nighty[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
nighty.exe
Size 5.4MB
Sample260822-pphmjayxfx
SHA256 9445766d9bfa39ca4e09c8d3f8edde467ebcb92f0e5d52e6febdc19bc4fb27e7
MD5 7949152783e09907a16df9bad75bd0b9
SHA1 75b3b62f7c70523017b13013ee950e31cf399fc7
SHA512 878a5daaac4a8619f9c87debefc9352e2ff84f5eb194f6c75051177da3eed07c1cf78bae5e79e1cf3bb943cc6c8c58058d88ddd68367756cc33fd8326600dc2d
SSDEEP 49152:uIeHPFxqxEHkVB5rCIs4Q0cv8o5StB6to:uIw7KaILEAtBi
TLSH
T1A8464046A7F58275C8B6C2BD553F5331A83B3D4CD624E27647A8C31537E0330A2AEB96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nighty.exe

File Explorer

nighty.exe

.exe 5.4MB

nighty.exe

IMPHASH 88ae4bcecfaa52cb2285084d99ff3c92
SHA256 9445766d9bfa39ca4e09c8d3f8edde467ebcb92f0e5d52e6febdc19bc4fb27e7
MD5 7949152783e09907a16df9bad75bd0b9
SHA1 75b3b62f7c70523017b13013ee950e31cf399fc7
SHA512 878a5daaac4a8619f9c87debefc9352e2ff84f5eb194f6c75051177da3eed07c1cf78bae5e79e1cf3bb943cc6c8c58058d88ddd68367756cc33fd8326600dc2d
SSDEEP 49152:uIeHPFxqxEHkVB5rCIs4Q0cv8o5StB6to:uIw7KaILEAtBi
TLSH
T1A8464046A7F58275C8B6C2BD553F5331A83B3D4CD624E27647A8C31537E0330A2AEB96
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4318316

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\kendrick\Desktop\projeler\antivm\x64\Release\antivm.pdb

kernel32

GetSystemFirmwareTable SetThreadAffinityMask GetCurrentThread CloseHandle GetFileAttributesA VirtualFree VirtualAlloc CreateFileA WideCharToMultiByte LocalFree RtlCaptureContext GetModuleHandleW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError

advapi32

RegOpenKeyExA RegEnumKeyExA RegCloseKey RegQueryValueExA

ole32

CoSetProxyBlanket CoCreateInstance CoUninitialize CoInitializeEx

oleaut32

SysAllocString SysFreeString VariantInit VariantClear

msvcp140

?_Throw_Cpp_error@std@@YAXH@Z _Cnd_broadcast ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A _Cnd_do_broadcast_at_thread_exit _Cnd_wait _Mtx_unlock _Mtx_lock _Thrd_id _Thrd_join ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z

pdh

PdhGetFormattedCounterValue PdhCollectQueryData PdhCloseQuery PdhRemoveCounter PdhAddCounterA PdhOpenQueryW

vcruntime140

__current_exception_context __current_exception __std_exception_copy __std_exception_destroy _CxxThrowException memchr memcmp memmove memcpy memset __std_terminate __C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit _register_thread_local_exe_atexit_callback __p___argc _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit _set_app_type _exit __p___argv _configure_narrow_argv _invoke_watson exit _initterm_e _beginthreadex terminate _initterm

api-ms-win-crt-heap-l1-1-0

free _aligned_free _aligned_malloc _callnewh _set_new_mode malloc

api-ms-win-crt-math-l1-1-0

exp sqrt __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale