4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056

Sharing

Copy URL Twitter E-mail

General

Target
4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056
Size 7.2MB
Sample260722-yn5kcatemc
SHA256 4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056
MD5 420d615ea419fde1d500354b99a13d57
SHA1 8d4e5853fbb38ff25bb3a61717e03b0df12d7798
SHA512 39703c205c52ede96cf36c029ee63a5c6c3b78b66e31146d68585c0a4b0dd38f5994e572f9c6e6ef0c8984e8335167e74d710cf0a229f0f3d5bf299f7ce7e5e3
SSDEEP 98304:Y25hnUEPTYK9qRJ/+QfzvuZMG3TrlaoNHkT86PyrnPTcijpjcrApQegnaRkozogi:939omZXBNHk46PyrFFLZyUko0edLeZ
TLSH
T18976F113FB818432CBD3017556A6D77E8A7A65300735C2C3F7A4257A8E31AD1E73A3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056

File Explorer

4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056

.exe 7.2MB

4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056

IMPHASH 095308d7b7e19697e8d43e81069c27d4
SHA256 4a80ab116c3db23cb8fdc5f1d88ce61eef0915f0955b5acb39c9aaed8585f056
MD5 420d615ea419fde1d500354b99a13d57
SHA1 8d4e5853fbb38ff25bb3a61717e03b0df12d7798
SHA512 39703c205c52ede96cf36c029ee63a5c6c3b78b66e31146d68585c0a4b0dd38f5994e572f9c6e6ef0c8984e8335167e74d710cf0a229f0f3d5bf299f7ce7e5e3
SSDEEP 98304:Y25hnUEPTYK9qRJ/+QfzvuZMG3TrlaoNHkT86PyrnPTcijpjcrApQegnaRkozogi:939omZXBNHk46PyrFFLZyUko0edLeZ
TLSH
T18976F113FB818432CBD3017556A6D77E8A7A65300735C2C3F7A4257A8E31AD1E73A3A9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2276767

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\packingworkspace\1667529944144\appsInstall\apps\bin\OutPut\Nox\NoxPack.pdb

kernel32

TryEnterCriticalSection DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree CreateIoCompletionPort GetQueuedCompletionStatus PostQueuedCompletionStatus GetModuleHandleExA GetCurrentThreadId SetThreadPriority GetPrivateProfileStringA lstrcpynW GlobalMemoryStatusEx RaiseException SetLastError InitializeCriticalSectionAndSpinCount lstrcmpW GetSystemDefaultLangID GetVersion GetUserDefaultLCID GetCommandLineW GetEnvironmentVariableA GetDriveTypeW DecodePointer SetUnhandledExceptionFilter ExitProcess GetLocalTime LoadLibraryExW SetEvent ResetEvent CreateEventW CreateFileA CompareFileTime CreateDirectoryA GetFileTime SetFileAttributesA GetModuleFileNameA SetEndOfFile QueueUserWorkItem GetStartupInfoW GetSystemInfo GetACP FormatMessageA InitializeCriticalSectionEx SleepEx VerSetConditionMask QueryPerformanceFrequency GetSystemDirectoryW VerifyVersionInfoW QueryPerformanceCounter WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle PeekNamedPipe WaitForMultipleObjects GetEnvironmentVariableW GetConsoleMode ReadConsoleA ReadConsoleW SetConsoleMode GetModuleHandleExW TerminateThread GetSystemTimeAsFileTime SwitchToFiber DeleteFiber CreateFiber LoadLibraryA ConvertFiberToThread LeaveCriticalSection CreateThread GetCurrentProcessId WaitForSingleObject GetLastError RemoveDirectoryW ReadFile GetVolumeInformationW WriteConsoleW GetModuleHandleW InitializeCriticalSection SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW FindFirstFileExA GetTimeZoneInformation GetFullPathNameA GetFullPathNameW FlushFileBuffers HeapSize SetStdHandle EnumSystemLocalesW IsValidLocale GetTimeFormatW GetDateFormatW GetCurrentThread GetConsoleCP HeapReAlloc SetConsoleCtrlHandler SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetCommandLineA FreeLibraryAndExitThread ResumeThread ExitThread GetFileAttributesExW InterlockedFlushSList RtlUnwind LoadLibraryExA VirtualFree VirtualAlloc FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList GetProcessHeap HeapFree HeapAlloc InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess UnhandledExceptionFilter GetLocaleInfoW LCMapStringW CompareStringW GetCPInfo EncodePointer GetStringTypeW Process32NextW Process32FirstW CreateToolhelp32Snapshot lstrcatW lstrcpyW lstrcmpiW lstrcmpiA OpenProcess ConvertThreadToFiber EnterCriticalSection GetModuleFileNameW GetTickCount GetLongPathNameW FindNextFileW FindFirstFileW FindClose CreateDirectoryW WideCharToMultiByte WritePrivateProfileStructW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetPrivateProfileStringW GetPrivateProfileIntW DeleteFileW lstrlenW MulDiv LocalFree LocalAlloc CloseHandle WriteFile SetFileAttributesW CreateFileW FindResourceW GlobalFree GlobalUnlock GlobalLock GlobalAlloc SizeofResource FreeResource LockResource LoadResource GetExitCodeProcess Sleep CreatePipe SetHandleInformation OutputDebugStringW DebugBreak RemoveDirectoryA QueryDosDeviceW GetTempFileNameW GetLogicalDriveStringsW GetFileSize FindNextFileA FindFirstFileA DeleteFileA SetCurrentDirectoryW DosDateTimeToFileTime GetCurrentProcess DuplicateHandle SetFileTime SetFilePointer GetFileType GetCurrentDirectoryW lstrlenA lstrcpyA lstrcpynA GetTempPathW GetDiskFreeSpaceExW DeviceIoControl SystemTimeToFileTime LoadLibraryW GetProcAddress FreeLibrary GetSystemTime GetVersionExW MultiByteToWideChar MoveFileExW SetEnvironmentVariableW CopyFileW CreateProcessW OutputDebugStringA SuspendThread FormatMessageW

