nox_setup_v7[.]0[.]5[.]9_full_intl[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nox_setup_v7.0.5.9_full_intl.exe
Size 754.3MB
Sample260702-mc6sgset8k
SHA256 b23e799c9f2221859988082bdab0ebee4fccab4b83d9aac4ac1ae53ab19b7a73
MD5 e48da59c31e8cb59cb83a052a69dd394
SHA1 3163921997c850f0e73c050e85338e34c5244c5c
SHA512 822eb6776c66a5d273bfde81cf093e10ce71fac49ba1e4b586cc78c97e50947d1f1a629cc4151a5d635cc1eace27acfc55225412eb87f94b29ad176433e05fb7
SSDEEP 12582912:LHfnFcdlknp4CDGbPF3X+VYwwuyzsBdSN9LFHKixFcl5S8+wR6qzixQZ562Yd/SJ:LfnKLk+6G9+Vzw1HK2cbS7YsU5HYd9tU
TLSH
T138893302B7C29472D6D202759AE5D33BAE6976214335D0D3ABF0266B0F315D2E73E389
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

nox_setup_v7.0.5.9_full_intl.exe

.exe 754.3MB

nox_setup_v7.0.5.9_full_intl.exe

IMPHASH c4b60f8dc5548768394711b778b675fa
SHA256 b23e799c9f2221859988082bdab0ebee4fccab4b83d9aac4ac1ae53ab19b7a73
MD5 e48da59c31e8cb59cb83a052a69dd394
SHA1 3163921997c850f0e73c050e85338e34c5244c5c
SHA512 822eb6776c66a5d273bfde81cf093e10ce71fac49ba1e4b586cc78c97e50947d1f1a629cc4151a5d635cc1eace27acfc55225412eb87f94b29ad176433e05fb7
SSDEEP 12582912:LHfnFcdlknp4CDGbPF3X+VYwwuyzsBdSN9LFHKixFcl5S8+wR6qzixQZ562Yd/SJ:LfnKLk+6G9+Vzw1HK2cbS7YsU5HYd9tU
TLSH
T138893302B7C29472D6D202759AE5D33BAE6976214335D0D3ABF0266B0F315D2E73E389
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Digest

6a:cf:cf:ed:7f:a2:03:24:fa:32:0e:bb:f2:8c:58:6b:24:88:db:9c:a2:93:60:1f:a5:81:c1:1a:94:3d:9f:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

Chains

Oct 12, 2023

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=Nox Limited,O=Nox Limited,ST=北京市,C=CN

Serial Number

0c:81:4e:20:f9:63:d4:e7:ba:16:59:c4:da:c0:7b:e8

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Oct 27, 2022 - Nov 28, 2023

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12

Issuer

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jan 12, 2016 - Jan 11, 2031

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Serial Number

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Dec 23, 2017 - Mar 22, 2029

Minor OS version

Major OS version

Entry point

2301121

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\WorkSpace\jenkins\workspace\Emulator_Build_Api4\Emulator_Check_AppsInstaller_EN_V5_ROM7_1\appsInstall\apps\bin\OutPut\Nox\NoxPack.pdb

kernel32

DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleExA GetCurrentThreadId SetThreadPriority GetPrivateProfileStringA lstrcpynW GlobalMemoryStatusEx RaiseException SetLastError InitializeCriticalSectionAndSpinCount lstrcmpW GetSystemDefaultLangID GetVersion VerSetConditionMask VerifyVersionInfoW GetUserDefaultLCID GetCommandLineW GetEnvironmentVariableA GetDriveTypeW DecodePointer SetUnhandledExceptionFilter ExitProcess GetLocalTime LoadLibraryExW SetEvent ResetEvent CreateEventW CreateFileA CompareFileTime CreateDirectoryA GetFileTime SetFileAttributesA GetModuleFileNameA SetEndOfFile QueueUserWorkItem GetStartupInfoW GetSystemInfo GetACP FormatMessageA InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency GetSystemDirectoryW QueryPerformanceCounter WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle PeekNamedPipe WaitForMultipleObjects GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW SuspendThread GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber LoadLibraryA ConvertFiberToThread ConvertThreadToFiber TryEnterCriticalSection TerminateThread CreateThread GetCurrentProcessId WaitForSingleObject GetLastError RemoveDirectoryW ReadFile GetVolumeInformationW WriteConsoleW CopyFileW EnterCriticalSection OutputDebugStringA SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage GetTimeZoneInformation GetFullPathNameA GetFullPathNameW FlushFileBuffers HeapSize SetStdHandle EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleCP HeapReAlloc SetConsoleCtrlHandler SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetCommandLineA FreeLibraryAndExitThread ResumeThread ExitThread GetFileAttributesExW InterlockedFlushSList RtlUnwind LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetProcessHeap HeapFree HeapAlloc InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetStringTypeW InitializeCriticalSection Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcatW lstrcpyW lstrcmpiW lstrcmpiA LeaveCriticalSection GetModuleHandleW GetModuleFileNameW GetLongPathNameW FindNextFileW FindFirstFileW FindClose CreateDirectoryW WideCharToMultiByte WritePrivateProfileStructW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW DeleteFileW lstrlenW MulDiv LocalFree LocalAlloc CloseHandle WriteFile SetFileAttributesW CreateFileW FindResourceW GlobalFree GlobalUnlock GlobalLock GlobalAlloc FreeResource SizeofResource LockResource OpenProcess GetExitCodeProcess Sleep CreatePipe SetHandleInformation OutputDebugStringW DebugBreak RemoveDirectoryA QueryDosDeviceW GetTempFileNameW GetLogicalDriveStringsW GetFileSize FindNextFileA FindFirstFileA DeleteFileA SetCurrentDirectoryW DosDateTimeToFileTime GetCurrentProcess DuplicateHandle SetFileTime SetFilePointer GetFileType GetCurrentDirectoryW lstrlenA lstrcpyA lstrcpynA GetTempPathW GetDiskFreeSpaceExW DeviceIoControl SystemTimeToFileTime LoadLibraryW GetProcAddress FreeLibrary GetSystemTime GetVersionExW MultiByteToWideChar FindFirstFileExA MoveFileExW GetTickCount FindFirstFileExW CreateProcessW LoadResource FormatMessageW

user32

GetWindowRect SendMessageW GetDesktopWindow ReleaseDC GetDC LoadStringW FillRect EnumDisplaySettingsW GetClipboardData RegisterClipboardFormatW IsClipboardFormatAvailable GetAsyncKeyState SetCapture ReleaseCapture SetCursor GetCursorPos CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor IntersectRect UnionRect PtInRect RegisterWindowMessageW PostThreadMessageW FindWindowW GetMonitorInfoW MonitorFromWindow TrackMouseEvent IsIconic IsWindowEnabled MapWindowPoints wsprintfW CopyRect SetWindowPos OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetParent FindWindowExW GetWindowThreadProcessId TranslateMessage DispatchMessageW PeekMessageW AttachThreadInput BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow MessageBoxW CharNextW PostMessageW WaitMessage DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer IsRectEmpty CallWindowProcW GetClassInfoExW IsWindow ShowWindow SetFocus SetWindowTextW GetWindowTextW GetWindowTextLengthW GetWindowLongW SetWindowLongW LoadCursorW BeginPaint EndPaint InvalidateRect DrawIcon DrawTextW LoadImageW DrawIconEx GetFocus GetKeyState GetClientRect UpdateWindow GetMessagePos IsZoomed EnableWindow SetWindowRgn ScreenToClient OffsetRect SetClassLongW ChangeDisplaySettingsW GetUserObjectInformationW SystemParametersInfoW GetWindow GetProcessWindowStation

gdi32

SetViewportOrgEx SetBkColor MoveToEx GetObjectA SetTextColor RoundRect Rectangle LineTo SetBkMode GetTextExtentPoint32W GetCurrentObject GetClipBox ExcludeClipRect CreateSolidBrush SetWindowOrgEx CreateFontIndirectW DeleteObject CreatePatternBrush CreateFontW CreateCompatibleBitmap GetObjectW CreateDIBSection SelectObject GetDIBits GetDeviceCaps DeleteDC CreateCompatibleDC BitBlt GetStockObject CombineRgn CreateRectRgn CreateRoundRectRgn CreateRectRgnIndirect SelectClipRgn GdiSetBatchLimit CreatePen StretchBlt

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegEnumValueW CreateWellKnownSid RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW OpenProcessToken CreateProcessAsUserW SetTokenInformation DuplicateTokenEx AllocateAndInitializeSid FreeSid GetLengthSid SystemFunction036 RegCloseKey

shell32

SHBrowseForFolderW SHGetSpecialFolderLocation SHGetMalloc CommandLineToArgvW Shell_NotifyIconW SHFileOperationW ShellExecuteW SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHGetPathFromIDListW

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoLoadLibrary StringFromGUID2 CoInitializeEx CoUninitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

OleLoadPicture SysAllocString VarUI4FromStr GetErrorInfo VariantClear VariantInit VariantChangeType SetErrorInfo CreateErrorInfo SysFreeString

shlwapi

PathAppendW PathCanonicalizeW PathFindExtensionW PathIsDirectoryW PathIsRootW PathMatchSpecW SHRegGetUSValueA PathRemoveExtensionW PathRemoveFileSpecW SHGetValueW PathIsDirectoryEmptyW PathAppendA PathCombineA PathFileExistsA PathFindFileNameA PathIsDirectoryA StrCmpIW StrStrIW StrStrW PathFileExistsW PathRemoveFileSpecA PathFindFileNameW SHRegSetUSValueA PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt AlphaBlend

gdiplus

GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipCreateBitmapFromHBITMAP GdipSetStringFormatFlags GdipDeleteStringFormat GdipCreateStringFormat GdipDeleteFont GdipDrawString GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipReleaseDC GdipSetImageAttributesColorKeys GdipGetPropertyItem GdipCreateFontFromLogfontA GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipTranslateTextureTransform GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdiplusStartup GdipFree GdipAlloc GdipGetPropertyItemSize

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

HttpQueryInfoW InternetSetOptionW InternetSetCookieA InternetSetCookieW InternetErrorDlg InternetGetCookieW InternetOpenA InternetConnectW InternetOpenUrlA HttpOpenRequestW HttpSendRequestA InternetReadFile InternetOpenUrlW InternetCloseHandle InternetOpenW InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname gethostbyname getnameinfo bind send recv socket WSAGetLastError shutdown

wldap32

ord147 ord133 ord79 ord142 ord301 ord127 ord27 ord26 ord118 ord167 ord41 ord208 ord216 ord14 ord46 ord219 ord145

generic

count=15, id=241, version=40116,

count=186, id=243, version=40116,

count=28, id=242, version=40116,

count=1, id=264, version=23026,

count=17, id=170, productName=VS2010 build 30319, version=30319,

count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=209, version=65501,

count=6, id=199, version=41118,

count=26, id=259, version=23013,

count=75, id=261, version=23013,

count=66, id=260, version=23013,

count=6, id=206, version=65501,

count=1, id=208, version=65501,

count=666, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=47, id=203, version=65501,

count=595, id=1, productName=Unmarked objects,

count=108, id=261, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=255, productName=VS2015 [14.0] build 23026, version=23026,

count=1, id=151,

count=1, id=258, productName=VS2015 [14.0] build 23026, version=23026,