MedoNuker[.]exe | Triage™

General

Target
MedoNuker.exe
Size 86KB
Sample260705-v3jpmsas9m
SHA256 7c9e5fdecd5b719949c967ca48ed1f7bd7e7b5274dc01073ab65b291668ce00f
MD5 d27004694d1ab19589eae8db3a46e045
SHA1 8f6b23fb55690a02e60b95d695b20bafc7a8ad49
SHA512 f2d7cf769b9a10d34e392c1993761858fe02dd27a85151b8c3f200806e7cd43cb516dd898ac02f13fa302ff2a9739361f6bcb5a3cf76f024c6c8f1ea25cdee8f
SSDEEP 1536:djnVH2tD88RALo/omrDzLbw2fQF6NFb6JyM8bnZ4SCes0LdsWxGcdxtrmvAXiwc4:992tgk/omfbw2ftFb6JN8bnZjsexYvA8
TLSH
T1FA836C0178C28471F576143658B8DAB59A3EF8101F649EEB339816BD0F346C19E36EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MedoNuker.exe

File Explorer

MedoNuker.exe

.exe 86KB

MedoNuker.exe

IMPHASH 0c97d5f0929993c5ec9b5a697cee220f
SHA256 7c9e5fdecd5b719949c967ca48ed1f7bd7e7b5274dc01073ab65b291668ce00f
MD5 d27004694d1ab19589eae8db3a46e045
SHA1 8f6b23fb55690a02e60b95d695b20bafc7a8ad49
SHA512 f2d7cf769b9a10d34e392c1993761858fe02dd27a85151b8c3f200806e7cd43cb516dd898ac02f13fa302ff2a9739361f6bcb5a3cf76f024c6c8f1ea25cdee8f
SSDEEP 1536:djnVH2tD88RALo/omrDzLbw2fQF6NFb6JyM8bnZ4SCes0LdsWxGcdxtrmvAXiwc4:992tgk/omfbw2ftFb6JN8bnZjsexYvA8
TLSH
T1FA836C0178C28471F576143658B8DAB59A3EF8101F649EEB339816BD0F346C19E36EEB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

ShellExecuteExW

advapi32

FreeSid RegSetValueExW OpenProcessToken AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership RegCloseKey LookupPrivilegeValueW RegCreateKeyExW

kernel32

GetProcAddress WriteConsoleW DeleteFileW GetFileAttributesW SetFileAttributesW GetCurrentProcess GetModuleFileNameW CloseHandle CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent RtlUnwind GetLastError SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer RaiseException GetStdHandle WriteFile ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW DecodePointer IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

wsprintfW ExitWindowsEx

Sharing