nulluty[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
nulluty.exe
Size 8.0MB
Sample260717-1chmjsat91
SHA256 a13ff1ffd69678a6dcc8dd66a686c48921e6925a8ebed0f0dc0a2ec5d4862269
MD5 3f138c933263e02c513e2b1741a6474f
SHA1 d49ff578042ba64b6b50e70d340c0cc553c229ea
SHA512 f04e46365e85c38310d573384ce444df558dc0aa5b70788c371e07478fe239a305665e4f9eaa3e92e8af5531aab588b3d1bc402a87d660ea349aa5636caac368
SSDEEP 768:2S6u/JE7FlrTCkaSQ4FoS5vBAYSjPfA09S78w1eH+1:2S6mGmC8YSjPt9pw1/
TLSH
T1C8862A16565524ECC262F2B9D79F2A42D672784D33616BDF23C0B0DA0F2F6C069F7826
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nulluty.exe

File Explorer

nulluty.exe

.exe 8.0MB

nulluty.exe

IMPHASH d0f1b208586ba03de7702b4e468c2367
SHA256 a13ff1ffd69678a6dcc8dd66a686c48921e6925a8ebed0f0dc0a2ec5d4862269
MD5 3f138c933263e02c513e2b1741a6474f
SHA1 d49ff578042ba64b6b50e70d340c0cc553c229ea
SHA512 f04e46365e85c38310d573384ce444df558dc0aa5b70788c371e07478fe239a305665e4f9eaa3e92e8af5531aab588b3d1bc402a87d660ea349aa5636caac368
SSDEEP 768:2S6u/JE7FlrTCkaSQ4FoS5vBAYSjPfA09S78w1eH+1:2S6mGmC8YSjPt9pw1/
TLSH
T1C8862A16565524ECC262F2B9D79F2A42D672784D33616BDF23C0B0DA0F2F6C069F7826
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Liamous\Desktop\Project\penis\x64\Release\penis.pdb

kernel32

WideCharToMultiByte SetConsoleOutputCP GetModuleHandleW Sleep GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetConsoleCP QueryPerformanceCounter MultiByteToWideChar SetUnhandledExceptionFilter

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?good@ios_base@std@@QEBA_NXZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z

iphlpapi

GetTcpTable GetAdaptersInfo

ws2_32

ntohs

winhttp

WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpSendRequest WinHttpConnect WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpCloseHandle

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memset memcpy memcmp __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc __p___argv _set_app_type _register_thread_local_exe_atexit_callback _initterm_e _seh_filter_exe _register_onexit_function terminate _initialize_onexit_table _initterm _initialize_narrow_environment _configure_narrow_argv _get_initial_narrow_environment _cexit _c_exit _crt_atexit exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

strncmp strlen wcslen

Name

.text

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bigdata

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nulluty.exe

kernel32

msvcp140

iphlpapi

ws2_32

winhttp

vcruntime140_1

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

generic