Nex (2)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nex (2).exe
Size 2.6MB
Sample260827-vb8jpaycjb
SHA256 bfbdb93fe55d16d684180b4b84db94f27ca32e40278bd5a31a55e08b2bb0f7e1
MD5 ad5dbcdefbee985d3cc952b43e5c9714
SHA1 1a33c7cc3522d068f75e4a4ad1eb6e862241b95d
SHA512 7bbde777a3af7c17a872855fa9309503a883802ed9f2a648aa469157f4222609b3e67899f5e48ec628f95c0fa94caa8dc99f4d0db2dd7b74114e778fe93a48a1
SSDEEP 49152:S0JGzIVCors/x2iC62ccqKDaW0wycnnhxK5yCWG46ph0Ads9GfO7:rJgIVCors/x2iC1wrWGLh0Ads9OO
TLSH
T161C5AE1293A246BCD16AD676C59AF913EB75740C03E2A5CF27D049D13FA62F08B7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nex (2).exe

File Explorer

Nex (2).exe

.exe 2.6MB

Nex (2).exe

IMPHASH 7bf8af6a91598a8fdc855860afb06ee9
SHA256 bfbdb93fe55d16d684180b4b84db94f27ca32e40278bd5a31a55e08b2bb0f7e1
MD5 ad5dbcdefbee985d3cc952b43e5c9714
SHA1 1a33c7cc3522d068f75e4a4ad1eb6e862241b95d
SHA512 7bbde777a3af7c17a872855fa9309503a883802ed9f2a648aa469157f4222609b3e67899f5e48ec628f95c0fa94caa8dc99f4d0db2dd7b74114e778fe93a48a1
SSDEEP 49152:S0JGzIVCors/x2iC62ccqKDaW0wycnnhxK5yCWG46ph0Ads9GfO7:rJgIVCors/x2iC1wrWGLh0Ads9OO
TLSH
T161C5AE1293A246BCD16AD676C59AF913EB75740C03E2A5CF27D049D13FA62F08B7E321
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1302800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpCloseHandle WinHttpSetTimeouts WinHttpQueryOption WinHttpConnect WinHttpOpenRequest WinHttpCrackUrl WinHttpSendRequest

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptHashData BCryptCreateHash BCryptGenRandom

crypt32

CertGetNameStringW CryptEncodeObjectEx CertFreeCertificateContext CertGetIssuerCertificateFromStore CertCompareCertificateName

dwmapi

DwmSetWindowAttribute DwmFlush

shell32

DragAcceptFiles DragQueryFileW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW DragFinish DragQueryPoint

ole32

PropVariantClear CreateStreamOnHGlobal CoUninitialize CoCreateInstance CoInitializeEx CoTaskMemFree

user32

GetWindowLongA GetPropA SetPropA GetMessageExtraInfo GetWindowRect SetWindowDisplayAffinity FindWindowExW GetDC ScreenToClient FindWindowW ReleaseDC CallWindowProcW SetWindowLongPtrW SendMessageW GetSystemMetrics SetTimer GetWindowLongPtrW KillTimer ReleaseCapture LoadImageW SetWindowLongA OpenClipboard EmptyClipboard GetClipboardData TrackMouseEvent TranslateMessage DispatchMessageW PeekMessageW GetMessageTime PostMessageW WaitMessage DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow GetLayeredWindowAttributes SetLayeredWindowAttributes FlashWindow MoveWindow SetWindowPos GetWindowPlacement CloseClipboard SetWindowPlacement IsWindowVisible IsIconic BringWindowToTop IsZoomed SetFocus GetActiveWindow GetKeyState MapVirtualKeyW SetClipboardData SetCapture MsgWaitForMultipleObjects SetForegroundWindow SetPropW GetRawInputDeviceList GetRawInputDeviceInfoA EnumDisplayMonitors EnumDisplayDevicesW EnumDisplaySettingsExW EnumDisplaySettingsW ChangeDisplaySettingsExW ToUnicode UnregisterClassW UnregisterDeviceNotification RegisterDeviceNotificationW RegisterRawInputDevices GetRawInputData GetMonitorInfoW MonitorFromWindow SystemParametersInfoW CreateIconIndirect DestroyIcon LoadCursorW GetClassLongPtrW SetWindowLongW GetWindowLongW PtInRect OffsetRect SetRect ClipCursor WindowFromPoint ClientToScreen GetCursorPos SetCursor SetCursorPos AdjustWindowRectEx GetClientRect SetWindowTextW RemovePropW GetPropW

