Nosferatu[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nosferatu.exe
Size 5.8MB
Sample260620-yeanlsas41
SHA256 3ef7ca5a86499857c4aa6afaa6f528574bc6b7ce6820fe831025e7bf02aab403
MD5 b9d427cf34d4e94a11729f16ab8e6b5f
SHA1 07e5296abde57aafa5c6ede1d23ec140c27ebe45
SHA512 6937bf0c51896dddc2b2ea37c0a17f1cd7abecf84ca3705c3c32b6e8d277fdf59b88b6b5d08ad7e04ec70b1312115969d9d9460885e73969db5784a01b802f0c
SSDEEP 98304:jNdQLSbuk8jxpAbCZ96OJbQ0hR8rGWb1:YMq0O
TLSH
T16D568C43F36292EDC11AC474931AA233FA72B849073576FB6BD44A313E52FD05A2DB49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nosferatu.exe

File Explorer

Nosferatu.exe

.exe 5.8MB

Nosferatu.exe

IMPHASH 162b5b4350b16658e43f8c25ca638eca
SHA256 3ef7ca5a86499857c4aa6afaa6f528574bc6b7ce6820fe831025e7bf02aab403
MD5 b9d427cf34d4e94a11729f16ab8e6b5f
SHA1 07e5296abde57aafa5c6ede1d23ec140c27ebe45
SHA512 6937bf0c51896dddc2b2ea37c0a17f1cd7abecf84ca3705c3c32b6e8d277fdf59b88b6b5d08ad7e04ec70b1312115969d9d9460885e73969db5784a01b802f0c
SSDEEP 98304:jNdQLSbuk8jxpAbCZ96OJbQ0hR8rGWb1:YMq0O
TLSH
T16D568C43F36292EDC11AC474931AA233FA72B849073576FB6BD44A313E52FD05A2DB49
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

password1

Minor OS version

Major OS version

Entry point

3580928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Nosferatu.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

CreateWaitableTimerExW SetWaitableTimer GetFileInformationByHandleEx FindClose FindFirstFileExW SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW SetHandleInformation WriteFileEx SleepEx ReadFileEx HeapAlloc ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess LoadLibraryA WaitForSingleObjectEx ReadProcessMemory GetModuleHandleW GetModuleHandleA Sleep PostQueuedCompletionStatus GetFinalPathNameByHandleW SetLastError SetFileCompletionNotificationModes DuplicateHandle GetQueuedCompletionStatusEx IsDebuggerPresent SetFilePointerEx GetSystemInfo GetSystemTimeAsFileTime LoadLibraryW LoadLibraryExW FreeLibrary AddVectoredExceptionHandler GetProcAddress GlobalFree GlobalAlloc GlobalUnlock GlobalSize GlobalLock GetCurrentThreadId GetCurrentThread SetThreadStackGuarantee OpenProcess GetSystemTimePreciseAsFileTime WaitForSingleObject InitializeSListHead ExitProcess GetFileAttributesW CreateProcessW CompareStringOrdinal FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter HeapReAlloc FormatMessageW GetWindowsDirectoryW GetSystemDirectoryW CreateIoCompletionPort QueryPerformanceFrequency GetEnvironmentVariableW WriteConsoleW GetModuleFileNameW GetConsoleOutputCP GetConsoleMode GetStdHandle lstrlenW GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext SetThreadErrorMode MultiByteToWideChar WideCharToMultiByte CloseHandle SetUnhandledExceptionFilter CreateThread GetLastError SwitchToThread HeapFree GetProcessHeap GetFileInformationByHandle

bcryptprimitives

ProcessPrng

ntdll

NtOpenFile NtCancelIoFileEx RtlNtStatusToDosError NtReadFile NtWriteFile NtCreateFile NtDeviceIoControlFile NtCreateNamedPipeFile

advapi32

ImpersonateAnonymousToken RegCloseKey RevertToSelf RegQueryValueExW RegOpenKeyExW

ws2_32

getaddrinfo freeaddrinfo recv send shutdown ioctlsocket WSASend WSAIoctl closesocket bind WSASocketW connect getsockopt WSACleanup getsockname WSAGetLastError getpeername setsockopt WSAStartup

secur32

FreeCredentialsHandle ApplyControlToken AcceptSecurityContext FreeContextBuffer QueryContextAttributesW InitializeSecurityContextW AcquireCredentialsHandleA DeleteSecurityContext EncryptMessage DecryptMessage

crypt32

CertCloseStore CertDuplicateCertificateContext CertFreeCertificateContext CertEnumCertificatesInStore CertOpenStore CertDuplicateCertificateChain CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertGetCertificateChain CertFreeCertificateChain CertDuplicateStore

oleaut32

GetErrorInfo SysStringLen SysFreeString SysAllocStringLen SetErrorInfo SafeArrayPutElement SafeArrayCreateVector

user32

ReleaseDC FlashWindowEx SetForegroundWindow MapVirtualKeyW SetWindowDisplayAffinity ReleaseCapture GetCursorPos SetWindowTextW SetCursorPos PostMessageW CreateIconFromResourceEx IsIconic SendMessageW GetClipboardData IsClipboardFormatAvailable DestroyIcon GetWindowTextW GetWindowTextLengthW GetClipCursor ClipCursor ShowCursor ShowWindow GetSystemMenu EnableMenuItem SetWindowLongW GetWindowLongW AdjustWindowRectEx GetSystemMetrics GetKeyboardLayout ToUnicodeEx GetKeyState GetWindowRect GetUpdateRect ValidateRect SystemParametersInfoA GetRawInputData CreateIcon RegisterRawInputDevices MsgWaitForMultipleObjectsEx RemovePropW GetActiveWindow OpenClipboard RegisterWindowMessageA RedrawWindow GetKeyboardState PostThreadMessageW CloseClipboard GetMonitorInfoW SetCursor LoadCursorW CallWindowProcW GetPropW SetWindowLongPtrW SetPropW GetClassInfoExW GetClassNameW EnumDisplayMonitors GetMenu ClientToScreen CloseTouchInputHandle GetTouchInputInfo EmptyClipboard DefWindowProcW DispatchMessageW TranslateMessage GetMessageW GetClientRect MapVirtualKeyA MonitorFromRect TrackMouseEvent FindWindowA SendInput mouse_event GetAsyncKeyState GetForegroundWindow SetCapture DestroyWindow ScreenToClient SetWindowPlacement GetWindowPlacement PeekMessageW ChangeDisplaySettingsExW GetWindowLongPtrW IsProcessDPIAware InvalidateRgn SetWindowPos MonitorFromWindow RegisterTouchWindow SetClipboardData MonitorFromPoint RegisterClassExW CreateWindowExW GetDC

psapi

EnumProcessModulesEx EnumProcesses GetModuleBaseNameW

uiautomationcore

UiaRaiseAutomationEvent UiaRaiseAutomationPropertyChangedEvent UiaGetReservedNotSupportedValue UiaHostProviderFromHwnd UiaLookupId UiaReturnRawElementProvider

gdi32

GetDeviceCaps DeleteObject SetPixelFormat CreateRectRgn SwapBuffers DescribePixelFormat ChoosePixelFormat

imm32

ImmGetContext ImmGetCompositionStringW ImmSetCandidateWindow ImmAssociateContextEx ImmReleaseContext

opengl32

wglDeleteContext wglShareLists wglGetCurrentDC wglCreateContext wglGetProcAddress wglGetCurrentContext wglMakeCurrent

dwmapi

DwmEnableBlurBehindWindow

ole32

CoCreateInstance RevokeDragDrop RegisterDragDrop CoInitializeEx OleInitialize CoUninitialize

winmm

timeGetDevCaps timeBeginPeriod timeEndPeriod

shlwapi

AssocQueryStringW

shell32

DragFinish DragQueryFileW

uxtheme

SetWindowTheme

vcruntime140

memcpy memcmp memmove memset __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

powf pow cbrtf sin exp2f floorf ceilf truncf cos atan2f acosf roundf __setusermatherr cosf expf round floor trunc _hypotf log10 ceil sinf

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initterm _set_app_type _initialize_narrow_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe exit _initterm_e _get_initial_narrow_environment __p___argc __p___argv _cexit _c_exit _exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode