NullXFIVEM[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NullXFIVEM.exe
Size 11.4MB
Sample260204-tpkjcaew2e
SHA256 68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16
MD5 a4af1b44f371e53cd243eca483f3111b
SHA1 dccf8ffe112865253fd752672a2626bb34c96aae
SHA512 24a5cd4adf15e1206549bb44aec8140c75596edb34b6c8d9e52b56c504f034f3e678202ee77178fae0f0438d08d810a2412d44962651bd6f9115c6b96859efbc
SSDEEP 196608:wDTEq55J2U61tNKjpY2mg53cLEF3d3nafyDIfKoI3xosyQXzjIAvB3LDeiXs:Enl2U61PK1Y2zb3aH1mjjIApPeiXs
TLSH
T152C63371CB8B4296DDBF4138CC3A111AF71DD6D5C16E3F9C76D0D6ABA2068E90B8D602
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

installer

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
NullXFIVEM.exe
unpack001/adafsf.exe
unpack001/ko pvp.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2

File Explorer

NullXFIVEM.exe

.exe 11.4MB
adafsf.exe

.exe 9.5MB
ko pvp.exe

.exe 2.6MB

NullXFIVEM.exe

IMPHASH 29b61e5a552b3a9bc00953de1c93be41
SHA256 68d99f454aa359732aeab903997391820fc0245c126d86ec6117c7d444e2ae16
MD5 a4af1b44f371e53cd243eca483f3111b
SHA1 dccf8ffe112865253fd752672a2626bb34c96aae
SHA512 24a5cd4adf15e1206549bb44aec8140c75596edb34b6c8d9e52b56c504f034f3e678202ee77178fae0f0438d08d810a2412d44962651bd6f9115c6b96859efbc
SSDEEP 196608:wDTEq55J2U61tNKjpY2mg53cLEF3d3nafyDIfKoI3xosyQXzjIAvB3LDeiXs:Enl2U61PK1Y2zb3aH1mjjIApPeiXs
TLSH
T152C63371CB8B4296DDBF4138CC3A111AF71DD6D5C16E3F9C76D0D6ABA2068E90B8D602
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

12557

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetFileAttributesA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CompareFileTime SearchPathA Sleep GetTickCount GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess CreateDirectoryA lstrcmpiA GetCommandLineA GetVersion SetErrorMode lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA CreateFileA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA LoadLibraryA SetFileTime CloseHandle GlobalFree lstrcmpA ExpandEnvironmentStringsA GetExitCodeProcess GlobalAlloc WaitForSingleObject GetWindowsDirectoryA GetTempPathA GetProcAddress FindFirstFileA FindNextFileA DeleteFileA SetFilePointer ReadFile FindClose GetPrivateProfileStringA WritePrivateProfileStringA WriteFile MulDiv LoadLibraryExA GetModuleHandleA MultiByteToWideChar FreeLibrary

user32

GetWindowRect EnableMenuItem GetSystemMenu ScreenToClient SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetForegroundWindow PostQuitMessage RegisterClassA EndDialog AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA ExitWindowsEx DestroyWindow OpenClipboard TrackPopupMenu SendMessageTimeoutA GetDC LoadImageA GetDlgItem FindWindowExA IsWindow SetClipboardData SetWindowLongA EmptyClipboard SetTimer CreateDialogParamA wsprintfA ShowWindow SetWindowTextA

gdi32

SelectObject SetBkMode CreateFontIndirectA SetTextColor DeleteObject GetDeviceCaps CreateBrushIndirect SetBkColor

shell32

SHGetSpecialFolderLocation SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA

advapi32

RegDeleteValueA SetFileSecurityA RegOpenKeyExA RegDeleteKeyA RegEnumValueA RegCloseKey RegCreateKeyExA RegSetValueExA RegQueryValueExA RegEnumKeyA

comctl32

ImageList_Create ImageList_Destroy ord17 ImageList_AddMasked

ole32

OleUninitialize OleInitialize CoTaskMemFree CoCreateInstance

adafsf.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 407b7cc72a8e37d0c2916e1ff0297b39aaeaee1389876df984220d167627591a
MD5 690a49a8eea014d251dd47423b72da85
SHA1 be9f786dc7710b603374bcdb14c39053469fa21d
SHA512 34bc56de682b1203c98bfbd0ecd436fb25d62badbc9626dfa0e800830e6da84e88b6e6cbcce24b681a87af90a29a73c61c6675498ebfaabf9de1067fb48d2f5f
SSDEEP 196608:FY7EiH9VBsfOFBAVNZndgk3hX8wedcnOKCw02j3WeFFTkGwIY/i9O:CpzBsfOjA/Zn2rgOgNLRY/ic
TLSH
T14EA63330CB8741D1E57A4674C628319DB71E6EC592FF3B682053FCB772B246A0B6C692
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