d3d11

D3D11CreateDevice

dxgi

CreateDXGIFactory1

winmm

timeEndPeriod timeBeginPeriod

mfplat

MFCreateMediaType MFGetStrideForBitmapInfoHeader MFCreateAttributes MFStartup MFShutdown

mfreadwrite

MFCreateSourceReaderFromURL

opengl32

glGetIntegerv glTexSubImage2D glDisable glIsEnabled glDrawArrays glEnable glTexImage2D glDeleteTextures glTexParameteri glGenTextures glBindTexture glClearColor glClear glViewport

kernel32

AcquireSRWLockExclusive ReleaseSRWLockExclusive GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle InitializeSListHead GetSystemTimeAsFileTime WakeAllConditionVariable IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext MoveFileExW CopyFileW AreFileApisANSI SetFileInformationByHandle SleepConditionVariableSRW GetModuleHandleExW VerSetConditionMask QueryPerformanceFrequency TlsFree TlsSetValue TlsGetValue TlsAlloc DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection SetThreadExecutionState GetStartupInfoW OutputDebugStringA LoadLibraryA FreeLibrary Sleep CreateWaitableTimerExW SetWaitableTimer GlobalUnlock GlobalLock FindResourceW AttachConsole GetModuleHandleW GetTempPathW GetCurrentProcessId QueryPerformanceCounter MultiByteToWideChar WideCharToMultiByte VirtualProtect GetCurrentProcess TerminateProcess GetModuleFileNameW GetFileAttributesW GetCurrentThreadId GetSystemDirectoryW CreateToolhelp32Snapshot Process32NextW GetCurrentThread Process32FirstW CloseHandle GetThreadContext GetProcAddress ExitProcess FlushInstructionCache IsDebuggerPresent CheckRemoteDebuggerPresent GetVolumeInformationW GetComputerNameW GetLastError LocalFree ReadFile SetInformationJobObject SetHandleInformation HeapFree WriteFile AssignProcessToJobObject InitializeProcThreadAttributeList CreateJobObjectW CreatePipe WaitForSingleObject ClosePseudoConsole ResumeThread FormatMessageW UpdateProcThreadAttribute CreatePseudoConsole DeleteProcThreadAttributeList HeapAlloc GetProcessHeap CreateProcessW TerminateJobObject FlushFileBuffers GetExitCodeProcess SizeofResource LockResource GlobalAlloc GlobalFree LoadResource GetTickCount64

gdi32

CreateDCW CreateRectRgn GetDeviceCaps SetBrushOrgEx SelectObject CreateDIBSection CreateCompatibleDC StretchBlt GdiFlush DeleteDC SetStretchBltMode GetDeviceGammaRamp SetDeviceGammaRamp ChoosePixelFormat DescribePixelFormat SetPixelFormat CreateBitmap DeleteObject SwapBuffers

advapi32

GetSecurityDescriptorDacl SetNamedSecurityInfoW ConvertStringSecurityDescriptorToSecurityDescriptorW RegCloseKey RegOpenKeyExW RegQueryValueExW

msvcp140

?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach _Mtx_unlock ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z _Thrd_id _Thrd_join ?_Random_device@std@@YAIXZ _Cnd_broadcast ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler strchr memcpy memset memchr memcmp memmove strstr __current_exception __current_exception_context _CxxThrowException

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh malloc free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _set_fmode __acrt_iob_func freopen_s __stdio_common_vfprintf _wfopen fseek fflush fclose fputc _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fgetc __stdio_common_vsprintf ftell fwrite __p__commode

api-ms-win-crt-runtime-l1-1-0

abort _initialize_onexit_table _register_onexit_function _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _errno _beginthreadex _crt_atexit terminate _invoke_watson _register_thread_local_exe_atexit_callback __p___argc __p___argv _c_exit _cexit

api-ms-win-crt-math-l1-1-0

sqrtf cosf ceilf fmodf lroundf __setusermatherr powf sinf _dsign fmaxf fminf _dclass acosf expf

api-ms-win-crt-convert-l1-1-0

strtod strtoul strtoll strtoull

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-string-l1-1-0

wcscpy tolower isxdigit wcscmp strcpy towlower strncmp strspn toupper strcspn strlen strcmp strncpy

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64

api-ms-win-crt-utility-l1-1-0

qsort