NopexProLXARKdy[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
NopexProLXARKdy.dll
Size 941KB
Sample260724-p82jragc44
SHA256 8d1885df1cbab346580d14fe64589c4d8a7c6bc15720ba3b3b85566374b4c6e5
MD5 af72320c30686df47f007c95373ce9a5
SHA1 0853997356ac1cce045e0fbb370f5618549ebfd9
SHA512 c257813d1344f911e8a628fb54ea82b9493f361e7afea3e5fff6278287997cfe15f8100607a753a18d22d9b8ae64e3123407a47aca82f177e63661891f9d0bfc
SSDEEP 12288:tJrwyNMqhj584MZDRCY//ZQxlzJMOalZ0vHzf0YkGv94QFhSHGTrpv5:tJ9uqJ584MrCYfO2GTMunTrpv5
TLSH
T1E8258C833AD60CBBD9532B3955DF533A7735FEA04B2A4F2B4504C6322C13AD0AE5AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NopexProLXARKdy.dll

File Explorer

NopexProLXARKdy.dll

.dll 941KB

NopexProLXARKdy.dll

IMPHASH d2c12038c00247850cab04ca85020165
SHA256 8d1885df1cbab346580d14fe64589c4d8a7c6bc15720ba3b3b85566374b4c6e5
MD5 af72320c30686df47f007c95373ce9a5
SHA1 0853997356ac1cce045e0fbb370f5618549ebfd9
SHA512 c257813d1344f911e8a628fb54ea82b9493f361e7afea3e5fff6278287997cfe15f8100607a753a18d22d9b8ae64e3123407a47aca82f177e63661891f9d0bfc
SSDEEP 12288:tJrwyNMqhj584MZDRCY//ZQxlzJMOalZ0vHzf0YkGv94QFhSHGTrpv5:tJ9uqJ584MrCYfO2GTMunTrpv5
TLSH
T1E8258C833AD60CBBD9532B3955DF533A7735FEA04B2A4F2B4504C6322C13AD0AE5AB51
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

enginar

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

AddVectoredExceptionHandler CloseHandle CloseThreadpoolWork CreateProcessA CreateThreadpoolWork DeleteCriticalSection DeleteProcThreadAttributeList DisableThreadLibraryCalls EnterCriticalSection FindResourceA FormatMessageA GetCPInfo GetCurrentThread GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetThreadId GetTickCount HeapAlloc HeapFree InitializeCriticalSection InitializeProcThreadAttributeList LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LocalFree LockResource MultiByteToWideChar OpenProcess RaiseException ReadProcessMemory ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadContext SizeofResource Sleep SubmitThreadpoolWork TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UpdateProcThreadAttribute VirtualProtect VirtualQuery WideCharToMultiByte lstrcmpiW

msvcrt

___lc_codepage_func ___mb_cur_max_func __iob_func _amsg_exit _errno _initterm _lock _unlock _wcsicmp abort calloc fprintf fputc fputs free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset realloc strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen wcsrchr _read

