nox_setup_v7[.]0[.]6[.]1_full_intl[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

nox_setup_v7.0.6.1_full_intl.exe
Size

570.2MB
MD5

2030bc6db4c8e48b974e172989aceab7
SHA1

3b9388aee7d2912859c8bce99475a34d3e8b8cc5
SHA256

83fa5ca0e825e4a1e51b46b019e9626c9e0925a092613f28e53efd6b3cc4d903
SHA512

d734e23f3d2d22782be8a1bcecaabe36112f6ed9d3e3ad2056d22d9dac61532535ba2f29b0a795fa57250a01c67c75fd24faf88b8ad0e6e551b0fa31c8cc33d6
SSDEEP

12582912:3Z3qPsQptRLxCqzfX7C5uMM6AV2/9tF0VjY0TB8HSTdnI6eq1RT9:UPsQptrCs+YkIVjY0HFbeql

Score

1^/10

Malware Config

Signatures

Files

nox_setup_v7.0.6.1_full_intl.exe
.exe windows:6 windows x86 arch:x86

c4b60f8dc5548768394711b778b675fa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

3b:5f:74:87:fe:89:60:07:3a:53:d8:c4
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

14/06/2024, 09:25

Not After

24/08/2025, 06:08

Subject

SERIALNUMBER=911101083302797532,CN=Nox Limited,OU=IT,O=Nox Limited,L=Beijing,ST=Beijing,C=CN,1.3.6.1.4.1.311.60.2.1.2=#13074265696a696e67,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4d:28:b7:f1:52:a8:2a:b7:fa:68:32:ef:62:ec:96:7f:8f:85:aa:03:70:c2:24:74:30:40:60:a4:5b:fe:c8:e9
Signer

Actual PE Digest

4d:28:b7:f1:52:a8:2a:b7:fa:68:32:ef:62:ec:96:7f:8f:85:aa:03:70:c2:24:74:30:40:60:a4:5b:fe:c8:e9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\WorkSpace\jenkins\workspace\Emulator_Build_Api4\Emulator_Check_AppsInstaller_EN_V5_ROM7_1\appsInstall\apps\bin\OutPut\Nox\NoxPack.pdb

Imports

kernel32

DeleteCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
GetModuleHandleExA
GetCurrentThreadId
SetThreadPriority
GetPrivateProfileStringA
lstrcpynW
GlobalMemoryStatusEx
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
lstrcmpW
GetSystemDefaultLangID
GetVersion
VerSetConditionMask
VerifyVersionInfoW
GetUserDefaultLCID
GetCommandLineW
GetEnvironmentVariableA
GetDriveTypeW
DecodePointer
SetUnhandledExceptionFilter
ExitProcess
GetLocalTime
LoadLibraryExW
SetEvent
ResetEvent
CreateEventW
CreateFileA
CompareFileTime
CreateDirectoryA
GetFileTime
SetFileAttributesA
GetModuleFileNameA
SetEndOfFile
QueueUserWorkItem
GetStartupInfoW
GetSystemInfo
GetACP
FormatMessageA
InitializeCriticalSectionEx
SleepEx
QueryPerformanceFrequency
GetSystemDirectoryW
QueryPerformanceCounter
WaitForSingleObjectEx
ExpandEnvironmentStringsA
GetStdHandle
PeekNamedPipe
WaitForMultipleObjects
GetEnvironmentVariableW
GetConsoleMode
ReadConsoleA
ReadConsoleW
SetConsoleMode
GetModuleHandleExW
SuspendThread
GetSystemTimeAsFileTime
SwitchToFiber
DeleteFiber
CreateFiber
LoadLibraryA
ConvertFiberToThread
ConvertThreadToFiber
TryEnterCriticalSection
TerminateThread
CreateThread
GetCurrentProcessId
WaitForSingleObject
GetLastError
RemoveDirectoryW
ReadFile
GetVolumeInformationW
WriteConsoleW
CopyFileW
EnterCriticalSection
OutputDebugStringA
SetEnvironmentVariableW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetTimeZoneInformation
GetFullPathNameA
GetFullPathNameW
FlushFileBuffers
HeapSize
SetStdHandle
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
GetCurrentThread
GetConsoleCP
HeapReAlloc
SetConsoleCtrlHandler
SetFilePointerEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCommandLineA
FreeLibraryAndExitThread
ResumeThread
ExitThread
GetFileAttributesExW
InterlockedFlushSList
RtlUnwind
LoadLibraryExA
VirtualFree
VirtualAlloc
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
GetProcessHeap
HeapFree
HeapAlloc
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
GetLocaleInfoW
LCMapStringW
CompareStringW
GetCPInfo
EncodePointer
GetStringTypeW
InitializeCriticalSection
Process32NextW
Process32FirstW
CreateToolhelp32Snapshot
lstrcatW
lstrcpyW
lstrcmpiW
lstrcmpiA
LeaveCriticalSection
GetModuleHandleW
GetModuleFileNameW
GetLongPathNameW
FindNextFileW
FindFirstFileW
FindClose
CreateDirectoryW
WideCharToMultiByte
WritePrivateProfileStructW
GetPrivateProfileSectionNamesW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
DeleteFileW
lstrlenW
MulDiv
LocalFree
LocalAlloc
CloseHandle
WriteFile
SetFileAttributesW
CreateFileW
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
FreeResource
SizeofResource
LockResource
OpenProcess
GetExitCodeProcess
Sleep
CreatePipe
SetHandleInformation
OutputDebugStringW
DebugBreak
RemoveDirectoryA
QueryDosDeviceW
GetTempFileNameW
GetLogicalDriveStringsW
GetFileSize
FindNextFileA
FindFirstFileA
DeleteFileA
SetCurrentDirectoryW
DosDateTimeToFileTime
GetCurrentProcess
DuplicateHandle
SetFileTime
SetFilePointer
GetFileType
GetCurrentDirectoryW
lstrlenA
lstrcpyA
lstrcpynA
GetTempPathW
GetDiskFreeSpaceExW
DeviceIoControl
SystemTimeToFileTime
LoadLibraryW
GetProcAddress
FreeLibrary
GetSystemTime
GetVersionExW
MultiByteToWideChar
FindFirstFileExA
MoveFileExW
GetTickCount
FindFirstFileExW
CreateProcessW
LoadResource
FormatMessageW

