neverlose.rar
- SHA256 fe681bb9009b306a3a73c3d8aa7edc1ed7ece504fd935fc7f587161aedc3f2cc
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
neverlose/injector.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
neverlose/injector.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
neverlose/neverlose.dll
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
neverlose/neverlose.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target neverlose.rar
- Size 24.5MB
- Sample260712-k5z5asht21
- SHA256 fe681bb9009b306a3a73c3d8aa7edc1ed7ece504fd935fc7f587161aedc3f2cc
- MD5 8bd9623e88fb61d98f0c2634b2593691
- SHA1 9fac07b36e3ebf15a8676881769eeb9759537b97
- SHA512 a1ebbf8553cab28f150fabcd5dc6a2d6ea2bda66fed91553c2192b80700ed00ed68d1e2f0b7eda150a98c2b1d21a44af11407871abe121472866e7ab57c7116a
- SSDEEP 786432:5otwpq2KUFTjB17bXookaKj3LlBn5E5+k:5oWpSUJ3vXd9Kjnn+5p
- TLSH T1A547336BF7AFF4B661B0C531E05C8B3063A45B7C83441C39DAF909EA5653CBB5422A63
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/neverlose/injector.exe unpack001/neverlose/neverlose.dll
File Explorer
-
neverlose.rar.rar 24.5MB
-
neverlose/injector.exe.exe 10KB
-
neverlose/neverlose.dll.dll 59.7MB
neverlose/injector.exe
- IMPHASH def7d54d9bcb77406595e0d172015441
- SHA256 f275c9fc108554794f176428983ad21fdd4bebcae6d294dbe80a4c053680dcfc
- MD5 31ae4c94456dfd036500dc465e46158b
- SHA1 69509a4c4a9b7a82518ce52ea1e5bbac7badbac4
- SHA512 7ebf7ef804e14a051e3da8598743f630490758613c618c68fc5692176ae85e9052b16d3fe88da193cad10ce30c69466fca8b4317a4e3cb20d2641063e7ef47a2
- SSDEEP 192:Sdak828jk4I6WMgJd9tw47Zq2bSibQm7E5pz6cS2a:SdF8jk4I6YJd9eSZJWibQm7N2
- TLSH T1E0222C83FFD05CF0EF6942380137D55EC7AE6A204A63BE176F94B8510976680F91A26F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4682
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
ntdll
NtWaitForSingleObject
NtWriteVirtualMemory
NtSuspendProcess
NtClose
NtQueryInformationThread
NtFreeVirtualMemory
NtAllocateVirtualMemory
RtlGetCurrentDirectory_U
NtResumeProcess
NtOpenProcess
NtCreateThreadEx
NtQuerySystemInformation
kernel32
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
GetProcAddress
shell32
ShellExecuteW
vcruntime140
_except_handler4_common
__current_exception_context
__current_exception
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcscat_s
api-ms-win-crt-heap-l1-1-0
free
malloc
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_seh_filter_exe
_set_app_type
_crt_atexit
_configure_narrow_argv
terminate
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_controlfp_s
_register_onexit_function
_initialize_onexit_table
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Name
.text
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
488B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
420B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35403,
count=1, id=259, version=35403,
count=12, id=260, version=35403,
count=19, id=261, version=35403,
count=7, id=257, version=33145,
count=59, id=1, productName=Unmarked objects,
count=1, id=265, version=35730,
count=1, id=255, version=35730,
count=1, id=258, version=35730,
neverlose/neverlose.dll
- IMPHASH c46321e69991cffeb2ccc2805d7cf222
- SHA256 ffce7b1e545fc21d45c6703c317309b0c8f2c95ea28c37915cbaafba7fbee9d3
- MD5 ac8ad91cbab4f9a04304ac87d41e3c4a
- SHA1 2895b0596abf72879bae01ebdc7506fd290afc60