9910670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ko pvp.exe

IMPHASH f05c6f552e83fb4297e0ce9920a199b3
SHA256 e10080c3b13c49ec96dcbeb694e8167f6630ea5f5cbae7bb60a83f3745cf05a6
MD5 fce5bf9549199706bf0c3e22e2cf9ea2
SHA1 a71533d382d8a99ed8b410bdbff268808505a12a
SHA512 d8e0fce9802cf8aa760637aa39c29cd30bf959ab306e1cefa6fd09466751bff7e70f202a131f90aa75fccbd976ab1e803a43b13cffbbda01299f812dc0e522a1
SSDEEP 49152:AmAOW92YVB4y3VLuxuMvAKrTZrNyAk2dEzkhT8pg8E:AiUfjVqxdAGTZ10t2
TLSH
T17FC5E065E09B872CDF622B3858546633C1A13CC943F0E7D36AEDCD706BA79B45ABC640
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

Major OS version

Entry point

513700

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hhhhh\Desktop\Fivem-External-master\x64\Release\Fivem-External.pdb

dwmapi

DwmExtendFrameIntoClientArea

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

GetTokenInformation RevertToSelf PrivilegeCheck SetTokenInformation OpenProcessToken SetThreadToken CreateProcessAsUserW RegQueryValueExW LookupPrivilegeValueW DuplicateTokenEx

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

ntdll

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

winhttp

WinHttpOpenRequest WinHttpConnect WinHttpReadData WinHttpCloseHandle WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpOpen WinHttpSendRequest

kernel32

AreFileApisANSI GetStartupInfoW GetCommandLineW GetCurrentProcess OpenProcess CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle ExitProcess MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock UnhandledExceptionFilter GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter WriteProcessMemory ReadProcessMemory SetUnhandledExceptionFilter GetFileAttributesExW FindFirstFileW FindClose CreateFileW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId Sleep SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetSystemTimeAsFileTime InitializeSListHead TerminateProcess IsProcessorFeaturePresent GetFileInformationByHandleEx GetModuleHandleW WakeAllConditionVariable IsDebuggerPresent GetCurrentProcessId

user32

GetCursorPos DefWindowProcW CreateWindowExW MapWindowPoints MoveWindow SetWindowLongW SetForegroundWindow GetKeyState SetCursorPos ReleaseCapture IsWindowUnicode GetClientRect SetCursor SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetAsyncKeyState DispatchMessageW PeekMessageW TranslateMessage OpenClipboard

msvcp140

_Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Mtx_unlock ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

d3dcompiler_43

D3DCompile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp memchr memmove memset __current_exception_context __current_exception memcpy __C_specific_handler strstr __std_terminate __std_exception_copy __std_exception_destroy _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-runtime-l1-1-0

_c_exit _exit exit _initterm_e _initterm _invalid_parameter_noinfo_noreturn terminate _beginthreadex _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _register_thread_local_exe_atexit_callback _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table abort _errno _set_app_type

api-ms-win-crt-math-l1-1-0

cosf __setusermatherr _dsign sqrtf fmodf acosf ceilf sinf powf

api-ms-win-crt-convert-l1-1-0

strtoull strtoll strtod atoi

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers __p__commode _set_fmode __stdio_common_vsprintf __stdio_common_vsscanf _wfopen fputc __stdio_common_vfprintf fseek __acrt_iob_func ftell fflush fgetc _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite fclose

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-string-l1-1-0

strncpy strncmp strcmp _wcsicmp

api-ms-win-crt-utility-l1-1-0

qsort

NullXFIVEM.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

generic

adafsf.exe

mscoree

dotnet

ko pvp.exe

dwmapi

d3d11

advapi32

d3dx11_43

ntdll

winhttp

kernel32

user32

msvcp140

imm32

d3dcompiler_43

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic