NXEmu-0[.]6[.]0-462-65abc63[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
NXEmu-0.6.0-462-65abc63.zip
Size 19.8MB
Sample260705-phg3escv3t
SHA256 cad52fe1486782dfac9bd39d515d9ac8b9587745b79bafde3c456738a8a13e6b
MD5 89df33f5f17fe34a517696725e76614d
SHA1 669305208a0d3ed93eea9e5a32b135d9652f7f24
SHA512 bddc3e01b61aca3efaf3d8878c4956f8c6efec4d41cc49f536c884fd9f881bcb44efcfc630c00328ac8f9086020f10c11663f2e91c1b02060e73d556fad79157
SSDEEP 393216:gKbpRvEvmKfMuRTmd60AUev9MxoXn9JygfhgtgyY7gJRt4iKDZHozIqpvBlXOTVD:VbpRv4f7mlelR/lfhgW7At4iIqIUv7O1
TLSH
T1F427335B2488896439DCFEECC7D2A32FEBC3CA5870A4DE631515C5B6F0A92D331A452D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
unpack001/lang/english.lang
unpack001/modules/cpu/nxemu-cpu.dll
unpack001/modules/loader/nxemu-loader.dll
unpack001/modules/operating_system/nxemu-os.dll
unpack001/modules/video/nxemu-video.dll
unpack001/nxemu.exe
unpack001/sciter.dll

File Explorer

NXEmu-0.6.0-462-65abc63.zip

.zip 19.8MB
lang/english.lang

.dll 368KB
modules/cpu/nxemu-cpu.dll

.dll 4.0MB
modules/loader/nxemu-loader.dll

.dll 4.2MB
modules/operating_system/nxemu-os.dll

.dll 6.6MB
modules/video/nxemu-video.dll

.dll 28.9MB
nxemu.exe

.exe 1.1MB
sciter.dll

.dll 9.0MB
user/portable.txt

143B

NXEmu-0.6.0-462-65abc63.zip

SHA256 cad52fe1486782dfac9bd39d515d9ac8b9587745b79bafde3c456738a8a13e6b
MD5 89df33f5f17fe34a517696725e76614d
SHA1 669305208a0d3ed93eea9e5a32b135d9652f7f24
SHA512 bddc3e01b61aca3efaf3d8878c4956f8c6efec4d41cc49f536c884fd9f881bcb44efcfc630c00328ac8f9086020f10c11663f2e91c1b02060e73d556fad79157
SSDEEP 393216:gKbpRvEvmKfMuRTmd60AUev9MxoXn9JygfhgtgyY7gJRt4iKDZHozIqpvBlXOTVD:VbpRv4f7mlelR/lfhgW7At4iIqIUv7O1
TLSH
T1F427335B2488896439DCFEECC7D2A32FEBC3CA5870A4DE631515C5B6F0A92D331A452D
MD5 SHA1 SHA512 SSDEEP TLSH

lang/english.lang

SHA256 04e51d6c2a6b2f164bf6833a66895e46d5a5ca79a95ed755e0c368da3854e954
MD5 5fa481c4e144c4d6ad59c96212e1c746
SHA1 74f638a44ea4f3e617f42d4de79166b9f1e627fc
SHA512 9341e2df31da12289a253f0e7ccdd0109e2f78b7d83fee1b51b43bf64b898ae0670f866a369cf390de54f30abe0c799c692b8b0e46012d9b935394846ef60304
SSDEEP 6144:TlgXobyU4x0l8+gMtV4qOGgABsukyTZ5FZV1wGCAjRHwUuriwLdi:BgXobFM0lVDZBsRybvPwWwL0
TLSH
T1C9846B3C89810739C77F22B8C3D30A557A89804A91D137B4FAAF41A2BB79D56D0B7E4D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

%!f(<nil>)

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

modules/cpu/nxemu-cpu.dll

IMPHASH ead30877d10146af2e6c345b53b97b08
SHA256 f458d85710870548ed5b8f0ec069faed4e7afb3b47cdbcc6a00570b6c5066843
MD5 3670fb60fab91da7303fb017f1c088d0
SHA1 9c86d4b78df07706e78d93f3535bd92e599456b8
SHA512 51f3c2883e3c5f4b004ec1d5e72b2feeab487677718c8f025023048199badf5649998b0a59e1c6b4d8687e713f132f2cdafad445bb14154da2d153f1bdaec939
SSDEEP 98304:FsMxhNcNB5/F2iXpysfm6BdOK26IfGNZTnCjQE5eo6QCS5Vj0D00EE8mSANSXykk:FsMxhNcN//F2iXpysfm6BdOK26IfGNZb
TLSH
T13E164A72B19662E6C077D0F9C7124967EAB23C4682B0AA2F51CE19151FF72316B3FE14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2981480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\jenkins-nxemu\workspace\NXEmu\modules\x64\cpu\pdb\nxemu-cpu.pdb

kernel32

GetSystemInfo VirtualProtect VirtualAlloc VirtualFree RtlAddFunctionTable RtlDeleteFunctionTable LoadLibraryExA WriteConsoleW OutputDebugStringW DebugBreak GetModuleFileNameW GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitOnceBeginInitialize InitOnceComplete FormatMessageA WakeAllConditionVariable SleepConditionVariableSRW GetModuleHandleW GetProcAddress QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable LocalFree GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI GetLastError MoveFileExW GetFileInformationByHandleEx SetLastError LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess InterlockedFlushSList RtlUnwindEx RtlPcToFileHeader RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary SetStdHandle GetFileType GetModuleHandleExW ReadFile SetEndOfFile FlushFileBuffers ExitProcess HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc HeapSize GetFileSizeEx SetFilePointerEx WriteFile GetConsoleOutputCP GetConsoleMode ReadConsoleW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap VirtualQuery

ole32

CoTaskMemFree

modules/loader/nxemu-loader.dll

IMPHASH 3f34442a9910e8a84f50e1650a4b6c30
SHA256 98daa69f5d126499e08329946708ba945fa9493cfb3b4be92067b4f7be909435
MD5 6c02be4c0c60a3062f8096d01c54dddc
SHA1 28f0611b3ca01e85a2f6a43b2872bdb9890b52f7
SHA512 38d45a019c27bb141d50cfb1a244fed30627a2b9b6a11849aee6971b8f012cadde9e201b14e2e5546a66032128cc0b39bbdf420c5a8caa3057852e47c656d122
SSDEEP 49152:jIlJXjjrSwO+gO/nqQtutnURzd+jyY7FqvoHW2DTCoHDoHXuhD8eXkmgTeKs:jIlpnAVjyY7Ao9HCojo3uhD8eXkmgTe
TLSH
T1AB26AD0972ED18EDD652D47AC982F943D1F3BC43573ACF1B09D24E228D6F690B92A6C4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2617640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\jenkins-nxemu\workspace\NXEmu\modules\x64\loader\pdb\nxemu-loader.pdb

kernel32

ReadFile SetFilePointer WriteFile CloseHandle GetLastError WriteConsoleW SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW FindClose FindFirstFileW GetFileAttributesW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte OutputDebugStringW DebugBreak GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute LocalFree FormatMessageA GetLocaleInfoEx FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetModuleHandleW GetProcAddress MoveFileExW GetFileInformationByHandleEx ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread WakeConditionVariable SetLastError LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo CreateFileW GetSystemTimeAsFileTime GetStringTypeW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetDriveTypeW GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle GetModuleHandleExW SetEndOfFile FlushFileBuffers ExitProcess HeapFree HeapReAlloc GetConsoleMode ReadConsoleW GetConsoleOutputCP GetFileSizeEx SetFilePointerEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap LoadLibraryExA CreateFileA VirtualQuery VirtualProtect GetSystemInfo RtlUnwind

comdlg32

GetOpenFileNameW

ole32

CoTaskMemFree

modules/operating_system/nxemu-os.dll

IMPHASH ecb585ff36f702cfce67310ccda41097
SHA256 bab5ea3756c83ac99c61e46bd61897bf13972763d7165fb071988e2eb7363050
MD5 be2adc0db7c8c26c570ab8a76e4da3c7
SHA1 17112616f9dda2c8a9de255da8ae293b007b7667
SHA512 46cd9143be8ac9829975710b5f25003e6a1ee227f7df5aed8b65921d831411a716bbbade31c6fe442474ef10b03a7c79c3f82ac745f3a1bfda9b6d09a7e004be
SSDEEP 98304:xedBFUsqfrpRCX87+SHtpschQTuYLfTy950n6Qjtw:6BFUlrpRCX8SSHjRQKYLfTIortw
TLSH
T1D866AE5AB2B802E9C0BBD1B9CA579917F7B274490274B64F06D54AAB1F73B310A7F310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4298028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\jenkins-nxemu\workspace\NXEmu\modules\x64\operating_system\pdb\nxemu-os.pdb

iphlpapi

ConvertLengthToIpv4Mask GetAdaptersAddresses

winmm

waveOutMessage waveOutGetPosition waveInReset waveInStart waveInAddBuffer waveInUnprepareHeader waveInPrepareHeader waveInClose waveInOpen waveInGetDevCapsW waveInGetNumDevs waveOutReset waveOutWrite waveOutUnprepareHeader waveOutPrepareHeader waveOutClose waveOutOpen waveOutGetErrorTextW waveOutGetDevCapsW waveInGetDevCapsA waveOutRestart waveOutPause waveOutGetDevCapsA waveOutGetNumDevs timeBeginPeriod waveInMessage timeEndPeriod timeGetTime

setupapi

SetupDiDestroyDeviceInfoList CM_Get_Parent SetupDiEnumDeviceInfo SetupDiGetDeviceRegistryPropertyA SetupDiGetClassDevsA SetupDiGetDeviceInterfaceDetailA SetupDiEnumDeviceInterfaces CM_Get_Device_IDA CM_Locate_DevNodeA

imm32

ImmSetCompositionWindow ImmNotifyIME ImmGetCandidateListW ImmSetCompositionStringW ImmGetCompositionStringW ImmAssociateContext ImmReleaseContext ImmGetContext ImmSetCandidateWindow ImmGetIMEFileNameA

ntdll

RtlVirtualUnwind RtlUnwind RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader VerSetConditionMask NtDelayExecution RtlUnwindEx

kernel32

LoadLibraryExA GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleW MultiByteToWideChar WideCharToMultiByte OutputDebugStringW DebugBreak QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId GetCurrentThread SetThreadPriority SetThreadDescription GetModuleFileNameW GetLastError LocalFree FormatMessageA GetCurrentProcess CloseHandle VirtualProtect VirtualFree VirtualFreeEx GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute FreeLibrary GetProcAddress LoadLibraryA VirtualAlloc WriteFile AttachConsole GetConsoleMode CreateFileW GetFileSizeEx ReadFile SetFilePointer SetFilePointerEx SetErrorMode GetTickCount GetModuleHandleW MulDiv SetThreadExecutionState ExitProcess TerminateProcess GlobalMemoryStatusEx GetSystemInfo CreateDirectoryW LoadLibraryW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount TryEnterCriticalSection DeleteCriticalSection ReleaseSemaphore WaitForSingleObjectEx CreateSemaphoreW Sleep VirtualQuery GetEnvironmentVariableA SetEnvironmentVariableA IsDebuggerPresent RaiseException CreateThread CreateFileA DeviceIoControl GetOverlappedResult CancelIo ResetEvent WaitForSingleObject CreateEventW FormatMessageW VerifyVersionInfoW TlsAlloc TlsGetValue TlsSetValue LoadLibraryExW GlobalAlloc GlobalUnlock GlobalLock CompareStringA GetModuleHandleExW GetSystemPowerStatus GetLocaleInfoA SetLastError CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus CancelIoEx SetEvent SleepEx SetWaitableTimer WaitForMultipleObjects CreateWaitableTimerW QueueUserAPC TerminateThread InitializeCriticalSection InitializeConditionVariable WakeAllConditionVariable SleepConditionVariableCS TlsFree GetSystemDirectoryA GetVersionExA VerifyVersionInfoA CancelWaitableTimer GetSystemTimeAsFileTime SwitchToThread GetExitCodeThread ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared TryAcquireSRWLockExclusive SleepConditionVariableSRW GetTickCount64 GetLocaleInfoEx FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx WakeConditionVariable InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead InterlockedPushEntrySList InterlockedFlushSList ExitThread FreeLibraryAndExitThread GetTimeZoneInformation SetStdHandle GetFileType SetEndOfFile FlushFileBuffers HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetConsoleOutputCP HeapReAlloc HeapSize IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW InterlockedPopEntrySList

user32

CallWindowProcW UnregisterClassW RegisterClassExW GetClassInfoExW SetWindowPos IsIconic GetKeyState GetAsyncKeyState SetTimer KillTimer GetSystemMetrics GetMenu GetForegroundWindow GetDC GetUpdateRect InvalidateRect ValidateRect GetPropW GetClientRect GetWindowRect AdjustWindowRectEx SetCursor GetCursorPos GetClipCursor ClientToScreen ScreenToClient ClipCursor FillRect GetWindowLongW CallNextHookEx LoadIconW DestroyIcon GetRawInputData RegisterWindowMessageA GetDoubleClickTime RegisterDeviceNotificationW UnregisterDeviceNotification UnregisterClassA RegisterClassExA CreateWindowExA DestroyWindow OpenClipboard CloseClipboard GetClipboardSequenceNumber SetClipboardData GetClipboardData EmptyClipboard IsClipboardFormatAvailable GetKeyboardLayout GetKeyboardState PostMessageW MapVirtualKeyW ReleaseDC ChangeDisplaySettingsExW EnumDisplaySettingsW EnumDisplayDevicesW MonitorFromPoint GetMonitorInfoW EnumDisplayMonitors SetCapture ReleaseCapture SetCursorPos LoadCursorW CopyImage CreateIconIndirect SystemParametersInfoW RegisterRawInputDevices SendMessageW AttachThreadInput RegisterClassW CreateWindowExW ShowWindow SetLayeredWindowAttributes FlashWindowEx SetFocus GetFocus SetActiveWindow SetForegroundWindow SetPropW RemovePropW SetWindowTextW GetWindowTextW GetWindowTextLengthW IntersectRect PtInRect SetWindowLongW GetWindowLongPtrW SetWindowLongPtrW GetParent GetWindowThreadProcessId SetWindowsHookExW UnhookWindowsHookEx CreateIconFromResource MonitorFromRect MonitorFromWindow SetWindowRgn GetDesktopWindow GetRawInputDeviceInfoA GetRawInputDeviceList PostThreadMessageW DialogBoxIndirectParamW EndDialog GetDlgItem DrawTextW SystemParametersInfoA GetMessageExtraInfo PeekMessageW DispatchMessageW TranslateMessage GetMessageW TrackMouseEvent MessageBoxA DefWindowProcW ToUnicode

gdi32

CreateCompatibleDC DeleteObject DescribePixelFormat GetTextMetricsW GetTextExtentPoint32A CreateFontIndirectW DeleteDC SelectObject CreateDIBSection CreateCompatibleBitmap CreateDCW BitBlt SwapBuffers SetPixelFormat GetPixelFormat CreateSolidBrush ChoosePixelFormat CreateRectRgn CombineRgn SetDeviceGammaRamp GetDeviceGammaRamp GetICMProfileW CreateBitmap GetDIBits GetDeviceCaps

ole32

CLSIDFromString CoCreateInstance CoTaskMemFree CoInitializeEx CoUninitialize PropVariantClear

