NYX_ABYSS[.]exe | Triage™

General

Target
NYX_ABYSS.exe
Size 253KB
Sample260814-ekcklsfa84
SHA256 ac47e338e30438d342ba00746c22ea398f596b7b59f3be66ef196fe8f62a9d41
MD5 07ab4204a188c299b82eceb1c729c115
SHA1 23f6b4921239d4b29639689036db4b4b8841db73
SHA512 b047e6f168fe3a2f05bf245f7415de3573c589e70aa8529d6b427f69586263c0e2f0ceb76f7beb5c1615b1180c5d00f57b3fce5fef4fd00a4854403aa9b1166c
SSDEEP 3072:oJuc1p0BRLSh1/44pJLn+7VcSOY7RwItqj/aylAppgTfwsD5yKR7tjBD4dS:6uNj+14k+JzOi1tqGp2LwCyKRwd
TLSH
T106446B1776941CF8FC6BC03DC6558657A67378860B31EAEF02A442292F27AE16F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NYX_ABYSS.exe

File Explorer

NYX_ABYSS.exe

.exe 253KB

NYX_ABYSS.exe

IMPHASH 67a0f20727f552586c5ce66691250e41
SHA256 ac47e338e30438d342ba00746c22ea398f596b7b59f3be66ef196fe8f62a9d41
MD5 07ab4204a188c299b82eceb1c729c115
SHA1 23f6b4921239d4b29639689036db4b4b8841db73
SHA512 b047e6f168fe3a2f05bf245f7415de3573c589e70aa8529d6b427f69586263c0e2f0ceb76f7beb5c1615b1180c5d00f57b3fce5fef4fd00a4854403aa9b1166c
SSDEEP 3072:oJuc1p0BRLSh1/44pJLn+7VcSOY7RwItqj/aylAppgTfwsD5yKR7tjBD4dS:6uNj+14k+JzOi1tqGp2LwCyKRwd
TLSH
T106446B1776941CF8FC6BC03DC6558657A67378860B31EAEF02A442292F27AE16F3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

105452

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nyx_abyss.pdb

kernel32

CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject CloseHandle Sleep IsDebuggerPresent AddVectoredExceptionHandler CreateThread GetStdHandle GetLastError GetConsoleMode WideCharToMultiByte RemoveVectoredExceptionHandler RaiseException SetLastError GetModuleFileNameW GetFullPathNameW GetModuleHandleW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx GetCurrentProcess CheckRemoteDebuggerPresent SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency FormatMessageW QueryPerformanceCounter GetModuleHandleA ReadConsoleW SetFilePointerEx FlushFileBuffers HeapSize LCMapStringW CompareStringW GetSystemTimeAsFileTime InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile NtQueryInformationProcess

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

Name

.text

Size

159KB

Virtual Size

158KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.seal

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

NYX_ABYSS.exe

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

generic