Nitrogen[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Nitrogen.zip
Size

450KB
MD5

280b1bfe4e51f4bd2dd327b683497532
SHA1

518ebf1b067ff5184a8049c8219cf0957850c01e
SHA256

e038854494c067f921f7df47f3149c782779a26d23581d8c3c87d4c5e2270847
SHA512

2eced74052d7a884043c76b6256ce6abade4d27fd9e69c19c3f5dd967d16c63928c19c89093ab44f1d10a4c458c9643238e95c01fb8955aceae0f7b75042423b
SSDEEP

12288:gcx2q74v6drMyCDtKnysl/4cZwptJStZ84rFrjy0I+SI:FAq7korM3t8xd4cUJSt2+9xDSI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nitrogen.exe

Files

Nitrogen.zip
.zip
Nitrogen.exe
.exe windows:4 windows x64 arch:x64

f7e43e0de1643f36b9466c5cecaec952

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

ChangeServiceConfigA
CloseServiceHandle
ControlService
EnumDependentServicesA
OpenSCManagerA
OpenServiceA
OpenServiceW
QueryServiceStatusEx
RevertToSelf
SetThreadToken

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateFileA
CreateFileMappingA
CreateProcessA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FreeLibrary
GetCommandLineA
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetLocalTime
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetProcessAffinityMask
GetProcessHeap
GetStdHandle
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetTickCount64
HeapAlloc
HeapFree
InitializeCriticalSection
IsDBCSLeadByteEx
IsDebuggerPresent
K32EnumProcessModules
K32GetModuleFileNameExA
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
MultiByteToWideChar
OpenProcess
OutputDebugStringA
RaiseException
ReadProcessMemory
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetConsoleMode
SetEvent
SetFilePointerEx
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler

msvcrt

___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_beginthreadex
_cexit
_commode
_errno
fwprintf
_endthreadex
_fmode
_initterm
_lock
free
memchr
memcmp
memcpy
memmove
memset
printf
srand
_onexit
_stricmp
_time64
_ultoa
_unlock
_setjmp
abort
calloc
exit
fflush
fprintf
fputc
fputs
fputwc
fwrite
getenv
iswctype
localeconv
longjmp
malloc
raise
rand
realloc
setlocale
signal
strchr
strcmp
strcoll
strcpy
strerror
strftime
strlen
strncat
strncmp
strncpy
strtoul
strxfrm
system
towlower
towupper
vfprintf
wcscoll
wcsftime
wcslen
wcsxfrm
_strnicmp
_strdup
_read

ntdll

NtProtectVirtualMemory
NtWriteVirtualMemory

shell32

CommandLineToArgvW

shlwapi

PathRemoveFileSpecA
StrStrIA

user32

wsprintfW
wvsprintfW

Sections

.text
Size: 1016KB - Virtual size: 1015KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 20KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
__MACOSX/._Nitrogen.exe

Sharing

General

Malware Config

Signatures

Files

f7e43e0de1643f36b9466c5cecaec952

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcrt

ntdll

shell32

shlwapi

user32

Sections

.text Size: 1016KB - Virtual size: 1015KB

.data Size: 9KB - Virtual size: 8KB

.rdata Size: 85KB - Virtual size: 85KB

.pdata Size: 40KB - Virtual size: 39KB

.xdata Size: 51KB - Virtual size: 50KB

.bss Size: - Virtual size: 20KB

.idata Size: 6KB - Virtual size: 6KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 4KB

.text
Size: 1016KB - Virtual size: 1015KB

.data
Size: 9KB - Virtual size: 8KB

.rdata
Size: 85KB - Virtual size: 85KB

.pdata
Size: 40KB - Virtual size: 39KB

.xdata
Size: 51KB - Virtual size: 50KB

.bss
Size: - Virtual size: 20KB

.idata
Size: 6KB - Virtual size: 6KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 4KB