oleaut32

SysFreeString

avrt

AvRevertMmThreadCharacteristics AvSetMmThreadCharacteristicsA

modules/video/nxemu-video.dll

IMPHASH 84cfb56bd33762788a2716a417632404
SHA256 d5a68fb266b0c2f8e30b6ee0a81560fade8be13451e9ef9f38c7032920722962
MD5 a6bac9edf8a3dc03ac85bd904e93c773
SHA1 0a7d26e6dbe20da2e24a6c40eb59f78f4bb26c07
SHA512 05d5b3c665122bb8b7a63ab5c9003d219d3f7f6c8ceae6ca9f39278b6f17dec9fe8438e7f269c158b7ae27a7ad00cdb44c6cc945bc77e9fd4715fe8cbfac5407
SSDEEP 393216:3pn9eE+kDEW1fq+IuNVc8v0SR3CE+buL5lYAG27V1R4PI:Zs/ju1R
TLSH
T12B677B06B76102E9C17BF13485A75F17F7A1F8A943601BAB16A766642F637E01A3F3C0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3099968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\jenkins-nxemu\workspace\NXEmu\modules\x64\video\pdb\nxemu-video.pdb

opengl32

wglDeleteContext wglMakeCurrent wglCreateContext

user32

DestroyWindow CreateWindowExA RegisterClassA DefWindowProcW GetDC ReleaseDC

gdi32

SetPixelFormat GetPixelFormat DescribePixelFormat ChoosePixelFormat SwapBuffers

kernel32

RtlUnwind LoadLibraryA DeleteFileW VirtualAlloc LoadLibraryExA GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime VirtualFree LCMapStringEx MultiByteToWideChar WideCharToMultiByte GetModuleFileNameW OutputDebugStringW DebugBreak GetCurrentThread SetThreadPriority SetThreadDescription GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute FreeLibrary GetProcAddress LoadLibraryW CloseHandle DuplicateHandle GetCurrentProcess RtlPcToFileHeader RaiseException ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitOnceBeginInitialize InitOnceComplete FormatMessageA GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent LocalFree GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle GetFullPathNameW SetFileInformationByHandle AreFileApisANSI GetModuleHandleW MoveFileExW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo ReleaseSRWLockShared AcquireSRWLockShared SetLastError LoadLibraryExW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer RemoveDirectoryW GetSystemTimeAsFileTime GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId InitializeSListHead TerminateProcess RtlUnwindEx InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread ReadFile SetEndOfFile FlushFileBuffers ExitProcess HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW WriteFile GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx SetStdHandle GetTimeZoneInformation HeapReAlloc HeapSize HeapQueryInformation IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap WriteConsoleW InitializeSRWLock InitializeConditionVariable MoveFileExA GetProcessAffinityMask MapViewOfFile UnmapViewOfFile CreateFileMappingA VirtualQuery VirtualProtect GetSystemInfo

ole32

CoTaskMemFree

nxemu.exe

IMPHASH cfda2e4140a1ab4e69ade68da272f7fc
SHA256 260ac61b370dc033ce25a04ab88ff71154c4e04b8779657a974e1c6a3111af7f
MD5 dac3c203df13e7a035b76526287df83c
SHA1 a318ca4e39818b33e0653f0e5a70d921faa90e45
SHA512 660df363990a72e220cfca17627ada767b1e154dd85a15f2aeb1cec1a5c72cf66e2dcd0c56a0dc4346939a31401b3efc39a050b401eb02cb7c2be5e9bc8b4d91
SSDEEP 12288:DWTc7VN+09ImtmsVB7nRBrxR+6/jCs+tfOx92EXcMGOXIckMdy4KhKR:CTc7vZm6NnRBr9LCssW16X4Khu
TLSH
T108358D1E66A802FDD0ABC6B8CE538417F2B2B8470371D60F17E55A622F576605F7EB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

554264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\jenkins-nxemu\workspace\NXEmu\bin\x64\Release\pdb\nxemu.pdb

kernel32

SetEnvironmentVariableA CloseHandle GetLastError WaitForSingleObject GetExitCodeProcess CreateProcessA FreeLibrary IsDebuggerPresent DebugBreak GetTickCount64 SetThreadExecutionState LoadLibraryA GetEnvironmentVariableA SetFilePointer LoadLibraryExA VirtualQuery VirtualProtect GetSystemInfo LoadLibraryW GetProcAddress HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP SetErrorMode GetModuleHandleW LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW FindClose FindFirstFileW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte CreateFileA GetFileSize ReadFile WriteFile MulDiv SetCurrentDirectoryW GetCurrentDirectoryW CreateDirectoryW OutputDebugStringW GetCurrentThread SetThreadDescription GetStdHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleW AllocConsole GetConsoleWindow WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread LocalFree FormatMessageA GetLocaleInfoEx CreateFileW FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI MoveFileExW GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW SetLastError WakeAllConditionVariable WakeConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess TerminateProcess RtlPcToFileHeader RaiseException RtlUnwindEx InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA GetCommandLineW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess SetEndOfFile FlushFileBuffers SetStdHandle GetFileType HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleOutputCP GetConsoleMode ReadConsoleW SetFilePointerEx GetFileSizeEx HeapReAlloc IsValidCodePage GetACP

user32

MonitorFromWindow SetWindowLongPtrW GetWindowLongPtrW GetWindowRect ReleaseDC MessageBoxW GetCursorPos ScreenToClient PostMessageW IsWindow IsWindowVisible GetMonitorInfoW SetFocus EnableWindow GetSystemMetrics SetForegroundWindow GetParent DefWindowProcW RegisterClassExW SystemParametersInfoW MonitorFromPoint GetDC SetWindowPlacement IsIconic CreateWindowExW DestroyWindow ShowWindow MoveWindow GetWindowPlacement SetWindowPos

gdi32

GetDeviceCaps

comdlg32

GetOpenFileNameW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CoTaskMemFree

sciter.dll

IMPHASH 29ab2f884aa1ecce2a2540902c802d59
SHA256 6512c2f1f58325e1da0da0d1e8e2b9e1a6d622460f9d0a5444789853b30ace94
MD5 302ac5ac27f70fbd983335dfe9ce8ac0
SHA1 71be910027068db406e861b5cd75492954e66ce4
SHA512 ab662158a7a731cb24dd67aeefbe756ca08832eafbdc549f059d537dabd5b10158bf60681a25392cabb616be4d321fd285db3b0e209fe8b9a11dfe0fded95493
SSDEEP 98304:yRHiAnE/vDIntQVgFwk9+eiNiNuC8YmyR:6HbnIvdEHgeiNiNuS
TLSH
T1BC968E5672A481A5C0A6C435CA1BED17F7B2BC8912B4C79F12A167EE2F337306D6E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6222560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\sciter\work\sdk\bin\windows.d2d\x64\sciter.pdb

userenv

GetUserProfileDirectoryW

shlwapi

PathCreateFromUrlW UrlCreateFromPathW PathIsRelativeW

winmm

timeEndPeriod timeGetTime timeBeginPeriod timeSetEvent timeKillEvent

oleacc

AccessibleObjectFromWindow LresultFromObject

comctl32

ImageList_DrawEx ImageList_GetIconSize ImageList_Destroy

ws2_32

htonl WSAGetLastError setsockopt GetAddrInfoW FreeAddrInfoW htons getsockopt closesocket ioctlsocket WSARecvFrom connect WSARecv ntohs ntohl socket getsockname WSAStartup select WSASetLastError freeaddrinfo getpeername WSASendTo bind WSASocketW WSAIoctl WSASend shutdown listen getaddrinfo

wininet

InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionW InternetErrorDlg HttpOpenRequestA HttpQueryInfoA InternetQueryOptionW InternetReadFile HttpQueryInfoW

imm32

ImmGetContext ImmGetCompositionStringW ImmReleaseContext ImmIsIME ImmSetCandidateWindow ImmAssociateContextEx ImmNotifyIME

kernel32

FlsFree FlsSetValue FlsGetValue FlsAlloc GetDriveTypeW SetFileAttributesW GetFileAttributesExW GetConsoleOutputCP SetStdHandle EnumSystemLocalesW FreeLibraryAndExitThread ExitThread HeapSize InitializeCriticalSectionAndSpinCount RtlUnwind InterlockedFlushSList GetACP GetOEMCP GetCommandLineA GetCommandLineW IsValidLocale FindFirstFileExW ExitProcess IsValidCodePage MultiByteToWideChar SleepConditionVariableCS TlsSetValue EnterCriticalSection GetCurrentProcess ReleaseSemaphore TryAcquireSRWLockExclusive WakeAllConditionVariable WakeConditionVariable LeaveCriticalSection InitializeCriticalSection InitializeConditionVariable WaitForSingleObject ResumeThread DuplicateHandle CreateEventW GetLastError ReleaseSRWLockExclusive SetEvent GetCurrentThread AcquireSRWLockExclusive TlsAlloc CloseHandle GetNativeSystemInfo DeleteCriticalSection CreateSemaphoreW TlsGetValue TlsFree CompareStringW GetSystemDefaultLCID GetFullPathNameW GetModuleFileNameW GetLocaleInfoW GetUserDefaultLCID QueryPerformanceFrequency VerSetConditionMask GetComputerNameW WideCharToMultiByte VerifyVersionInfoW QueryPerformanceCounter FindFirstFileW FindNextFileW FindClose SetFilePointer SetEndOfFile CreateFileW UnmapViewOfFile FlushViewOfFile GetFileSize CreateFileMappingW MapViewOfFile Sleep GetTimeZoneInformation SystemTimeToFileTime GetSystemTime GetProcAddress FreeLibrary LoadLibraryExW MulDiv GetStartupInfoW SetThreadExecutionState GetModuleHandleW SetLastError SetEnvironmentVariableW GetConsoleTitleW GetEnvironmentVariableW GetTempPathW GetVersionExW FreeEnvironmentStringsW GetSystemInfo GetCurrentDirectoryW GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW OutputDebugStringW LocalFree FormatMessageA DebugBreak GetCPInfo GetModuleHandleExW FormatMessageW GetModuleHandleA LoadLibraryA SetErrorMode GetQueuedCompletionStatus PostQueuedCompletionStatus CreateIoCompletionPort GetNumberFormatW GetCurrencyFormatW GetTimeFormatW GetDateFormatW SetHandleInformation SetFileCompletionNotificationModes CancelIo RegisterWaitForSingleObject UnregisterWait CancelIoEx SwitchToThread SetConsoleCtrlHandler GetConsoleMode GetFileType ReadFile SetNamedPipeHandleState CreateNamedPipeA WriteFile CreateNamedPipeW PeekNamedPipe QueueUserWorkItem CancelSynchronousIo CreateFileA GetNamedPipeHandleStateW WaitNamedPipeW ConnectNamedPipe FlushFileBuffers CreateDirectoryW GetFileInformationByHandleEx GetFileSizeEx GetDiskFreeSpaceW DeviceIoControl RemoveDirectoryW SetFileTime ReOpenFile CreateHardLinkW GetFileAttributesW GetFileInformationByHandle SetFilePointerEx MoveFileExW CopyFileW CreateSymbolicLinkW GetLongPathNameW GetShortPathNameW ReadDirectoryChangesW InitializeCriticalSectionEx DecodePointer GlobalSize GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleCursorInfo SetConsoleCursorInfo FillConsoleOutputCharacterW ReadConsoleInputW ReadConsoleW ResetEvent WriteConsoleInputW FillConsoleOutputAttribute WriteConsoleW GetNumberOfConsoleInputEvents SetConsoleCursorPosition SetInformationJobObject AssignProcessToJobObject TerminateProcess CreateJobObjectW UnregisterWaitEx LCMapStringW CreateProcessW GetExitCodeProcess GetVolumeInformationW GetLogicalDriveStringsW HeapFree SetThreadPriority HeapReAlloc CreateThread HeapAlloc GetProcessHeap LoadLibraryW VirtualFree VirtualAlloc WaitForMultipleObjects GetCurrentThreadId lstrcmpW SetDllDirectoryW GetStdHandle VirtualProtect GetThreadPriority GetTickCount SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent RtlPcToFileHeader RaiseException WaitForSingleObjectEx GetExitCodeThread EncodePointer LCMapStringEx GetStringTypeW RtlUnwindEx

user32

EndPaint BeginPaint GetParent MapWindowPoints IsWindow GetWindowLongW GetWindowRect SetWindowLongW SetWindowPos GetDoubleClickTime MessageBeep EnableWindow GetCursorPos SendMessageW SetCursorPos IsIconic InvalidateRect LoadImageW SetForegroundWindow ReleaseCapture UpdateWindow PtInRect SystemParametersInfoW KillTimer SetRect IsZoomed GetClientRect FlashWindowEx SetCursor SetCapture ClipCursor LoadCursorW LoadIconW TranslateMessage RegisterRawInputDevices SetPropW BringWindowToTop SetFocus SetLayeredWindowAttributes GetMessageTime MoveWindow ReleaseDC GetRawInputData SetWindowPlacement PeekMessageW GetLayeredWindowAttributes ClientToScreen CreateIconIndirect GetMonitorInfoW DestroyIcon SetTimer DispatchMessageW OffsetRect GetAsyncKeyState ShowWindow GetActiveWindow GetClassLongPtrW GetWindowPlacement WindowFromPoint RegisterClassExW MsgWaitForMultipleObjects WaitMessage SetWindowTextW GetSystemMetrics RemovePropW ScreenToClient CreateWindowExW MonitorFromWindow GetPropW IsWindowVisible GetDC DestroyWindow MapVirtualKeyW PostMessageW GetKeyState AdjustWindowRectEx DefWindowProcW GetSysColor RegisterWindowMessageW EndDeferWindowPos BeginDeferWindowPos DeferWindowPos GetWindowTextW GetDesktopWindow NotifyWinEvent UnregisterDeviceNotification ToUnicode RegisterDeviceNotificationW UnregisterClassW DestroyCaret GetKeyboardLayout CreateCaret SetCaretPos EnumDisplaySettingsW EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplayMonitors ChangeDisplaySettingsExW GetRawInputDeviceList GetRawInputDeviceInfoA GetClipboardSequenceNumber RegisterClipboardFormatW GetMessageW PostThreadMessageW GetQueueStatus TrackMouseEvent

gdi32

DeleteDC CreateCompatibleDC SetDeviceGammaRamp CreateDCW GetDeviceGammaRamp GetDeviceCaps DescribePixelFormat ChoosePixelFormat SwapBuffers SetPixelFormat CreateDIBSection CreateBitmap CreateRectRgn DeleteObject SelectObject

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW OpenProcessToken SystemFunction036 CryptAcquireContextW CryptGenRandom CryptReleaseContext GetUserNameW

shell32

Shell_NotifyIconW SHGetSpecialFolderPathW ShellExecuteExW ord727 SHBrowseForFolderW SHGetPathFromIDListW DragQueryFileW ord74 SHGetFileInfoW

ole32

OleSetClipboard RegisterDragDrop OleGetClipboard RevokeDragDrop DoDragDrop CoInitialize CoTaskMemAlloc CoUninitialize CoFreeUnusedLibraries CreateStreamOnHGlobal OleInitialize OleUninitialize CoCreateGuid CoTaskMemFree CoCreateInstance ReleaseStgMedium

oleaut32

SafeArrayPutElement SysAllocStringLen SysFreeString SafeArrayDestroy SafeArrayCreateVector

Name

.text

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

144KB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

225KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NXEmu-0.6.0-462-65abc63.zip

lang/english.lang

generic

modules/cpu/nxemu-cpu.dll

kernel32

ole32

generic

modules/loader/nxemu-loader.dll

kernel32

comdlg32

ole32

generic

modules/operating_system/nxemu-os.dll

iphlpapi

winmm

setupapi

imm32

ntdll

kernel32

user32

gdi32

ole32

oleaut32

avrt

generic

modules/video/nxemu-video.dll

opengl32

user32

gdi32

kernel32

ole32

generic

nxemu.exe

kernel32

user32

gdi32

comdlg32

ole32

generic

sciter.dll

userenv

shlwapi

winmm

oleacc

comctl32

ws2_32

wininet

imm32

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

generic

user/portable.txt