Nezur_External[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Nezur_External.zip
Size

1.3MB
MD5

33c48fa5d08931c03e912b1cd330e7c4
SHA1

b5c37fbedf143c5032dba29d5536afc83bc4f8a0
SHA256

fe3d07700fdf4fb932c146e7150c7183c4fec15e1eca618bfef0daae31937641
SHA512

13d9aad49cf6b2cbfd2103dc11702ea6f1831bd8385dadec7629cd9d9ec7b4af37dc5f9b04437dcabe9effb9eb48a9948db96168c84ac2d4b04846aa151ee2d2
SSDEEP

24576:XvuS/cRI2TwAE7pccb1vrMV+4ISPm/k9eLbnpc7/rX7Z6JwdJUOHF7kz3E6NR:m5RIbn7bNrMpIb/k8XnEV8q7p6z

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nezur.exe

Files

Nezur_External.zip
.zip

Password: lol
Nezur.exe
.exe windows:6 windows x64 arch:x64

Password: lol

5b7d2645c4b61dc6b3757896456b3eba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\lucas\Downloads\nezurV3-protected\nezurV3\x64\Release\nezurV3.pdb

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

version

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

kernel32

GetLocaleInfoEx
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
SetFileInformationByHandle
AreFileApisANSI
GetFileInformationByHandleEx
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
GetModuleFileNameW
UnmapViewOfFile
ReleaseSRWLockExclusive
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
GetTickCount
GetFileSizeEx
GetSystemDirectoryA
SleepEx
LeaveCriticalSection
EnterCriticalSection
LocalFree
MapViewOfFile
CreateFileMappingW
VirtualProtect
CreateThread
GetCurrentProcess
GetConsoleWindow
Sleep
GetModuleFileNameA
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
QueryPerformanceFrequency
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
GetProcessHeap
GetCurrentProcessId
DeleteCriticalSection
GetProcAddress
HeapDestroy
HeapAlloc
HeapReAlloc
GetVersionExA
LoadLibraryA
GetLastError
GetTempPathA
HeapSize
InitializeCriticalSectionEx
VirtualAlloc
VirtualFree
HeapFree
CloseHandle
Process32Next
CreateToolhelp32Snapshot
CreateFileW
DeviceIoControl
FormatMessageA
Process32First
CreateFileA
WaitForMultipleObjects
PeekNamedPipe
VerifyVersionInfoA
SetLastError
QueryFullProcessImageNameW
AcquireSRWLockExclusive
ReadFile
GetModuleHandleW

user32

MonitorFromWindow
DestroyWindow
GetWindowRect
DispatchMessageA
MessageBoxA
ShowWindow
MoveWindow
DefWindowProcA
CreateWindowExA
SetLayeredWindowAttributes
TranslateMessage
LoadIconA
PeekMessageA
PostQuitMessage
RegisterClassExA
UpdateWindow
GetKeyState
LoadCursorA
GetMonitorInfoA
GetWindowLongA
SetWindowLongA
SendInput
GetCursorPos
FindWindowA
GetForegroundWindow
GetAsyncKeyState
ScreenToClient
GetSystemMetrics
SetClipboardData
GetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
SetCursorPos
ReleaseCapture
IsWindowUnicode
GetClientRect
SetCursor
SetCapture
TrackMouseEvent
ClientToScreen
GetCapture
UnregisterClassW

gdi32

CreateSolidBrush

advapi32

CryptDestroyHash
StartServiceA
ControlService
DeleteService
OpenSCManagerA
QueryServiceConfigA
CloseServiceHandle
CreateServiceA
EnumServicesStatusA
RegOpenKeyExA
RegQueryInfoKeyA
RegSetValueExA
RegQueryValueExA
RegCloseKey
CryptEncrypt
CryptImportKey
CryptDestroyKey
CheckTokenMembership
CryptHashData
CryptCreateHash
CryptGenRandom
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
ConvertSidToStringSidA
CopySid
SetSecurityInfo
IsValidSid
InitializeAcl
GetTokenInformation
GetLengthSid
AddAccessAllowedAce
OpenProcessToken
AllocateAndInitializeSid
FreeSid
OpenServiceA

shell32

ShellExecuteExA
ShellExecuteW
SHGetFolderPathA
ShellExecuteA

msvcp140

?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Mtx_unlock
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Xout_of_range@std@@YAXPEBD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?good@ios_base@std@@QEBA_NXZ
_Strxfrm
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strcoll
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??7ios_base@std@@QEBA_NXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??Bios_base@std@@QEBA_NXZ
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
_Thrd_detach
_Query_perf_counter
_Cnd_do_broadcast_at_thread_exit
?_Random_device@std@@YAIXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency
_Thrd_yield
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z

