270_434_NXG_CSS_V3..rar
- SHA256 ae3ba1eaf7dba9704184e73d55bbd8091681a37fc4bd3e0fef52527ecc67820a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NXGCSS/NXGCSS.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
NXGCSS/NXGCSS.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
NXGCSS/NXGCSS.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
NXGCSS/NXGCSS.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
General
- Target 270_434_NXG_CSS_V3..rar
- Size 526KB
- Sample260910-prh13stbpb
- SHA256 ae3ba1eaf7dba9704184e73d55bbd8091681a37fc4bd3e0fef52527ecc67820a
- MD5 89369fd156a5ac5d5e6b18cba79dde27
- SHA1 731139998d2be6fa96becf7a9f85ddb31341e384
- SHA512 346176db5faaac92061ec827dfb568c773733f21d95d31e457e6a8655dbe40804f8209dcab572f1e03afd33f8e86f6bce77b411b984e4fb7a0097de592049264
- SSDEEP 12288:Ub/7BWdLssfjSqNeL2ghMDnqeeK2sYoc/s5J9h1I3d:UzdWGsVghMZ2DocEtYN
- TLSH T1D5B423ABC71567D2F2CD8235F0C68831497274B3CAB05C2E6AA6796CCCAC15D71B7E12
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/NXGCSS/NXGCSS.dll unpack001/NXGCSS/NXGCSS.exe
File Explorer
-
270_434_NXG_CSS_V3..rar.rar 526KB
-
NXGCSS/NXGCSS.dll.dll 45KB
-
NXGCSS/NXGCSS.exe.exe 1.3MB
NXGCSS/NXGCSS.dll
- IMPHASH 35e34beb82bb95445858088ae02f556b
- SHA256 f1d0b923f2a6e33e439522171fc65645bb201ab05706b0ba64071c22728b426e
- MD5 e3d576dc83347c64d2317f84be98dfb8
- SHA1 bdf9970a895dcaa395791491690c0f7ab13a8daa
- SHA512 c14e5a3a47ce9276bfae21b68de9ed3754029b322b20b91d2b682873a57a63f0c8c52471377241c1ab7b35d2a71a2d0258772e3e518b0a581255b16f37e776ac
- SSDEEP 768:HyJ1hmgtI9OwGtxwn8Brl+mPrmkkKJFC5cUV5dG0kG:SThmLk9xwn8NLmkh6qUDdGRG
- TLSH T1A4239211D877A9B3D9DE187966CA370EEB3ADC13A6CCE9D335F019D259222E19033631
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
33200
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
d:\Users\Josh\Desktop\NEW-UPDATED-HACKS\NXG PUBLICS\NXG CSS\NXG BASE\Release\Magic D3D9 Base v1.0.pdb
kernel32
DisableThreadLibraryCalls
WritePrivateProfileStringA
GetModuleHandleA
VirtualProtect
CreateThread
GetCurrentProcess
GetSystemTimeAsFileTime
Sleep
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
GetPrivateProfileIntA
GetCurrentProcessId
IsBadReadPtr
InterlockedExchange
FlushInstructionCache
SetLastError
user32
mouse_event
GetCursorPos
ReleaseDC
wsprintfA
GetClientRect
GetDC
GetForegroundWindow
GetWindowPlacement
GetAsyncKeyState
SetCursorPos
gdi32
GetPixel
AddFontResourceExA
d3dx9_42
D3DXCreateFontA
D3DXAssembleShader
D3DXCreateLine
msvcr90
_vsnprintf
clock
??2@YAPAXI@Z
memset
memcpy
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
sprintf
_CIsin
??3@YAXPAX@Z
_CIcos
Name
.text
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=150, version=20413,
count=3, id=149, productName=VS2008 build 21022, version=21022,
count=12, id=131, productName=VS2008 build 21022, version=21022,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=29, version=9254,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=73, id=1, productName=Unmarked objects,
count=1, id=138, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
NXGCSS/NXGCSS.exe
- IMPHASH a8dd688d834ce695f9ce1eb4236468e7
- SHA256 ca3837bd07ff5bbde51086e11f0dbdd6b0db0e90be7de9d8da07daa3a1648014
- MD5 2021bb5cc6b8625c2d024073fb484c0c
- SHA1 25473aedeb7a20408f8c5ba0b94192895bfcc490
- SHA512 150fd34300c31619b8a42ef4c05305d8362cd5509a955acb05dfca5b1ce1a5d42a30c87070828264c2e59e3bdc07dfdb2ff6a6f2b650b3445ae988696e76c57e
- SSDEEP 12288:0CtZsxBaaBeXDdF0FUtTL1Vnlbi+sQt98zGdQQCY9q8PEtXOKWyv:0YCC0611Vns+sQt9wyQx8PjKt
- TLSH T138657BB0F055DDA2D994B7342435BDA801BB2FF679B8D51D2D1EB4A84BF3382209CD4A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
5745
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
CreateRemoteThread
GetProcAddress
GetModuleHandleA
WriteProcessMemory
VirtualAllocEx
OpenProcess
Sleep
Process32Next
Process32First
CreateToolhelp32Snapshot
CloseHandle
CreateThread
FindFirstFileA
GetModuleFileNameA
FlushFileBuffers
CreateFileA
HeapSize
GetCommandLineA
GetStartupInfoA
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetModuleHandleW
ExitProcess
WriteFile
GetStdHandle
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
WideCharToMultiByte
GetLastError
GetEnvironmentStringsW
SetHandleCount
GetFileType
DeleteCriticalSection
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
InterlockedIncrement
SetLastError
GetCurrentThreadId
InterlockedDecrement
HeapCreate
VirtualFree
HeapFree
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
SetFilePointer
GetConsoleCP
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
LoadLibraryA
InitializeCriticalSectionAndSpinCount
HeapAlloc
VirtualAlloc
HeapReAlloc
RtlUnwind
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
user32
DialogBoxParamA
EndDialog
ShowWindow
LoadIconA
MessageBoxA
shell32
Shell_NotifyIconA
Name
.text
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1.3MB
Virtual Size
1.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 build 21022, version=21022,
count=96, id=131, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=VS2005 build 50727, version=50727,
count=99, id=1, productName=Unmarked objects,
count=32, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,