nedfe[.]rar | Triage™

Resubmissions

30/01/2025, 11:39

250130-nsaweszmft10

30/01/2025, 01:17

250130-bnfjwsvkh110

Sharing

Copy URL Twitter E-mail

General

Target
nedfe.rar
Size 2.2MB
Sample250130-bnfjwsvkh1
SHA256 e18b6d133656117a09751990c173b1a19136568d455b5b0c10b5e3e91151915b
MD5 accc94d0684fbb9e043d2863696b5ae0
SHA1 03a71e4036d8950907fd405381d5bcfea0c2c684
SHA512 6c933dda5bdcd3ac0ba098198062b3f4a3d599a3104dc98a4bd66358a515c9d98cd79627d083aaf18c203b1b1708fd38ad11205fa7b2597a11f36e03029c4b2a
SSDEEP 49152:uR7m07hzxQzTzgzLIgEEXKRGyLYvrv5xofaG/ZH1DejeD8mJ3mXQJmBo0:o0ALIgExRGzrv5WZVDejq2A6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Anubis.exe
unpack001/spooferconfig.dll

File Explorer

nedfe.rar

.rar 2.2MB
Anubis.exe

.exe 1.2MB
spooferconfig.dll

.dll 6.0MB

nedfe.rar

SHA256 e18b6d133656117a09751990c173b1a19136568d455b5b0c10b5e3e91151915b
MD5 accc94d0684fbb9e043d2863696b5ae0
SHA1 03a71e4036d8950907fd405381d5bcfea0c2c684
SHA512 6c933dda5bdcd3ac0ba098198062b3f4a3d599a3104dc98a4bd66358a515c9d98cd79627d083aaf18c203b1b1708fd38ad11205fa7b2597a11f36e03029c4b2a
SSDEEP 49152:uR7m07hzxQzTzgzLIgEEXKRGyLYvrv5xofaG/ZH1DejeD8mJ3mXQJmBo0:o0ALIgExRGzrv5WZVDejq2A6
MD5 SHA1 SHA512 SSDEEP

Anubis.exe

IMPHASH a9c887a4f18a3fede2cc29ceea138ed3
SHA256 4b350ae0b85aa7f7818e37e3f02397cd3667af8d62eb3132fb3297bd96a0abe2
MD5 c2adb7ff42f1c961035f17bad5bee12d
SHA1 e2ae36539f9ff88e8a89d750e99d15ea6e84f0dc
SHA512 16413f90689cfa3fc509637bea54634ead1bba7f89d621bbc8096279f2413cd3477142a63becfa457e5756583c34049699ab1e960d1133dad2f72e3325ecb348
SSDEEP 24576:uDDgbYd14JwD00GR/L4Sgh5ovGpuIGPBgyjhgQJ8L/inWS:gcbILXoO3p9GP6ydk/inWS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5329

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

spooferconfig.dll

IMPHASH 7e8ab85d38ca9ddc32f9ba426542109f
SHA256 35f12093577d9c58fe7858ca26a935aaf409269057a9a8bdf975693d6dfe208a
MD5 f553ad722875c02d5b45f5c975ceb771
SHA1 867f41aa5b67cf7e15e3efe6cb4360f8f415fa6e
SHA512 041924f9a64d626d1a3b7111de968f11cc08d384b9dcd47e832744bc195d71d6f58bf06cc9f14fcf31a2f1490230779d9a1afd70e8eb836424fd14d59e6f663b
SSDEEP 49152:Z9EWdahQOLgGyX6lRu6vz3ZLZh/qNwffAj3g/bTqSk6Fi0Lp5eo0Jvn:DaNFz3Z3/lgQ/6Sj5wv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

974452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\EtoShinya\source\repos\M\x64\Release\minty.pdb

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

GetModuleHandleA LockResource LoadResource GetModuleFileNameA VirtualProtect GetCurrentProcess Sleep CreateFileA GetProcAddress lstrcmpiW GetCurrentThreadId OpenThread GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency FreeLibrary QueryPerformanceCounter LoadLibraryExA FormatMessageA CreateThread AllocConsole QueueUserAPC GetModuleHandleW FreeResource ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree SizeofResource SetLastError EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead LocalFree GetLocaleInfoEx GetCurrentThread GetTickCount64 MultiByteToWideChar GetModuleFileNameW lstrlenW WaitNamedPipeW GetCurrentProcessId CloseHandle GetLastError CreateFileW AreFileApisANSI PeekNamedPipe WriteFile FindResourceA ReadFile SuspendThread VirtualQuery

user32

CloseClipboard EmptyClipboard ReleaseCapture OpenClipboard GetCursorPos IsWindowUnicode GetClientRect SetCursor SetCapture GetForegroundWindow TrackMouseEvent ClientToScreen GetCapture EnumWindows GetClassNameA ScreenToClient GetWindowThreadProcessId RegisterClassExA SetWindowLongPtrA CreateWindowExA DefWindowProcA CallWindowProcA FindWindowA LoadCursorA SetClipboardData GetKeyState GetClipboardData GetMessageExtraInfo SetCursorPos

advapi32

RegCreateKeyExW RegSetValueExW RegCloseKey

shell32

ShellExecuteA

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?uncaught_exceptions@std@@YAHXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?good@ios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z _Query_perf_frequency ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Thrd_sleep _Query_perf_counter _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Strxfrm ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A _Strcoll ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?tolower@?$ctype@D@std@@QEBADD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??1?$codecvt@_SDU_Mbstatet@@@std@@MEAA@XZ ??0?$codecvt@_SDU_Mbstatet@@@std@@QEAA@_K@Z ?out@?$codecvt@_SDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_S1AEAPEB_SPEAD3AEAPEAD@Z ?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Random_device@std@@YAIXZ _Cnd_broadcast _Mtx_unlock _Xtime_get_ticks _Cnd_do_broadcast_at_thread_exit _Mtx_init_in_situ _Mtx_lock _Mtx_destroy_in_situ _Cnd_timedwait ?_Throw_C_error@std@@YAXH@Z ?_Xbad_alloc@std@@YAXXZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_init_in_situ _Mtx_current_owns ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

msvcp140_codecvt_ids

?id@?$codecvt@_SDU_Mbstatet@@@std@@2V0locale@2@A

ntdll

RtlLookupFunctionEntry RtlCaptureContext NtQuerySection NtProtectVirtualMemory RtlVirtualUnwind

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __C_specific_handler __std_terminate __intrinsic_setjmp memmove memcmp __std_type_info_destroy_list _CxxThrowException __current_exception_context __current_exception memset memcpy strrchr longjmp strstr strchr memchr

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _cexit _initterm _initterm_e _seh_filter_dll abort _wassert exit _errno system _beginthreadex _configure_narrow_argv terminate strerror _invalid_parameter_noinfo_noreturn

api-ms-win-crt-stdio-l1-1-0

ftell __stdio_common_vsprintf_s fseek feof fread fputc tmpnam __stdio_common_vswprintf fflush fgetc fwrite __stdio_common_vfprintf __stdio_common_vsprintf __acrt_iob_func fgetpos setvbuf _ftelli64 _popen tmpfile ungetc _pclose clearerr fgets fsetpos _fseeki64 fclose getc fopen ferror freopen _get_stream_buffer_pointers _wfopen __stdio_common_vsscanf

api-ms-win-crt-heap-l1-1-0

realloc malloc free _callnewh

api-ms-win-crt-time-l1-1-0

_gmtime64 strftime _mktime64 clock _difftime64 _time64 _localtime64

api-ms-win-crt-string-l1-1-0

isblank isalnum toupper strcmp isspace strspn isdigit isxdigit _strdup strpbrk strcoll islower ispunct iscntrl isalpha strncmp strncpy isgraph isupper tolower

api-ms-win-crt-convert-l1-1-0

atof strtod strtoull strtoul strtoll

api-ms-win-crt-math-l1-1-0

sinf sin pow logf tan log10 log fmodf fmod _dsign ldexp _dclass acos acosf asin atan2 frexp atan2f ceil ceilf sqrtf cos sqrt cosf exp floor floorf powf

api-ms-win-crt-filesystem-l1-1-0

remove _lock_file rename _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func setlocale localeconv

api-ms-win-crt-utility-l1-1-0

qsort srand rand

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

963KB

Virtual Size

963KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

113KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

329KB

Virtual Size

329KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

nedfe.rar

Anubis.exe

msvcrt

shell32

kernel32

generic

spooferconfig.dll

d3d11

kernel32

user32

advapi32

shell32

msvcp140

msvcp140_codecvt_ids

ntdll

imm32

d3dcompiler_47

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic