Ninja Hex Panel[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Ninja Hex Panel.zip
Size 347KB
Sample260910-2lmhjayzds
SHA256 b0bada38de6be23b51ce2cf00709d5053f22f821c4156fe8ae3d358fc76cac85
MD5 e9d8064bd586fdd5187c6cf2dd42cfa4
SHA1 2a56477056c415637165b82800096ec9cc48a2e0
SHA512 406aec24f8db31d7f313d53d15d930a6da2f1d957a9aed2de6f28a57bcf80a17f8e863affb8400f733122070d6c4a55ed16a38d3e20e4926eb41c04abcaa276e
SSDEEP 6144:/T14bI7lgVe0b2EWm55CBxPoiMweadA8YBLfcMLL4+J0Vf5+Lwh6fRBuwY:/T1pW2txPzlXoLf7gN5+LwE2wY
TLSH
T1DA742323D6CFB70E3CD429F73A4C9C8302CA904AFA9A102D4EB695764717F995513ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ninja Hex Panel.dll
unpack001/Ninja Hex Panel.exe

File Explorer

Ninja Hex Panel.zip

.zip 347KB
Ninja Hex Panel.dll

.exe 359KB
Ninja Hex Panel.exe

.exe 148KB

Ninja Hex Panel.zip

SHA256 b0bada38de6be23b51ce2cf00709d5053f22f821c4156fe8ae3d358fc76cac85
MD5 e9d8064bd586fdd5187c6cf2dd42cfa4
SHA1 2a56477056c415637165b82800096ec9cc48a2e0
SHA512 406aec24f8db31d7f313d53d15d930a6da2f1d957a9aed2de6f28a57bcf80a17f8e863affb8400f733122070d6c4a55ed16a38d3e20e4926eb41c04abcaa276e
SSDEEP 6144:/T14bI7lgVe0b2EWm55CBxPoiMweadA8YBLfcMLL4+J0Vf5+Lwh6fRBuwY:/T1pW2txPzlXoLf7gN5+LwE2wY
TLSH
T1DA742323D6CFB70E3CD429F73A4C9C8302CA904AFA9A102D4EB695764717F995513ABC
MD5 SHA1 SHA512 SSDEEP TLSH

Ninja Hex Panel.dll

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 20ceed8ee973302c59c2d5210af54c2f600afd4860e58c7ed17f17a513ab44cc
MD5 2ff3afaeaf64b9f17429788ad57cc466
SHA1 224ea3b9f3094e5c33ef1c54de54d70f42f0ba02
SHA512 0ded802c0fb0ca4164678492de9631f07b2d63ebb0edffc419b91b5ac080586d772626575f181c48c3a7f6d388b6ad688cd2d9580c93c6e6b323201e46441a04
SSDEEP 6144:iuUf1uO1gp5wEsOBrankDHgZDWmr5CBPPoiMwgadYeYBbfcMBL4+J0bfdS/eUoWv:iH9/fEXankDgiPPzrDobfxgzdGq5u
TLSH
T1AF747A7BB8D0499DE975BD3D01B5A48507E377B8A23907BB94E6F9308D832D0DCE250A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

373022

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Ninja Hex Panel.exe

IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
SHA256 e5d52c5efe8a3a24cd23620b12631712c118d3f03d076c319848942f1872e7f3
MD5 2e6601e84604b39f886861141515a2ef
SHA1 ce65fe6b22b31b41a8bf76e3184008576574a45e
SHA512 61064f0f316ac7ca55aa63216167cd9ee8566a1dd700ffa1600267722a04768613d536049fcb208296d367fde0a007c8fd4b7d1b005a7792e99e4a53c541de24
SSDEEP 3072:/qeXA/4yIg9vkNPNu6H6xCYOixUE265VJw:/vgvkNFNaxmVE1J
TLSH
T143E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FreeLibrary LoadLibraryExW OutputDebugStringW FindFirstFileExW EnterCriticalSection GetFullPathNameW FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection GetEnvironmentVariableW GetModuleHandleW MultiByteToWideChar GetFileAttributesExW LoadLibraryA DeleteCriticalSection WideCharToMultiByte IsWow64Process TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount GetProcAddress GetWindowsDirectoryW FindResourceW GetLastError ActivateActCtx FindClose CreateActCtxW SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetCurrentProcessId IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetStringTypeW SwitchToThread GetCurrentThreadId InitializeCriticalSectionEx EncodePointer DecodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invoke_watson __p___argc _exit exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _errno _initialize_onexit_table abort _c_exit _register_thread_local_exe_atexit_callback terminate __p___wargv

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode fputwc __p__commode fputws _wfsopen fflush __stdio_common_vfwprintf __stdio_common_vsnwprintf_s __stdio_common_vswprintf setvbuf

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode free _callnewh malloc

api-ms-win-crt-string-l1-1-0

wcsncmp toupper strcmp strlen _wcsdup wcsnlen strcpy_s

api-ms-win-crt-convert-l1-1-0

wcstoul _wtoi

api-ms-win-crt-time-l1-1-0

wcsftime _gmtime64_s _time64

api-ms-win-crt-locale-l1-1-0

___mb_cur_max_func _configthreadlocale ___lc_codepage_func ___lc_locale_name_func __pctype_func _lock_locales setlocale _unlock_locales

api-ms-win-crt-math-l1-1-0

__setusermatherr