Nonagon[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nonagon.zip
Size 8.5MB
Sample260828-yz2mtsshle
SHA256 1e247af68355e570b9e095dab032bd3a03228394fc72a5d8782849a0f724fc55
MD5 67d6fc1ed5e5472eb3596f9daa82be29
SHA1 4dd3b28af56e8f2fb02ab4e981bf2ceff94b4c5d
SHA512 1170179dc1c9daf262d154cf85e2a1cbe81ea4ca7ce6fe5db11cc902b6e808784b0aada280fa739e44a45b3b04ec851a1ef111805d3eb8b6b6b84965c4430359
SSDEEP 196608:EReaD2LqxHn+Kf4+jXygpl3SALgHLE5YiZrr86EO5KALApBawSngh9LgdiYY/TgP:TaTxH+D+7ygplCPLE5ZZr975jUpUwSnD
TLSH
T18E963382F74C18739D28C7658FA732B5DB694A6FEBE00ADC55CE003D21618A6057DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Nonagon CS2/Nonagon.exe

File Explorer

Nonagon.zip

.zip 8.5MB
Nonagon CS2/Nonagon.exe

.exe 8.8MB
Nonagon CS2/loader.log

2KB

Nonagon.zip

SHA256 1e247af68355e570b9e095dab032bd3a03228394fc72a5d8782849a0f724fc55
MD5 67d6fc1ed5e5472eb3596f9daa82be29
SHA1 4dd3b28af56e8f2fb02ab4e981bf2ceff94b4c5d
SHA512 1170179dc1c9daf262d154cf85e2a1cbe81ea4ca7ce6fe5db11cc902b6e808784b0aada280fa739e44a45b3b04ec851a1ef111805d3eb8b6b6b84965c4430359
SSDEEP 196608:EReaD2LqxHn+Kf4+jXygpl3SALgHLE5YiZrr86EO5KALApBawSngh9LgdiYY/TgP:TaTxH+D+7ygplCPLE5ZZr975jUpUwSnD
TLSH
T18E963382F74C18739D28C7658FA732B5DB694A6FEBE00ADC55CE003D21618A6057DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Nonagon CS2/Nonagon.exe

IMPHASH 5dac18547480b7c126ddd8fd7ce8fdc8
SHA256 073359e8fb7afa1955fdceb6f8992286272c9c9095bd01212096d5520aebdf57
MD5 785dbbfd0d3a0a7403eb1128ad697d67
SHA1 6da4b3ff8920a230ec6af13f585548ad634b40a7
SHA512 1f1d3785d1fba51673d8d74f48c4378140b0260d1eadaf02fa1abc7cc8f3a7448bae3da70e5ba833a5dadaabd96854b94acf61bb207b94e1bf2f5b689b58928f
SSDEEP 196608:CReWVcLOPN7+KD8aPpsg/R34ShUh7ELg47rFyuyMtwgL85P8Ce92lBtQnEkcXPQG:pWVPNChaBsg/RIz7ELT7rLhth45ECe9J
TLSH
T187963342F3AC17F1D42A8234CE87761BEF763849175016DF23D404AC2BA67F55BBA622
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

410560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Asus\Desktop\Loader\build\x64\Release\loader.pdb

dwmapi

DwmSetWindowAttribute

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

iphlpapi

GetAdaptersInfo

bcrypt

BCryptDestroyKey BCryptGetProperty BCryptDecrypt BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptGenerateSymmetricKey BCryptCreateHash BCryptSetProperty BCryptHashData

shell32

ShellExecuteW SHGetKnownFolderPath

kernel32

FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter LocalFree GetCurrentThreadId GetCurrentProcess GetModuleHandleA GetProcAddress IsDebuggerPresent TerminateProcess OpenProcess CloseHandle RaiseException K32EnumProcessModulesEx K32GetModuleBaseNameW GetModuleFileNameA OutputDebugStringA WriteProcessMemory GetFullPathNameA WaitForSingleObject CreateToolhelp32Snapshot GetExitCodeThread Sleep GetTempPathA Process32NextW DeleteFileA Process32FirstW VirtualAllocEx CreateRemoteThread VirtualFreeEx GetLocaleInfoEx SizeofResource FindResourceA LoadResource UnmapViewOfFile GetLastError CreateFileMappingA MapViewOfFile GetModuleHandleW VirtualProtectEx GetLocaleInfoA MultiByteToWideChar LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte FreeLibrary QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive CreateFile2 CreateDirectoryW FindClose FindFirstFileW GetFileInformationByHandleEx WakeAllConditionVariable GetFileAttributesExW LockResource GetTickCount

user32

ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture EmptyClipboard GetKeyState DestroyWindow SetWindowRgn CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW CloseClipboard DispatchMessageW PeekMessageW TranslateMessage LoadIconW LoadCursorW GetWindowRect IsWindowVisible GetMessageExtraInfo GetWindowThreadProcessId GetCursorPos SetClipboardData DefWindowProcW OpenClipboard EnumWindows UpdateWindow GetClipboardData SetWindowLongW SetCursorPos PostQuitMessage SetLayeredWindowAttributes ShowWindow SetWindowPos GetWindowLongW GetWindowTextA

gdi32

CreateRoundRectRgn

advapi32

RegQueryValueExA RegOpenKeyExW RegCloseKey

ole32

CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoCreateInstance CoUninitialize CoTaskMemFree

oleaut32

SysFreeString VariantClear SysAllocString VariantInit

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Winerror_map@std@@YAHH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??Bios_base@std@@QEBA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Xbad_alloc@std@@YAXXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Mtx_lock _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Xtime_get_ticks

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException memset memmove memcpy memcmp __current_exception_context strchr strstr __C_specific_handler __std_terminate __std_exception_copy __std_exception_destroy memchr

api-ms-win-crt-heap-l1-1-0

malloc _callnewh _set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_narrow_winmain_command_line _initterm _initterm_e exit _exit terminate _c_exit _register_thread_local_exe_atexit_callback abort _initialize_narrow_environment _errno _beginthreadex

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strncpy_s toupper _wcsicmp strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-stdio-l1-1-0

_wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell __stdio_common_vsscanf __p__commode __stdio_common_vsprintf_s _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fwrite __stdio_common_vsnprintf_s fgetc fclose fflush fputc _set_fmode __stdio_common_vsprintf fgetpos

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf fmodf sqrtf cosf sinf ceilf __setusermatherr