSRW
GetProcessId
WaitForSingleObjectEx
GlobalUnlock
K32EnumProcesses
CreateToolhelp32Snapshot
Process32First
Process32Next
GetPriorityClass
ReadProcessMemory
OpenProcess
GetProcessTimes
VirtualQueryEx
GetProcessIoCounters
GlobalSize
GetFullPathNameW
CreatePipe
Sleep
GetModuleHandleA
GetNativeSystemInfo
VerSetConditionMask
VerifyVersionInfoW
GetSystemDirectoryW
GetComputerNameExW
LCMapStringW
CreateConsoleScreenBuffer
LoadLibraryW
FreeLibrary
GetSystemInfo
UnlockFile
LockFileEx
ReleaseSRWLockShared
GetFileInformationByHandleEx
ReadConsoleInputW
FlsGetValue
GetCommandLineA
GetModuleHandleExW
GetNumberOfConsoleInputEvents
SetConsoleCursorInfo
GetConsoleCursorInfo
FreeLibraryAndExitThread
ExitThread
LoadLibraryExW
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
SetFilePointerEx
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
RtlPcToFileHeader
RtlUnwindEx
SetHandleInformation
WriteFileEx
SleepEx
GetOverlappedResult
GetExitCodeProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetStartupInfoW
FindNextFileW
IsDebuggerPresent
InitializeSListHead
CreateDirectoryW
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
SetFileAttributesW
GetFinalPathNameByHandleW
CopyFileExW
GetFileType
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
GetModuleHandleW
GetModuleFileNameW
SetCurrentDirectoryW
ExitProcess
ReadFileEx
CreateEventW
GetWindowsDirectoryW
CreateProcessW
DeleteProcThreadAttributeList
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
WriteConsoleW
ReadConsoleW
CreateThread
GetSystemTimeAsFileTime
GetTempPathW
UnhandledExceptionFilter
SetConsoleActiveScreenBuffer
CreateFileW
FillConsoleOutputAttribute
GetUserPreferredUILanguages
GetProcessHeap
HeapFree
GetSystemTimes
HeapAlloc
WaitForMultipleObjects
GlobalLock
GetConsoleOutputCP
FillConsoleOutputCharacterA
DeleteCriticalSection
CreateEventA
TryEnterCriticalSection
LeaveCriticalSection
RegisterWaitForSingleObject
EnterCriticalSection
InitializeCriticalSection
RaiseException
AreFileApisANSI
HeapCreate
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetDiskFreeSpaceW
FindFirstFileExW
GetFileSizeEx
FindFirstVolumeW
FindNextVolumeW
FindVolumeClose
GetDriveTypeW
GetVolumeInformationW
GetVolumePathNamesForVolumeNameW
GetDiskFreeSpaceExW
OutputDebugStringA
LockFile
SetFilePointer
SetEndOfFile
UnlockFileEx
CreateMutexW
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
DeleteFileA
HeapReAlloc
HeapCompact
SetConsoleCursorPosition
GetConsoleScreenBufferInfo
GetLastError
HeapDestroy
GetFileSize
LoadLibraryExA
CompareStringW
GetEnvironmentVariableA
GetFullPathNameA
FlsAlloc
FlsSetValue
FlsFree
GetCurrentProcessorNumber
VirtualAlloc
VirtualFree
VirtualQuery
GetLargePageMinimum
GetNumaHighestNodeNumber
DeviceIoControl
GetNumaNodeProcessorMask
WriteConsoleA
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
SystemTimeToFileTime

advapi32

LookupPrivilegeValueA
GetUserNameW
GetLengthSid
RegCloseKey
RegEnumValueW
LookupAccountSidW
AdjustTokenPrivileges
LookupPrivilegeValueW
RegOpenKeyExW
RegQueryValueExW
GetTokenInformation
OpenProcessToken
InitializeSecurityDescriptor
SetSecurityDescriptorGroup
FreeSid
SetSecurityDescriptorControl
GetSecurityDescriptorControl
SetSecurityDescriptorOwner
AddAce
GetAce
InitializeAcl
GetAclInformation
CopySid
GetSidLengthRequired
GetSidSubAuthorityCount
IsValidSid
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
GetSecurityDescriptorGroup
ImpersonateAnonymousToken
GetSecurityDescriptorOwner
RevertToSelf
GetSecurityDescriptorSacl
GetSecurityDescriptorDacl
SystemFunction036

shell32

SHGetKnownFolderPath
SHCreateItemFromParsingName
CommandLineToArgvW

ole32

CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoInitializeEx

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertDuplicateStore
CertCloseStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore

ws2_32

WSARecv
WSASend
ioctlsocket
WSAGetLastError
freeaddrinfo
WSAStartup
send
WSADuplicateSocketW
closesocket
WSASocketW
getaddrinfo
connect
select
getsockopt
getpeername
recv
getsockname
listen
WSACleanup
setsockopt
bind

ntdll

NtWriteFile
NtReadFile
NtQueryInformationProcess
RtlGetVersion
RtlNtStatusToDosError
NtCreateFile
NtQuerySystemInformation

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

secur32

QueryContextAttributesW
InitializeSecurityContextW
DeleteSecurityContext
FreeContextBuffer
DecryptMessage
EncryptMessage
AcceptSecurityContext
LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer
FreeCredentialsHandle
AcquireCredentialsHandleA

iphlpapi

GetIfTable2
GetAdaptersAddresses
FreeMibTable

pdh

PdhCollectQueryDataEx
PdhAddEnglishCounterA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhAddEnglishCounterW
PdhCollectQueryData

powrprof

CallNtPowerInformation

oleaut32

VariantClear
GetErrorInfo
SysFreeString
SysStringLen
SysAllocString

netapi32

NetUserGetInfo
NetUserEnum
NetUserGetLocalGroups
NetApiBufferFree

psapi

GetModuleFileNameExW
GetModuleBaseNameW
GetProcessMemoryInfo

Sections

.text
Size: 17.3MB - Virtual size: 17.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 33KB - Virtual size: 251KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 940KB - Virtual size: 939KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 237KB - Virtual size: 236KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

56c5d1c85ad00b712a68cd0fc105559d

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

advapi32

shell32

ole32

bcrypt

crypt32

ws2_32

ntdll

version

secur32

iphlpapi

pdh

powrprof

oleaut32

netapi32

psapi

Sections

.text Size: 17.3MB - Virtual size: 17.3MB

.rdata Size: 8.4MB - Virtual size: 8.4MB

.data Size: 33KB - Virtual size: 251KB

.pdata Size: 940KB - Virtual size: 939KB

.rsrc Size: 8KB - Virtual size: 8KB

.reloc Size: 237KB - Virtual size: 236KB

.text
Size: 17.3MB - Virtual size: 17.3MB

.rdata
Size: 8.4MB - Virtual size: 8.4MB

.data
Size: 33KB - Virtual size: 251KB

.pdata
Size: 940KB - Virtual size: 939KB

.rsrc
Size: 8KB - Virtual size: 8KB

.reloc
Size: 237KB - Virtual size: 236KB