user32

GetWindowRect
SendMessageW
GetDesktopWindow
ReleaseDC
GetDC
LoadStringW
FillRect
EnumDisplaySettingsW
GetClipboardData
RegisterClipboardFormatW
IsClipboardFormatAvailable
GetAsyncKeyState
SetCapture
ReleaseCapture
SetCursor
GetCursorPos
CreateCaret
HideCaret
ShowCaret
SetCaretPos
ClientToScreen
GetSysColor
IntersectRect
UnionRect
PtInRect
RegisterWindowMessageW
PostThreadMessageW
FindWindowW
GetMonitorInfoW
MonitorFromWindow
TrackMouseEvent
IsIconic
IsWindowEnabled
MapWindowPoints
wsprintfW
CopyRect
SetWindowPos
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetSystemMetrics
GetParent
FindWindowExW
GetWindowThreadProcessId
TranslateMessage
DispatchMessageW
PeekMessageW
AttachThreadInput
BringWindowToTop
SetActiveWindow
GetForegroundWindow
SetForegroundWindow
MessageBoxW
CharNextW
PostMessageW
WaitMessage
DefWindowProcW
PostQuitMessage
UnregisterClassW
RegisterClassExW
CreateWindowExW
DestroyWindow
GetQueueStatus
MsgWaitForMultipleObjectsEx
SetTimer
KillTimer
IsRectEmpty
CallWindowProcW
GetClassInfoExW
IsWindow
ShowWindow
SetFocus
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetWindowLongW
SetWindowLongW
LoadCursorW
BeginPaint
EndPaint
InvalidateRect
DrawIcon
DrawTextW
LoadImageW
DrawIconEx
GetFocus
GetKeyState
GetClientRect
UpdateWindow
GetMessagePos
IsZoomed
EnableWindow
SetWindowRgn
ScreenToClient
OffsetRect
SetClassLongW
ChangeDisplaySettingsW
GetUserObjectInformationW
SystemParametersInfoW
GetWindow
GetProcessWindowStation

gdi32

SetViewportOrgEx
SetBkColor
MoveToEx
GetObjectA
SetTextColor
RoundRect
Rectangle
LineTo
SetBkMode
GetTextExtentPoint32W
GetCurrentObject
GetClipBox
ExcludeClipRect
CreateSolidBrush
SetWindowOrgEx
CreateFontIndirectW
DeleteObject
CreatePatternBrush
CreateFontW
CreateCompatibleBitmap
GetObjectW
CreateDIBSection
SelectObject
GetDIBits
GetDeviceCaps
DeleteDC
CreateCompatibleDC
BitBlt
GetStockObject
CombineRgn
CreateRectRgn
CreateRoundRectRgn
CreateRectRgnIndirect
SelectClipRgn
GdiSetBatchLimit
CreatePen
StretchBlt

comdlg32

GetOpenFileNameW
GetSaveFileNameW

advapi32

RegEnumValueW
CreateWellKnownSid
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
SetEntriesInAclW
GetNamedSecurityInfoW
SetNamedSecurityInfoW
RegDeleteKeyW
RegEnumKeyExW
RegQueryInfoKeyW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
CryptDecrypt
CryptCreateHash
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
OpenProcessToken
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
AllocateAndInitializeSid
FreeSid
GetLengthSid
SystemFunction036
RegCloseKey

shell32

SHBrowseForFolderW
SHGetSpecialFolderLocation
SHGetMalloc
CommandLineToArgvW
Shell_NotifyIconW
SHFileOperationW
ShellExecuteW
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
SHGetPathFromIDListW

ole32

CoInitialize
CoTaskMemFree
CoTaskMemRealloc
CoTaskMemAlloc
CreateILockBytesOnHGlobal
StgCreateDocfileOnILockBytes
CoLoadLibrary
StringFromGUID2
CoInitializeEx
CoUninitialize
CoCreateInstance
CreateStreamOnHGlobal

