NieRAutomata[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NieRAutomata.exe
Size 16.8MB
Sample260728-e7313sywes
SHA256 c9904a39e448d6cb3c98c28a90159cf9314753b0cfea5ceb4e76a12d3308a355
MD5 1b0a6667d4ff18b0b596a1cf08c45f4e
SHA1 9a329ae264a70e8c50c461e8b85cf45f4018f2ad
SHA512 90846319703ec862044cf2c26ba294b5cb1f0d59dc167c028a0fa8457d16096518026541930cb8e3118beeb86e75d9ad0d0a80278bd55901a831f1a4913e5d0f
SSDEEP 196608:mlqYf96l6uixic4sMFk757yyoAmhoPU4kjE1NWDp5:ml/fkl1SiPsoc57yyoRhoPU4iE1c
TLSH
T1CE078C8A37B590D9D027E038D957A61FE5B270140B319BCB06A10B5E6FB37E15EBB231
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NieRAutomata.exe

File Explorer

NieRAutomata.exe

.exe 16.8MB

NieRAutomata.exe

IMPHASH 0c27e69ce82c3aa4eb1d8dc636bdea4c
SHA256 c9904a39e448d6cb3c98c28a90159cf9314753b0cfea5ceb4e76a12d3308a355
MD5 1b0a6667d4ff18b0b596a1cf08c45f4e
SHA1 9a329ae264a70e8c50c461e8b85cf45f4018f2ad
SHA512 90846319703ec862044cf2c26ba294b5cb1f0d59dc167c028a0fa8457d16096518026541930cb8e3118beeb86e75d9ad0d0a80278bd55901a831f1a4913e5d0f
SSDEEP 196608:mlqYf96l6uixic4sMFk757yyoAmhoPU4kjE1NWDp5:ml/fkl1SiPsoc57yyoRhoPU4iE1c
TLSH
T1CE078C8A37B590D9D027E038D957A61FE5B270140B319BCB06A10B5E6FB37E15EBB231
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10312228

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\project\PRJ_028\p2\common\project\build\exe\x64\Release\PRJ_028_gdk.pdb

kernel32

WideCharToMultiByte MultiByteToWideChar GetUserDefaultLocaleName CreateEventA CloseHandle LeaveCriticalSection EnterCriticalSection DeleteCriticalSection RtlUnwind GetLastError DecodePointer WriteConsoleW HeapSize SetStdHandle GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW SetCriticalSectionSpinCount GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP HeapReAlloc GetTimeZoneInformation GetStringTypeW LCMapStringW CompareStringW GetFileType GetStdHandle GetModuleFileNameW ExitProcess SystemTimeToTzSpecificLocalTime FindNextFileW FindFirstFileExW GetModuleHandleExW FreeLibraryAndExitThread ExitThread GetCPInfo LoadLibraryExW GetEnvironmentStringsW InitializeCriticalSection EncodePointer InterlockedPushEntrySList RtlPcToFileHeader RtlUnwindEx WaitForMultipleObjectsEx SleepEx VerifyVersionInfoW VerSetConditionMask Sleep GetPrivateProfileStructA WritePrivateProfileStructA HeapDestroy HeapCreate HeapAlloc HeapFree CreateFileA FileTimeToSystemTime GetFileSize ReadFile WriteFile GetFileAttributesA DeleteFileA CreateDirectoryA CreateMutexA ReleaseMutex IsDebuggerPresent GetModuleFileNameA SetLastError GetCurrentThreadId GetModuleHandleA QueryPerformanceFrequency QueryPerformanceCounter GetLocalTime FindFirstFileA FindNextFileA FindClose GlobalAlloc GlobalSize GlobalFree CreateSemaphoreA WaitForSingleObject ReleaseSemaphore SetThreadPriority ResumeThread OpenThread SwitchToThread SetEvent SetCurrentDirectoryA GlobalLock GlobalUnlock IsBadWritePtr GetFileTime SetFilePointer CreateFileW FlushFileBuffers GetACP InitializeCriticalSectionAndSpinCount ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead CreateDirectoryW DebugBreak CreateThread GetCurrentThread GetSystemInfo SetThreadAffinityMask LoadLibraryA TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcessAffinityMask SetErrorMode GetModuleHandleExA DeleteFileW GetFileAttributesW SetEndOfFile MoveFileA MoveFileW GetTickCount GetThreadPriority GetExitCodeThread FreeLibrary LoadLibraryW RaiseException

user32

GetClientRect MessageBoxW GetSystemMetrics GetWindowRect SetWindowLongPtrW GetWindowLongPtrW GetForegroundWindow CallWindowProcW UnregisterDeviceNotification RegisterDeviceNotificationW GetKeyState GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard SwapMouseButton ShowCursor ScreenToClient GetCursorPos ClipCursor GetAsyncKeyState GetKeyboardLayout SetCursorPos EndPaint BeginPaint GetDC GetDesktopWindow SendMessageA UpdateWindow GetWindowLongA SetWindowLongPtrA AdjustWindowRect SetWindowPos GetMonitorInfoW GetDisplayConfigBufferSizes QueryDisplayConfig DisplayConfigGetDeviceInfo MessageBoxA ClientToScreen PostQuitMessage ShowWindow DefWindowProcA GetWindowLongPtrA DestroyWindow UnregisterClassA LoadIconA LoadCursorA RegisterClassExA CreateWindowExA PeekMessageA TranslateMessage DispatchMessageA

shell32

SHGetSpecialFolderPathA

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory

steam_api64

SteamInternal_CreateInterface SteamAPI_GetHSteamPipe SteamAPI_GetHSteamUser SteamInternal_ContextInit SteamAPI_Shutdown SteamAPI_Init SteamAPI_RegisterCallResult SteamAPI_UnregisterCallResult SteamAPI_RegisterCallback SteamAPI_UnregisterCallback SteamAPI_RunCallbacks SteamAPI_IsSteamRunning

winmm

timeBeginPeriod timeGetTime timeEndPeriod

dinput8

DirectInput8Create

xinput1_4

ord3 ord2

setupapi

SetupDiGetDeviceInterfaceDetailW SetupDiEnumDeviceInterfaces SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiGetDeviceInstanceIdW

gdi32

GetObjectA GetDeviceCaps

ole32

CoTaskMemAlloc CoTaskMemFree OleInitialize CreateStreamOnHGlobal OleUninitialize CoInitialize CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx CoCreateGuid

oleaut32

VariantClear SysAllocString OleLoadPicture SysFreeString VariantInit

Name

.text

Size

12.1MB

Virtual Size

12.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.9MB

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

749KB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

629KB

Virtual Size

632KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

37KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

260KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

141KB

Virtual Size

144KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NieRAutomata.exe

kernel32

user32

shell32

d3d11

dxgi

steam_api64

winmm

dinput8

xinput1_4

setupapi

gdi32

ole32

oleaut32

generic