- SHA512 9709702d2e5f8b7ae41fc35e63962e7061dab789aa6f865ce883707a45170644c93d9ee601ed843b66452461b085cc63196dd8608c074e7a02d8c7e0fb244965
- SSDEEP 786432:/iFsJh4S70hmKLMHvX2jT2O7je28p3TIrgcvY:/HhoMHvm+Ee28
- TLSH T124D7E102F681D0FBC58213F1E11E9F7E5D29865697204CD7F7889EA98AF52D4203AB2D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3320641
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\neverlose_prod\Project1\Release\neverlose.pdb
ntdll
NtClose
NtProtectVirtualMemory
NtFlushInstructionCache
NtTerminateProcess
NtWriteVirtualMemory
NtAllocateVirtualMemory
NtQueryVirtualMemory
RtlPcToFileHeader
NtResumeThread
NtWaitForSingleObject
NtQueryInformationThread
NtCreateThreadEx
kernel32
SleepConditionVariableSRW
SetWaitableTimer
SetLastError
EnterCriticalSection
CreateWaitableTimerW
WaitForMultipleObjects
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetQueuedCompletionStatus
CreateMutexW
WaitForSingleObject
ReleaseMutex
PostQueuedCompletionStatus
CreateEventW
MultiByteToWideChar
Sleep
FormatMessageW
GetLastError
SetEvent
TerminateThread
CloseHandle
CancelIoEx
QueueUserAPC
LocalFree
DeleteCriticalSection
GetCurrentProcessId
WideCharToMultiByte
SleepEx
FormatMessageA
CreateIoCompletionPort
VirtualFree
VirtualAlloc
VirtualQuery
HeapCreate
VirtualProtect
HeapFree
GetCurrentProcess
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
HeapReAlloc
HeapAlloc
GetThreadContext
GetProcAddress
UnhandledExceptionFilter
FlushInstructionCache
SetThreadContext
OpenThread
GetModuleHandleA
LoadLibraryW
K32GetModuleInformation
QueryPerformanceFrequency
GetStdHandle
AllocConsole
SizeofResource
LockResource
LoadResource
FindResourceW
AddVectoredExceptionHandler
TlsAlloc
TlsGetValue
TlsSetValue
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
GetSystemTime
SystemTimeToFileTime
FindClose
FindFirstFileW
FindNextFileW
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
InitializeCriticalSection
ReleaseSemaphore
GetExitCodeThread
CreateSemaphoreA
GetEnvironmentVariableW
GetACP
WriteFile
ConvertFiberToThread
ConvertThreadToFiber
GetSystemTimeAsFileTime
TerminateProcess
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
WakeAllConditionVariable
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetLocaleInfoEx
GetModuleHandleW
InitializeSListHead
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetFileInformationByHandleEx
MoveFileExW
AreFileApisANSI
SetFileInformationByHandle
QueryPerformanceCounter
GetFileAttributesExW
FindFirstFileExW
CreateFileW
CreateDirectoryW
user32
MessageBoxA
GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW
advapi32
CryptReleaseContext
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptGenRandom
msvcp140
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??4?$_Yarn@D@std@@QAEAAV01@PBD@Z
??Bios_base@std@@QBE_NXZ
??1?$codecvt@_WDU_Mbstatet@@@std@@MAE@XZ
??0?$codecvt@_WDU_Mbstatet@@@std@@QAE@I@Z
?out@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PB_W1AAPB_WPAD3AAPAD@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPA_W3AAPA_W@Z
?_Addfac@_Locimp@locale@std@@AAEXPAVfacet@23@I@Z
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UAEXXZ
?uncaught_exceptions@std@@YAHXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Xinvalid_argument@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Syserror_map@std@@YAPBDH@Z
_Xtime_get_ticks
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
?always_noconv@codecvt_base@std@@QBE_NXZ