shlwapi

PathFindFileNameW

ntdll

RtlCaptureContext
NtQuerySystemInformation
RtlLookupFunctionEntry
RtlVirtualUnwind

imm32

ImmGetContext
ImmSetCandidateWindow
ImmReleaseContext
ImmSetCompositionWindow

dwmapi

DwmExtendFrameIntoClientArea

normaliz

IdnToAscii

wldap32

ord211
ord143
ord45
ord50
ord46
ord217
ord22
ord26
ord60
ord301
ord200
ord27
ord30
ord79
ord35
ord33
ord32
ord41

crypt32

CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChain
CertGetCertificateChain
CertOpenStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateChainEngine

ws2_32

closesocket
recv
send
bind
connect
ntohl
gethostname
sendto
getpeername
recvfrom
freeaddrinfo
getaddrinfo
getsockname
getsockopt
select
WSAGetLastError
__WSAFDIsSet
ioctlsocket
listen
htonl
accept
WSACleanup
WSAStartup
WSAIoctl
WSASetLastError
socket
setsockopt
ntohs
htons

rpcrt4

UuidToStringA
UuidCreate
RpcStringFreeA

psapi

GetModuleInformation

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
strchr
strstr
__std_exception_destroy
__std_terminate
_CxxThrowException
memchr
memcmp
memcpy
memmove
strrchr
__C_specific_handler
__current_exception
__current_exception_context
memset

api-ms-win-crt-runtime-l1-1-0

_beginthreadex
terminate
abort
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
exit
_cexit
_seh_filter_exe
_set_app_type
_exit
_get_initial_narrow_environment
_initterm
_initterm_e
_getpid
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
strerror
system
_invalid_parameter_noinfo_noreturn
__sys_nerr
_invalid_parameter_noinfo
_errno
_resetstkoflw

api-ms-win-crt-stdio-l1-1-0

_open
_close
fflush
fputc
_write
_read
__p__commode
fclose
fgetc
fwrite
fputs
feof
fgetpos
_popen
_pclose
fgets
_lseeki64
setvbuf
ungetc
fsetpos
__stdio_common_vsscanf
_wfopen
fread
_set_fmode
__stdio_common_vfprintf
fseek
__acrt_iob_func
ftell
__stdio_common_vsprintf
__stdio_common_vsprintf_s
_fseeki64
fopen
_get_stream_buffer_pointers

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
malloc
_callnewh
calloc
free

api-ms-win-crt-filesystem-l1-1-0

_stat64
_access
_unlock_file
_lock_file
remove
_fstat64
_unlink

api-ms-win-crt-convert-l1-1-0

strtod
strtoll
strtoull
atof
atoi
strtoul
strtol

api-ms-win-crt-multibyte-l1-1-0

_mbsicmp

api-ms-win-crt-utility-l1-1-0

qsort
rand

api-ms-win-crt-string-l1-1-0

isspace
strcspn
_strdup
_stricmp
strspn
strncpy
strncmp
strpbrk
tolower
isupper
strcmp

api-ms-win-crt-time-l1-1-0

_localtime64
_time64
strftime
_gmtime64

api-ms-win-crt-math-l1-1-0

acosf
ceilf
_fdclass
sqrt
roundf
fmodf
pow
powf
cosf
_dsign
sinf
__setusermatherr
atan2f
_dclass
sqrtf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
___lc_codepage_func
localeconv

api-ms-win-crt-environment-l1-1-0

getenv

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 219KB - Virtual size: 219KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 176KB - Virtual size: 176KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: lol

Password: lol

5b7d2645c4b61dc6b3757896456b3eba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

d3d11

d3dcompiler_43

version

kernel32

user32

gdi32

advapi32

shell32

msvcp140

shlwapi

ntdll

imm32

dwmapi

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.rdata Size: 219KB - Virtual size: 219KB

.data Size: 1.3MB - Virtual size: 1.3MB

.pdata Size: 39KB - Virtual size: 39KB

.rsrc Size: 176KB - Virtual size: 176KB

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.rdata
Size: 219KB - Virtual size: 219KB

.data
Size: 1.3MB - Virtual size: 1.3MB

.pdata
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 176KB - Virtual size: 176KB

.reloc
Size: 2KB - Virtual size: 2KB