user32

GetWindowRect SendMessageW GetDesktopWindow ReleaseDC GetDC LoadStringW FillRect GetMonitorInfoW EnumDisplaySettingsW GetClipboardData RegisterClipboardFormatW IsClipboardFormatAvailable GetAsyncKeyState SetCapture ReleaseCapture SetCursor GetCursorPos CreateCaret HideCaret ShowCaret SetCaretPos ClientToScreen GetSysColor IntersectRect UnionRect PtInRect RegisterWindowMessageW PostThreadMessageW FindWindowW MonitorFromWindow SystemParametersInfoW TrackMouseEvent IsIconic IsWindowEnabled wsprintfW MapWindowPoints CopyRect SetWindowPos OpenClipboard CloseClipboard SetClipboardData EmptyClipboard GetSystemMetrics GetParent FindWindowExW GetWindowThreadProcessId TranslateMessage DispatchMessageW PeekMessageW AttachThreadInput BringWindowToTop SetActiveWindow GetForegroundWindow SetForegroundWindow MessageBoxW CharNextW PostMessageW WaitMessage DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW CreateWindowExW DestroyWindow GetQueueStatus MsgWaitForMultipleObjectsEx SetTimer KillTimer IsRectEmpty CallWindowProcW GetClassInfoExW IsWindow ShowWindow SetFocus SetWindowTextW GetWindowTextW GetWindowTextLengthW GetWindowLongW SetWindowLongW LoadCursorW BeginPaint EndPaint InvalidateRect DrawIcon DrawTextW LoadImageW DrawIconEx GetFocus GetKeyState GetClientRect UpdateWindow GetMessagePos IsZoomed EnableWindow SetWindowRgn ScreenToClient OffsetRect ChangeDisplaySettingsW GetProcessWindowStation GetUserObjectInformationW GetWindow SetClassLongW

gdi32

SetViewportOrgEx SetBkColor MoveToEx GetObjectA SetTextColor RoundRect Rectangle LineTo SetBkMode GetTextExtentPoint32W GetCurrentObject GetClipBox ExcludeClipRect CreateSolidBrush SetWindowOrgEx CreateFontIndirectW DeleteObject CreatePatternBrush CreateFontW CreateCompatibleBitmap GetObjectW CreateDIBSection SelectObject GetDIBits GetDeviceCaps DeleteDC CreateCompatibleDC BitBlt GetStockObject CombineRgn CreateRectRgn CreateRoundRectRgn CreateRectRgnIndirect SelectClipRgn GdiSetBatchLimit CreatePen StretchBlt

comdlg32

GetOpenFileNameW GetSaveFileNameW

advapi32

RegDeleteValueW RegCloseKey RegCreateKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW SetEntriesInAclW GetNamedSecurityInfoW SetNamedSecurityInfoW RegDeleteKeyW RegEnumKeyExW RegQueryInfoKeyW DeregisterEventSource RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptCreateHash CryptDestroyHash CryptSignHashW CryptEnumProvidersW OpenProcessToken CreateProcessAsUserW SetTokenInformation DuplicateTokenEx AllocateAndInitializeSid FreeSid GetLengthSid CreateWellKnownSid

shell32

SHBrowseForFolderW SHGetSpecialFolderLocation SHGetPathFromIDListW CommandLineToArgvW Shell_NotifyIconW SHFileOperationW ShellExecuteW SHGetSpecialFolderPathW SHGetSpecialFolderPathA SHGetMalloc

ole32

CoInitialize CoTaskMemFree CoTaskMemRealloc CoTaskMemAlloc CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes CoLoadLibrary StringFromGUID2 CoInitializeEx CoUninitialize CoCreateInstance CreateStreamOnHGlobal

oleaut32

OleLoadPicture SysFreeString VarUI4FromStr GetErrorInfo VariantClear VariantInit VariantChangeType SetErrorInfo CreateErrorInfo SysAllocString

shlwapi

SHRegSetUSValueA PathAppendW PathCanonicalizeW PathFindExtensionW PathIsDirectoryW PathIsRootW SHRegGetUSValueA PathMatchSpecW PathRemoveExtensionW PathRemoveFileSpecW SHGetValueW PathIsDirectoryEmptyW PathAppendA PathCombineA PathFileExistsA PathFindFileNameA PathIsDirectoryA StrStrIW StrStrW PathFileExistsW PathRemoveFileSpecA PathFindFileNameW StrCmpIW PathAddBackslashW

comctl32

InitCommonControlsEx

msimg32

TransparentBlt AlphaBlend

gdiplus

GdipSetStringFormatFlags GdipSetStringFormatAlign GdipSetStringFormatLineAlign GdipSetStringFormatTrimming GdipDeleteStringFormat GdipCreateStringFormat GdipDrawString GdipCreateBitmapFromHBITMAP GdipDeleteFont GdipCreateFontFromDC GdipDrawImageRectI GdipFillPath GdipFillRectangleI GdipDrawPath GdipDrawRectangleI GdipDrawLineI GdipSetTextRenderingHint GdipReleaseDC GdipSetImageAttributesColorKeys GdipGetPropertyItem GdipCreateFontFromLogfontA GdipImageSelectActiveFrame GdipImageGetFrameCount GdipImageGetFrameDimensionsList GdipImageGetFrameDimensionsCount GdipDeletePen GdipCreatePen1 GdipCreateSolidFill GdipTranslateTextureTransform GdipCreateTexture2I GdipDeleteBrush GdipCloneBrush GdipAddPathArcI GdipAddPathLineI GdipDeletePath GdipClonePath GdipCreatePath GdiplusShutdown GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromFileICM GdipCreateBitmapFromStreamICM GdipCreateBitmapFromFile GdipCreateBitmapFromStream GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdipLoadImageFromFileICM GdipLoadImageFromFile GdipDrawImageRectRectI GdipSetInterpolationMode GdipDeleteGraphics GdipCreateFromHDC GdipDisposeImageAttributes GdipCreateImageAttributes GdipGetImageHeight GdipGetImageWidth GdipDisposeImage GdipCloneImage GdipLoadImageFromStreamICM GdipLoadImageFromStream GdiplusStartup GdipFree GdipAlloc GdipGetPropertyItemSize

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

wininet

InternetReadFile HttpQueryInfoW InternetSetOptionW InternetSetCookieA InternetSetCookieW InternetErrorDlg InternetGetCookieW InternetOpenA InternetConnectW InternetOpenUrlA HttpOpenRequestW HttpSendRequestA InternetOpenUrlW InternetCloseHandle InternetOpenW InternetCrackUrlW

netapi32

Netbios

iphlpapi

GetAdaptersInfo

psapi

GetProcessImageFileNameW

dbghelp

MiniDumpWriteDump

crypt32

CertFreeCertificateContext CertDuplicateCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateContextProperty

winmm

timeGetTime

bcrypt

BCryptGenRandom

ws2_32

bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError WSAIoctl WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo accept listen recvfrom sendto ioctlsocket gethostname gethostbyname getnameinfo send recv socket WSAGetLastError shutdown

wldap32

ord147 ord133 ord79 ord142 ord301 ord127 ord27 ord26 ord118 ord41 ord167 ord208 ord216 ord14 ord46 ord219 ord145

generic

count=16, id=241, version=40116,

count=187, id=243, version=40116,

count=29, id=242, version=40116,

count=1, id=264, version=24215,

count=17, id=170, productName=VS2010 build 30319, version=30319,

count=10, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=1, id=209, version=65501,

count=3, id=261, version=23013,

count=6, id=199, version=41118,

count=26, id=259, version=24123,

count=72, id=261, version=24123,

count=36, id=260, version=24123,

count=6, id=206, version=65501,

count=1, id=208, version=65501,

count=666, id=260, productName=VS2015 UPD3.1 build 24215, version=24215,

count=47, id=203, version=65501,

count=594, id=1, productName=Unmarked objects,

count=108, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,

count=1, id=151,

count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,