nexis-loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nexis-loader.exe
Size 16.6MB
Sample260508-as3dsafw6r
SHA256 d1d5b4465306882075efb9fd3afda05a15828dcb65d978332202f7dfb9985234
MD5 90a037eef2bbbcfebe52fc17bb2ebffb
SHA1 0a6eb351749758dcdee2199c01fbc2737a2b7ace
SHA512 517c0b034f9a339a5f4a81956169fc9b0db6d70965103b3d078cb0ddb9e745506ba0cc691f707c05c5af5642de94c8cfdae80913c2d09bd11b27bb3f890aad7d
SSDEEP 393216:817X7HkxxDi1VAD2wPtm0cYWL8TZ2RmWDBZn6X:817LHkxxDo6tm0cYu8Fp+E
TLSH
T18D071207F28181F8D49DC079C36BA637EB32B8894530B69F6BE44B512F2AF506B1D359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nexis-loader.exe

File Explorer

nexis-loader.exe

.exe 16.6MB

nexis-loader.exe

IMPHASH 30fe07532e14405b26110ca807be0477
SHA256 d1d5b4465306882075efb9fd3afda05a15828dcb65d978332202f7dfb9985234
MD5 90a037eef2bbbcfebe52fc17bb2ebffb
SHA1 0a6eb351749758dcdee2199c01fbc2737a2b7ace
SHA512 517c0b034f9a339a5f4a81956169fc9b0db6d70965103b3d078cb0ddb9e745506ba0cc691f707c05c5af5642de94c8cfdae80913c2d09bd11b27bb3f890aad7d
SSDEEP 393216:817X7HkxxDi1VAD2wPtm0cYWL8TZ2RmWDBZn6X:817LHkxxDo6tm0cYu8Fp+E
TLSH
T18D071207F28181F8D49DC079C36BA637EB32B8894530B69F6BE44B512F2AF506B1D359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2011184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nexis_loader.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion RtlNtStatusToDosError NtOpenFile NtWriteFile NtCreateNamedPipeFile

kernel32

GetModuleHandleW SleepConditionVariableSRW GetSystemTimeAsFileTime RtlPcToFileHeader RaiseException FlsAlloc FlsGetValue GetCurrentThreadId FlsSetValue FlsFree EncodePointer InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx AcquireSRWLockExclusive ReleaseSRWLockExclusive SwitchToThread SetLastError lstrlenW RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex WaitForSingleObject HeapReAlloc MultiByteToWideChar HeapAlloc HeapFree SleepEx FormatMessageW ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle SetWaitableTimer LCIDToLocaleName GetCurrentThread SetThreadStackGuarantee CreateWaitableTimerExW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW CreateDirectoryW CreateFileW CreateThread QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx GetEnvironmentVariableW CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext GetCommandLineW SetEnvironmentVariableW AddVectoredExceptionHandler GetTempPathW GetFileAttributesW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle SetFileTime GetFullPathNameW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetDiskFreeSpaceExW FindFirstFileExW FindClose GetModuleHandleA FindNextFileW DeleteCriticalSection GetFinalPathNameByHandleW Sleep GetUserDefaultUILanguage GetProcAddress WakeAllConditionVariable CloseHandle FreeLibrary LoadLibraryA GetLastError InitializeCriticalSectionEx LoadLibraryExW OutputDebugStringW OutputDebugStringA GetSystemTimePreciseAsFileTime LoadLibraryExA GetProcessHeap LoadLibraryW GetSystemInfo

shell32

DragFinish DragQueryFileW ShellExecuteW SHAppBarMessage SHGetKnownFolderPath SHCreateItemFromParsingName

ole32

CoUninitialize CoTaskMemAlloc CoCreateFreeThreadedMarshaler CoCreateInstance CoTaskMemFree RegisterDragDrop RevokeDragDrop CoInitializeEx OleInitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

gdi32

GetDeviceCaps DeleteDC SelectObject CreateDIBSection CreateCompatibleDC CreateRectRgn SetTextColor CombineRgn BitBlt SetBkMode DeleteObject CreateSolidBrush

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

user32

InvalidateRect GetForegroundWindow SetCursorPos IsWindowEnabled IsWindowVisible GetWindowTextW GetWindowTextLengthW EnableWindow SetParent SetPropW GetKeyboardState EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx GetKeyState MapVirtualKeyExW GetKeyboardLayout ScreenToClient ClipCursor GetSystemMetrics GetClipCursor IsWindow SetWindowLongW GetSystemMenu LoadCursorW GetWindowPlacement GetMonitorInfoW SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture GetParent SetCapture ShowCursor RegisterTouchWindow RegisterWindowMessageA SetWindowRgn GetTouchInputInfo CloseTouchInputHandle FlashWindowEx GetAsyncKeyState TranslateAcceleratorW MsgWaitForMultipleObjectsEx MapVirtualKeyW GetUpdateRect PeekMessageW SetCursor ValidateRect GetRawInputData SetWindowLongPtrW DispatchMessageW GetMessageW UpdateWindow SetFocus GetWindow EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW SystemParametersInfoW GetWindowLongPtrW RedrawWindow AdjustWindowRect DestroyWindow IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA PostMessageW GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu TrackMouseEvent PostThreadMessageW FindWindowExW IsIconic SetWindowTextW

shlwapi

SHCreateMemStream

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

advapi32

EventSetInformation EventUnregister RegOpenKeyExW RegQueryValueExW RegCloseKey EventRegister EventWriteTransfer RegGetValueW

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

api-ms-win-crt-math-l1-1-0

floor roundf trunc round pow __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s wcslen _wcsicmp wcscmp

api-ms-win-crt-convert-l1-1-0

wcstol _ultow_s _wtoi

api-ms-win-crt-runtime-l1-1-0

terminate _configure_narrow_argv _c_exit _cexit _set_app_type _get_initial_narrow_environment _initterm _initterm_e exit _seh_filter_exe _register_onexit_function __p___argv _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback _initialize_narrow_environment abort _exit __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc malloc free _set_new_mode _callnewh