nullity[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
nullity.exe
Size 20KB
Sample260716-wf2glsat2l
SHA256 46b46cb09ab6aadf88cd85b90164ba92a9ec7a076ed1d3f297e845f5d07dcb8b
MD5 d62e59a058d97b72c87ba75927fb844e
SHA1 7df055b90428ba889f8ea433dfadc5ac1ad9e980
SHA512 ed2da76252d607309e7c21c0602727754638a1c15e2d41a2c401b5bbab61b979907fdbaee9bee0a7c07de2b6017b35474f5399bf222d287b402b40b0234268d2
SSDEEP 192:UXZenReXEUq4I61scivItit1Dop9y2KUwQZGsrIkE2EGwgaVw+5OMcy7bScofw1O:USkTI61ONozyuwirZE2EeaVfOD383j
TLSH
T1DF92E646A34738D5D124F27C829E0604A571B54E7B6297CBB3C970D90F6FAC0A8FBD45
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nullity.exe

File Explorer

nullity.exe

.exe 20KB

nullity.exe

IMPHASH 0ee5dde1ed31a673210f666e86069c48
SHA256 46b46cb09ab6aadf88cd85b90164ba92a9ec7a076ed1d3f297e845f5d07dcb8b
MD5 d62e59a058d97b72c87ba75927fb844e
SHA1 7df055b90428ba889f8ea433dfadc5ac1ad9e980
SHA512 ed2da76252d607309e7c21c0602727754638a1c15e2d41a2c401b5bbab61b979907fdbaee9bee0a7c07de2b6017b35474f5399bf222d287b402b40b0234268d2
SSDEEP 192:UXZenReXEUq4I61scivItit1Dop9y2KUwQZGsrIkE2EGwgaVw+5OMcy7bScofw1O:USkTI61ONozyuwirZE2EeaVfOD383j
TLSH
T1DF92E646A34738D5D124F27C829E0604A571B54E7B6297CBB3C970D90F6FAC0A8FBD45
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Liamous\Desktop\Project\penis\x64\Release\penis.pdb

kernel32

Sleep SetConsoleCP SetConsoleOutputCP GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetModuleHandleW QueryPerformanceCounter

msvcp140

?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?good@ios_base@std@@QEBA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context __current_exception __std_exception_destroy __std_terminate __C_specific_handler _CxxThrowException memcpy memcmp __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _seh_filter_exe _set_app_type _cexit _register_onexit_function _crt_atexit terminate __p___argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback _initialize_onexit_table __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strlen