Nylenia[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nylenia.exe
Size 9.4MB
Sample260626-syn3fsc16m
SHA256 2ff1c482e6f852af96b352aa0b98e7c77e0212c422de60c5c0525d4e9bb398e2
MD5 147b3c8361c0a4912771fae4eb277dc9
SHA1 aee8d50c6343e0a1ac1f64a510ac5761b513c00d
SHA512 9a556941e2ad05d9e44654158eec2adce0c0b9978635589d64e980fca21ca8d449024151c518fcdb955b07f5f00b1f49423ff6f9056a17b699ab65d0246c7037
SSDEEP 49152:C8b5K9Vjiw8PIh/tKgxz+vQpW/9bd29Gaci9iK+c1IrDGd+ac+Fxt7tnFaAgF5T5:C8b25MH9bzr+1c+pW/vsqPEtuLSCa6
TLSH
T183A62917EDA550E9C0EDD130C9769623BAB17C485B2023D71BA0F7242F76BE0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nylenia.exe

File Explorer

Nylenia.exe

.exe 9.4MB

Nylenia.exe

IMPHASH e35353effe7047db8af5e79efb1cfdeb
SHA256 2ff1c482e6f852af96b352aa0b98e7c77e0212c422de60c5c0525d4e9bb398e2
MD5 147b3c8361c0a4912771fae4eb277dc9
SHA1 aee8d50c6343e0a1ac1f64a510ac5761b513c00d
SHA512 9a556941e2ad05d9e44654158eec2adce0c0b9978635589d64e980fca21ca8d449024151c518fcdb955b07f5f00b1f49423ff6f9056a17b699ab65d0246c7037
SSDEEP 49152:C8b5K9Vjiw8PIh/tKgxz+vQpW/9bd29Gaci9iK+c1IrDGd+ac+Fxt7tnFaAgF5T5:C8b25MH9bzr+1c+pW/vsqPEtuLSCa6
TLSH
T183A62917EDA550E9C0EDD130C9769623BAB17C485B2023D71BA0F7242F76BE0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

d3d11

D3D11CreateDevice

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __initenv __iob_func __getmainargs __set_app_type _acmdln __setusermatherr _amsg_exit _assert _cexit _commode _fmode _errno memcpy memmove memset _initterm _lock _onexit _stricmp _unlock _wfopen abort calloc exit fclose fopen fprintf fputc fread free fseek ftell fwrite localeconv malloc realloc signal strerror strlen strncmp strncpy vfprintf wcslen

Name

.text

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

125KB

Virtual Size

124KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nylenia.exe

d3d11

kernel32

msvcrt

generic