Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
Nezur_External.zip
Resource
win10ltsc2021-20250128-en
Behavioral task
behavioral2
Sample
Nezur.exe
Resource
win10ltsc2021-20250128-en
General
-
Target
Nezur_External.zip
-
Size
6.0MB
-
MD5
66a4279526448b5732710b454881ce72
-
SHA1
0f4839b749475d58486ab7056837d6e240d26060
-
SHA256
da3e8288c6a92b776a56fdd71b436ff8621c9cc7967b64a425425044833c8d6c
-
SHA512
29ad72935de08a40bbd77b23dd19a4930f8f3e42d6f04928f267fd6367a710e07873cd1966b525575882128c98bebc72d6dcc38445df9a245409a1a9bd9faf6f
-
SSDEEP
98304:kwTxEiF/Ai+9pHom5LEFzBc3PsCACVy8siIHDEP2FBWY2tQHvoYlbg3cd+yeV5Ah:1E8Ii+7Ho2EFUsCLtTIwPtCAObgEeTAh
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nezur.exe
Files
-
Nezur_External.zip.zip
-
Nezur.exe.exe windows:6 windows x64 arch:x64
3eccdd7526770c194eaa3980d9b61d5f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
d3dcompiler_43
D3DCompile
kernel32
GetEnvironmentVariableA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ClientToScreen
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
gdi32
CreateSolidBrush
advapi32
CryptDestroyHash
shell32
ShellExecuteW
msvcp140
?uncaught_exception@std@@YA_NXZ
ntdll
RtlCaptureContext
imm32
ImmReleaseContext
dwmapi
DwmExtendFrameIntoClientArea
normaliz
IdnToAscii
wldap32
ord30
crypt32
CertGetCertificateChain
ws2_32
ntohl
shlwapi
PathFindFileNameW
rpcrt4
UuidCreate
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_terminate
api-ms-win-crt-runtime-l1-1-0
_exit
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strspn
api-ms-win-crt-stdio-l1-1-0
_write
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 221KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.boot0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.boot1 Size: 6.3MB - Virtual size: 6.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 212B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 15KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