RtlSecureZeroMemory RunIndirectSyscall _GCC_specific_handler _Unwind_Backtrace _Unwind_DeleteException _Unwind_FindEnclosingFunction _Unwind_ForcedUnwind _Unwind_GetCFA _Unwind_GetDataRelBase _Unwind_GetGR _Unwind_GetIP _Unwind_GetIPInfo _Unwind_GetLanguageSpecificData _Unwind_GetRegionStart _Unwind_GetTextRelBase _Unwind_RaiseException _Unwind_Resume _Unwind_Resume_or_Rethrow _Unwind_SetGR _Unwind_SetIP _Z12UnlinkModulev _Z13DecryptAES256RKSt6vectorIhSaIhEERS1_S3_ _Z14GetExplorerPIDv _Z14SafeMaskMemoryPvyc _Z15BypassTelemetryv _Z16ExecuteInjectionv _Z18EarlyBirdAPCHijackPvS_ _Z19GetRemoteModuleBasePvPKw _Z20CreateProcessSpoofedmP20_PROCESS_INFORMATION _Z22ToggleMemoryEncryptionPvyc _ZN13SyscallEngine10HashStringEPKc _ZN13SyscallEngine11WriteSecureEPvS0_S0_yPy _ZN13SyscallEngine13ProtectSecureEPvymPm _ZN13SyscallEngine17GetSyscallAddressEm _ZN13SyscallEngine17GetValidRetGadgetEv _ZN13SyscallEngine18GetCleanAddrByHashEm _ZN13SyscallEngine19ETWExceptionHandlerEP19_EXCEPTION_POINTERS _ZN13SyscallEngine19PrepareSpoofedStackEv _ZN13SyscallEngine21GetRandomModuleExportEv _ZN13SyscallEngine24QueryVirtualMemorySecureEPvS0_iS0_yPy _ZN13SyscallEngine6GetSSNEm _ZNKSt12_Vector_baseIhSaIhEE19_M_get_Tp_allocatorEv _ZNKSt16initializer_listIhE3endEv _ZNKSt16initializer_listIhE4sizeEv _ZNKSt16initializer_listIhE5beginEv _ZNKSt6vectorIhSaIhEE11_M_data_ptrIhEEPT_S4_ _ZNKSt6vectorIhSaIhEE12_M_check_lenEyPKc _ZNKSt6vectorIhSaIhEE3endEv _ZNKSt6vectorIhSaIhEE4dataEv _ZNKSt6vectorIhSaIhEE4sizeEv _ZNKSt6vectorIhSaIhEE5beginEv _ZNKSt6vectorIhSaIhEE8max_sizeEv _ZNKSt6vectorIwSaIwEE11_M_data_ptrIwEEPT_S4_ _ZNSt12_Vector_baseIhSaIhEE11_M_allocateEy _ZNSt12_Vector_baseIhSaIhEE12_Vector_implC1ERKS0_ _ZNSt12_Vector_baseIhSaIhEE12_Vector_implC1Ev _ZNSt12_Vector_baseIhSaIhEE12_Vector_implD1Ev _ZNSt12_Vector_baseIhSaIhEE13_M_deallocateEPhy _ZNSt12_Vector_baseIhSaIhEE17_M_create_storageEy _ZNSt12_Vector_baseIhSaIhEE17_Vector_impl_dataC2Ev _ZNSt12_Vector_baseIhSaIhEE19_M_get_Tp_allocatorEv _ZNSt12_Vector_baseIhSaIhEEC2ERKS0_ _ZNSt12_Vector_baseIhSaIhEEC2Ev _ZNSt12_Vector_baseIhSaIhEEC2EyRKS0_ _ZNSt12_Vector_baseIhSaIhEED2Ev _ZNSt12_Vector_baseIwSaIwEE11_M_allocateEy _ZNSt12_Vector_baseIwSaIwEE12_Vector_implC1ERKS0_ _ZNSt12_Vector_baseIwSaIwEE12_Vector_implD1Ev _ZNSt12_Vector_baseIwSaIwEE13_M_deallocateEPwy _ZNSt12_Vector_baseIwSaIwEE17_M_create_storageEy _ZNSt12_Vector_baseIwSaIwEE17_Vector_impl_dataC2Ev _ZNSt12_Vector_baseIwSaIwEE19_M_get_Tp_allocatorEv _ZNSt12_Vector_baseIwSaIwEEC2EyRKS0_ _ZNSt12_Vector_baseIwSaIwEED2Ev _ZNSt15__new_allocatorIhE10deallocateEPhy _ZNSt15__new_allocatorIhE8allocateEyPKv _ZNSt15__new_allocatorIhED2Ev _ZNSt15__new_allocatorIwE10deallocateEPwy _ZNSt15__new_allocatorIwE8allocateEyPKv _ZNSt15__new_allocatorIwED2Ev _ZNSt19_UninitDestroyGuardIPwvE7releaseEv _ZNSt19_UninitDestroyGuardIPwvEC1ERS0_ _ZNSt19_UninitDestroyGuardIPwvED1Ev _ZNSt27__uninitialized_default_n_1ILb1EE18__uninit_default_nIPhyEET_S3_T0_ _ZNSt6vectorIhSaIhEE11_S_max_sizeERKS0_ _ZNSt6vectorIhSaIhEE11_S_relocateEPhS2_S2_RS0_ _ZNSt6vectorIhSaIhEE12_Guard_allocC1EPhyRSt12_Vector_baseIhS0_E _ZNSt6vectorIhSaIhEE12_Guard_allocD1Ev _ZNSt6vectorIhSaIhEE15_M_erase_at_endEPh _ZNSt6vectorIhSaIhEE17_M_default_appendEy _ZNSt6vectorIhSaIhEE17_S_check_init_lenEyRKS0_ _ZNSt6vectorIhSaIhEE19_M_range_initializeIPhEEvT_S4_St20forward_iterator_tag _ZNSt6vectorIhSaIhEE21_M_range_initialize_nIPKhS4_EEvT_T0_y _ZNSt6vectorIhSaIhEE21_M_range_initialize_nIPhS3_EEvT_T0_y _ZNSt6vectorIhSaIhEE4dataEv _ZNSt6vectorIhSaIhEE6resizeEy _ZNSt6vectorIhSaIhEEC1ERKS1_ _ZNSt6vectorIhSaIhEEC1ESt16initializer_listIhERKS0_ _ZNSt6vectorIhSaIhEEC1Ev _ZNSt6vectorIhSaIhEEC1IPhvEET_S4_RKS0_ _ZNSt6vectorIhSaIhEED1Ev _ZNSt6vectorIwSaIwEE11_S_max_sizeERKS0_ _ZNSt6vectorIwSaIwEE17_S_check_init_lenEyRKS0_ _ZNSt6vectorIwSaIwEE18_M_fill_initializeEyRKw _ZNSt6vectorIwSaIwEE4dataEv _ZNSt6vectorIwSaIwEEC1EyRKwRKS0_ _ZNSt6vectorIwSaIwEED1Ev _ZSt10_ConstructIhJEEvPT_DpOT0_ _ZSt10_ConstructIwJRKwEEvPT_DpOT0_ _ZSt12__relocate_aIPhS0_SaIhEET0_T_S3_S2_RT1_ _ZSt14__relocate_a_1IhhENSt9enable_ifIXsrSt24__is_bitwise_relocatableIT_vE5valueEPS2_E4typeES4_S4_S4_RSaIT0_E _ZSt17__size_to_integery _ZSt18__do_uninit_fill_nIPwywET_S1_T0_RKT1_ _ZSt18uninitialized_copyIN9__gnu_cxx17__normal_iteratorIPKhSt6vectorIhSaIhEEEEPhET0_T_SA_S9_ _ZSt18uninitialized_copyIPKhPhET0_T_S4_S3_ _ZSt18uninitialized_copyIPhS0_ET0_T_S2_S1_ _ZSt20uninitialized_fill_nIPwywET_S1_T0_RKT1_ _ZSt22__uninitialized_copy_aIN9__gnu_cxx17__normal_iteratorIPKhSt6vectorIhSaIhEEEES7_PhhET1_T_T0_S9_RSaIT2_E _ZSt22__uninitialized_copy_aIPKhS1_PhhET1_T_T0_S3_RSaIT2_E _ZSt22__uninitialized_copy_aIPhS0_S0_hET1_T_T0_S1_RSaIT2_E _ZSt24__uninitialized_fill_n_aIPwywwET_S1_T0_RKT1_RSaIT2_E _ZSt25__uninitialized_default_nIPhyET_S1_T0_ _ZSt27__uninitialized_default_n_aIPhyhET_S1_T0_RSaIT1_E _ZSt3maxIyERKT_S2_S2_ _ZSt3minIyERKT_S2_S2_ _ZSt8_DestroyIPhEvT_S1_ _ZSt8_DestroyIPwEvT_S1_ _ZSt9__fill_a1IhhEN9__gnu_cxx11__enable_ifIXaasrSt9__is_byteIT_E7__valueoosrSt10__are_sameIS3_T0_E7__valuesrSt20__memcpyable_integerIS6_E7__widthEvE6__typeEPS3_SC_RKS6_ _ZdlPvS_ _ZnwyPv __emutls_get_address __emutls_register_common

Name

.text

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

322KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

431B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/113

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NopexProLXARKdy.dll

bcrypt

kernel32

msvcrt

generic