Nulo - Branding Budget 2025[.]scr

Sharing

Copy URL Twitter E-mail

General

Target
Nulo - Branding Budget 2025.scr
Size 906.3MB
Sample241126-mpawksxmbs
SHA256 d7926627286a12632a3dc0633c860a522fbff6fff9ee3bd2197477a2a4a43d50
MD5 234feb3b41b3fe7657ec9c6910a0a043
SHA1 4d8605565cefa99a7240a573e12c1c727f1afa7f
SHA512 b603846a723e02be06dffe6b9c10435629fd29a3d7ac7c9c194903a4c420b6acd61c03ab46628a39a7a4e9a5093deea4c35fedda5e599d06657c2e2dfa599399
SSDEEP 3145728:Uzqaxd+ESU/BISJ/WOoZXNC0NPPPC000:U05EvH0XNC0NPPPC000
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nulo - Branding Budget 2025.scr

File Explorer

Nulo - Branding Budget 2025.scr

.exe 906.3MB

Nulo - Branding Budget 2025.scr

IMPHASH 4485855b2cd5fbdd72abb3e3ce65c751
SHA256 d7926627286a12632a3dc0633c860a522fbff6fff9ee3bd2197477a2a4a43d50
MD5 234feb3b41b3fe7657ec9c6910a0a043
SHA1 4d8605565cefa99a7240a573e12c1c727f1afa7f
SHA512 b603846a723e02be06dffe6b9c10435629fd29a3d7ac7c9c194903a4c420b6acd61c03ab46628a39a7a4e9a5093deea4c35fedda5e599d06657c2e2dfa599399
SSDEEP 3145728:Uzqaxd+ESU/BISJ/WOoZXNC0NPPPC000:U05EvH0XNC0NPPPC000
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

435196

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\administrator\Documents\2_BOT_SCR_BYBASS_WD_HI\All_phương_án_bypass_WD_backup110\All_phương_án_bypass_WD\Bot Noncrypt V5\Bọc bằng .NET framework-NKT-Notoken\HienPDF-AOT-2FukRUN\bin\Release\net8.0\win-x64\native\Nu

advapi32

RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegOpenKeyExW

bcrypt

BCryptGenRandom

kernel32

TlsFree TlsSetValue SetLastError FormatMessageW GetLastError CloseHandle GetExitCodeProcess CreateProcessW OpenProcess K32EnumProcesses GetProcessId DuplicateHandle CreatePipe GetCPInfoExW GetCurrentProcess MultiByteToWideChar WideCharToMultiByte GetStdHandle GetConsoleCP GetConsoleOutputCP CloseThreadpoolIo RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTickCount64 GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW LocalAlloc GetProcAddress CreateIoCompletionPort CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode CreateThread ResumeThread GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo EncodePointer DecodePointer HeapCreate HeapDestroy HeapAlloc HeapFree GetProcessHeap TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RaiseException RtlPcToFileHeader RtlUnwindEx IsDebuggerPresent InitializeSListHead GetCurrentProcessId IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry

ole32

CoWaitForMultipleHandles CoTaskMemFree CoInitializeEx CoUninitialize CoGetApartmentType

api-ms-win-crt-heap-l1-1-0

_callnewh free calloc _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

modf pow ceil __setusermatherr

api-ms-win-crt-string-l1-1-0

wcsncmp strcmp _stricmp strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

abort terminate _crt_atexit _seh_filter_exe _set_app_type _register_onexit_function _configure_wide_argv _initialize_onexit_table _get_initial_wide_environment _initterm _initterm_e exit _exit __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_wide_environment

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

505KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

904.5MB

Virtual Size

904.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

110KB

Virtual Size

109KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

167KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nulo - Branding Budget 2025.scr

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic