Nepomuk[.]exe | Triage™

General

Target
Nepomuk.exe
Size 560KB
Sample250412-h822yszmv2
SHA256 93c71027c0484c7be95f7285b2fe668b60b3bec52b0f57d0deb01fcdfe111a89
MD5 fac9214c35af0181c30099c68920f445
SHA1 5fe0f210c6461db77ed5b7e265b85eae57ffa6f1
SHA512 b24a667583c375bdfa7318b74aaa7b124bee84a528c30609eb0e7ca6b1c71426c980f52ea2488dba359e54be97e7144473849dc151dccb6434e60ad7409ec3a6
SSDEEP 12288:gVL+IwnXn0S7X/fmB/TyXG3tXIODpvGtW55i5YO8:gVL+IQXjLWkW3dIO0WLi5b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nepomuk.exe

File Explorer

Nepomuk.exe

.exe 560KB

Nepomuk.exe

IMPHASH fd6361ba72b748c3b6b9430ee151fe92
SHA256 93c71027c0484c7be95f7285b2fe668b60b3bec52b0f57d0deb01fcdfe111a89
MD5 fac9214c35af0181c30099c68920f445
SHA1 5fe0f210c6461db77ed5b7e265b85eae57ffa6f1
SHA512 b24a667583c375bdfa7318b74aaa7b124bee84a528c30609eb0e7ca6b1c71426c980f52ea2488dba359e54be97e7144473849dc151dccb6434e60ad7409ec3a6
SSDEEP 12288:gVL+IwnXn0S7X/fmB/TyXG3tXIODpvGtW55i5YO8:gVL+IQXjLWkW3dIO0WLi5b
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

user32

AdjustWindowRectEx AdjustWindowRectExForDpi AnimateWindow AppendMenuW BeginPaint BringWindowToTop CallNextHookEx CallWindowProcW CascadeWindows CheckDlgButton ChildWindowFromPoint ClientToScreen CloseClipboard CloseGestureInfoHandle CloseTouchInputHandle CloseWindow CreateCaret CreateDialogParamW CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyCaret DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW DrawMenuBar DrawTextW EmptyClipboard EndDialog EndPaint EnumDisplayMonitors ExitWindowsEx FillRect FindWindowExW FindWindowW FlashWindow FlashWindowEx GetActiveWindow GetAsyncKeyState GetCapture GetCaretPos GetClassLongW GetClientRect GetClipboardData GetCursor GetDC GetDesktopWindow GetDlgItem GetDlgItemTextW GetDpiForWindow GetFocus GetForegroundWindow GetGestureInfo GetGuiResources GetKeyState GetKeyboardState GetMenu GetMessageW GetMonitorInfoW GetParent GetSubMenu GetSystemMetrics GetTouchInputInfo GetWindow GetWindowDC GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW InsertMenuW InvalidateRect IsClipboardFormatAvailable IsDlgButtonChecked IsGUIThread IsIconic IsWindow IsWindowVisible IsZoomed KillTimer LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW LockWorkStation MapVirtualKeyW MessageBoxExW MessageBoxIndirectW MessageBoxW MonitorFromWindow OpenClipboard OpenIcon PeekMessageW PostQuitMessage RedrawWindow RegisterClassExW RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveMenu ReplyMessage ScreenToClient SendMessageTimeoutW SendNotifyMessageW SetActiveWindow SetCapture SetCaretPos SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetFocus SetForegroundWindow SetKeyboardState SetMenu SetParent SetTimer SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW SetWindowsHookExW ShowCursor ShowWindow ShowWindowAsync SwitchToThisWindow SystemParametersInfoW TileWindows TrackPopupMenu TranslateMessage UnhookWindowsHookEx UnregisterClassW UpdateWindow ValidateRect VkKeyScanW WaitMessage WinHelpW WindowFromPoint keybd_event mouse_event wsprintfW wvsprintfW

kernel32

AllocConsole Beep CancelIoEx CloseHandle CopyFileW CreateDirectoryW CreateEventW CreateFileW CreateMutexW CreateProcessW CreateSemaphoreW CreateSymbolicLinkW CreateThread DebugBreak DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection ExitProcess ExitThread FindClose FindFirstFileW FindNextFileW FlushFileBuffers FormatMessageW FreeConsole FreeLibrary GetCommandLineW GetComputerNameW GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentVariableW GetErrorMode GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileType GetFullPathNameW GetLastError GetLogicalDriveStringsW GetLongPathNameW GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetProcessDEPPolicy GetProcessHeap GetProcessId GetProcessTimes GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemPowerStatus GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetTickCount GetTimeZoneInformation GetUserDefaultLocaleName GetVersion GetVersionExW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LoadLibraryW LockFile MoveFileW OpenEventW OutputDebugStringW QueryDosDeviceW QueryPerformanceCounter ReadConsoleW ReadFile ReadFileEx ReleaseMutex RemoveDirectoryW ResumeThread SetConsoleMode SetCurrentDirectoryW SetEndOfFile SetErrorMode SetFileAttributesW SetFilePointer SetLastError SetProcessAffinityMask SetProcessDEPPolicy SetStdHandle SetThreadContext SetThreadExecutionState SetThreadPriority SignalObjectAndWait Sleep SleepEx SuspendThread SwitchToThread TerminateProcess TerminateThread TryEnterCriticalSection UnlockFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection WriteConsoleW WriteFile WriteFileEx lstrcatW lstrcmpiW lstrcpyW lstrlenW

advapi32

AccessCheck AccessCheckByType AccessCheckByTypeResultList AddAccessAllowedAce AddAccessDeniedAce AdjustTokenPrivileges AllocateAndInitializeSid AllocateLocallyUniqueId ChangeServiceConfigW CheckTokenMembership ControlService CopySid CryptAcquireContextW CryptCreateHash CryptDecrypt CryptDeriveKey CryptDestroyKey CryptEncrypt CryptExportKey CryptGenKey CryptHashData CryptImportKey CryptReleaseContext CryptSignHashW CryptVerifySignatureW DecryptFileW DeleteService DeregisterEventSource EncryptFileW EnumDependentServicesW EnumServicesStatusW FileEncryptionStatusW FreeSid GetAce GetAclInformation GetLengthSid GetSecurityDescriptorDacl GetSidIdentifierAuthority GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation GetUserNameW InitializeAcl InitializeSecurityDescriptor IsTextUnicode IsValidAcl LogonUserW LookupAccountNameW LookupAccountSidW LookupPrivilegeValueW MapGenericMask NotifyServiceStatusChangeW ObjectCloseAuditAlarmW ObjectOpenAuditAlarmW ObjectPrivilegeAuditAlarmW OpenProcessToken OpenSCManagerW OpenServiceW OpenThreadToken PrivilegeCheck PrivilegedServiceAuditAlarmW QueryServiceConfigW QueryServiceStatus RegCloseKey RegConnectRegistryW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegLoadAppKeyW RegLoadKeyW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegRestoreKeyW RegSaveKeyExW RegSaveKeyW RegSetValueExW RegUnLoadKeyW RegisterEventSourceW ReportEventW SetAclInformation SetSecurityDescriptorDacl SetTokenInformation StartServiceW

Sharing