?__ExceptionPtrAssign@@YAXPAXPBX@Z
?__ExceptionPtrCreate@@YAXPAX@Z
?__ExceptionPtrCopyException@@YAXPAXPBX1@Z
?__ExceptionPtrCopy@@YAXPAXPBX@Z
_Query_perf_frequency
?_Throw_Cpp_error@std@@YAXH@Z
?_Random_device@std@@YAIXZ
?__ExceptionPtrDestroy@@YAXPAX@Z
_Mtx_lock
?__ExceptionPtrCurrentException@@YAXPAX@Z
_Cnd_do_broadcast_at_thread_exit
_Query_perf_counter
_Thrd_detach
_Mtx_unlock
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xout_of_range@std@@YAXPBD@Z
?_Id_cnt@id@locale@std@@0HA
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
?_New_Locimp@_Locimp@locale@std@@CAPAV123@ABV123@@Z
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?__ExceptionPtrRethrow@@YAXPBX@Z
?xalloc@ios_base@std@@SAHXZ
ws2_32
getservbyport
gethostbyaddr
socket
inet_ntoa
getservbyname
gethostbyname
inet_addr
WSAGetLastError
setsockopt
ioctlsocket
sendto
recvfrom
getsockopt
htons
getpeername
WSASocketA
send
recv
WSAIoctl
WSACleanup
__WSAFDIsSet
htonl
accept
bind
WSARecv
closesocket
WSASend
select
ntohl
shutdown
listen
WSASetLastError
WSAStringToAddressW
WSASocketW
WSAStartup
getsockname
WSAAddressToStringW
ntohs
connect
mswsock
GetAcceptExSockaddrs
AcceptEx
vcruntime140
__std_terminate
_purecall
__std_type_info_compare
memchr
memcpy
__std_exception_destroy
strchr
memmove
strrchr
strstr
wcsstr
__current_exception
__current_exception_context
_except_handler4_common
_CxxThrowException
__std_type_info_destroy_list
__CxxFrameHandler3
__std_exception_copy
memset
api-ms-win-crt-heap-l1-1-0
realloc
calloc
_aligned_malloc
_aligned_free
_callnewh
free
malloc
api-ms-win-crt-runtime-l1-1-0
signal
terminate
_beginthreadex
strerror_s
_invoke_watson
strerror
abort
raise
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_exit
_errno
api-ms-win-crt-stdio-l1-1-0
ungetc
fsetpos
__stdio_common_vswprintf
setvbuf
fgetpos
fputc
fflush
fread
_fseeki64
_get_stream_buffer_pointers
fopen
_setmode
_get_osfhandle
ftell
fseek
_fileno
fgets
ferror
feof
__stdio_common_vswprintf_s
fputs
__stdio_common_vsprintf
fclose
__stdio_common_vsscanf
fwrite
fgetc
_wfopen
__stdio_common_vfprintf
__acrt_iob_func
freopen
__stdio_common_vsprintf_s
api-ms-win-crt-math-l1-1-0
ceil
_dclass
_dsign
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
wcstol
strtol
strtod
strtoll
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
_stat32
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
isspace
strncpy
strspn
strcmp
strcpy_s
strcat_s
strncpy_s
tolower
isdigit
strpbrk
strcspn
api-ms-win-crt-time-l1-1-0
_time32
_time64
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-environment-l1-1-0
getenv
crypt32
CertOpenSystemStoreW
CertFreeCertificateContext
CertFindCertificateInStore
CertCloseStore
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2.2MB
Virtual Size
2.2MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
53.0MB
Virtual Size
53.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
166KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=261, version=34808,
count=14, id=259, version=35207,
count=10, id=260, version=35207,
count=28, id=261, version=35207,
count=4, id=257, version=35207,
count=19, productName=Unmarked objects (old),
count=852, id=260, version=35729,
count=15, id=257, version=33145,
count=446, id=1, productName=Unmarked objects,
count=34, id=265, version=35226,
count=1, id=255, version=35226,
count=1, id=151,
count=1, id=258, version=35226,