oleaut32

OleLoadPicture
SysAllocString
VarUI4FromStr
GetErrorInfo
VariantClear
VariantInit
VariantChangeType
SetErrorInfo
CreateErrorInfo
SysFreeString

shlwapi

PathAppendW
PathCanonicalizeW
PathFindExtensionW
PathIsDirectoryW
PathIsRootW
PathMatchSpecW
SHRegGetUSValueA
PathRemoveExtensionW
PathRemoveFileSpecW
SHGetValueW
PathIsDirectoryEmptyW
PathAppendA
PathCombineA
PathFileExistsA
PathFindFileNameA
PathIsDirectoryA
StrCmpIW
StrStrIW
StrStrW
PathFileExistsW
PathRemoveFileSpecA
PathFindFileNameW
SHRegSetUSValueA
PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt
AlphaBlend

gdiplus

GdipSetStringFormatAlign
GdipSetStringFormatLineAlign
GdipSetStringFormatTrimming
GdipCreateBitmapFromHBITMAP
GdipSetStringFormatFlags
GdipDeleteStringFormat
GdipCreateStringFormat
GdipDeleteFont
GdipDrawString
GdipCreateFontFromDC
GdipDrawImageRectI
GdipFillPath
GdipFillRectangleI
GdipDrawPath
GdipDrawRectangleI
GdipDrawLineI
GdipSetTextRenderingHint
GdipReleaseDC
GdipSetImageAttributesColorKeys
GdipGetPropertyItem
GdipCreateFontFromLogfontA
GdipImageSelectActiveFrame
GdipImageGetFrameCount
GdipImageGetFrameDimensionsList
GdipImageGetFrameDimensionsCount
GdipDeletePen
GdipCreatePen1
GdipCreateSolidFill
GdipTranslateTextureTransform
GdipCreateTexture2I
GdipDeleteBrush
GdipCloneBrush
GdipAddPathArcI
GdipAddPathLineI
GdipDeletePath
GdipClonePath
GdipCreatePath
GdiplusShutdown
GdipCreateHBITMAPFromBitmap
GdipCreateBitmapFromFileICM
GdipCreateBitmapFromStreamICM
GdipCreateBitmapFromFile
GdipCreateBitmapFromStream
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipSaveImageToFile
GdipLoadImageFromFileICM
GdipLoadImageFromFile
GdipDrawImageRectRectI
GdipSetInterpolationMode
GdipDeleteGraphics
GdipCreateFromHDC
GdipDisposeImageAttributes
GdipCreateImageAttributes
GdipGetImageHeight
GdipGetImageWidth
GdipDisposeImage
GdipCloneImage
GdipLoadImageFromStreamICM
GdipLoadImageFromStream
GdiplusStartup
GdipFree
GdipAlloc
GdipGetPropertyItemSize

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

wininet

HttpQueryInfoW
InternetSetOptionW
InternetSetCookieA
InternetSetCookieW
InternetErrorDlg
InternetGetCookieW
InternetOpenA
InternetConnectW
InternetOpenUrlA
HttpOpenRequestW
HttpSendRequestA
InternetReadFile
InternetOpenUrlW
InternetCloseHandle
InternetOpenW
InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext
CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

closesocket
connect
getpeername
getsockname
getsockopt
htons
ntohs
setsockopt
WSASetLastError
WSAIoctl
WSAStartup
WSACleanup
__WSAFDIsSet
select
getaddrinfo
freeaddrinfo
accept
listen
recvfrom
sendto
ioctlsocket
gethostname
gethostbyname
getnameinfo
bind
send
recv
socket
WSAGetLastError
shutdown

wldap32

ord147
ord133
ord79
ord142
ord301
ord127
ord27
ord26
ord118
ord167
ord41
ord208
ord216
ord14
ord46
ord219
ord145

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 699KB - Virtual size: 699KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 36KB - Virtual size: 75KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 566.9MB - Virtual size: 566.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c4b60f8dc5548768394711b778b675fa

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

3b:5f:74:87:fe:89:60:07:3a:53:d8:c4Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

4d:28:b7:f1:52:a8:2a:b7:fa:68:32:ef:62:ec:96:7f:8f:85:aa:03:70:c2:24:74:30:40:60:a4:5b:fe:c8:e9Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

msimg32

gdiplus

version

wininet

netapi32

iphlpapi

psapi

dbghelp

crypt32

winmm

bcrypt

ws2_32

wldap32

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 699KB - Virtual size: 699KB

.data Size: 36KB - Virtual size: 75KB

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 566.9MB - Virtual size: 566.9MB

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

3b:5f:74:87:fe:89:60:07:3a:53:d8:c4
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

4d:28:b7:f1:52:a8:2a:b7:fa:68:32:ef:62:ec:96:7f:8f:85:aa:03:70:c2:24:74:30:40:60:a4:5b:fe:c8:e9
Signer

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 699KB - Virtual size: 699KB

.data
Size: 36KB - Virtual size: 75KB

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 566.9MB - Virtual size: 566.9MB