Nexomia[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nexomia.exe
Size 19.4MB
Sample260922-2emvqagh33
SHA256 c23a06fa1fddbed8b6d96464044bff63e651e2927faeac5c054c16c34b117b46
MD5 e5e63841966c32e38bd62127c99b5ec8
SHA1 dfa3cb6ab1a500bd474079ca2ea27fd70953db59
SHA512 7a2405e639ff0c721a935686f2d92537e12e6b0d32c44326dd433fdc15ce33610d031a2cd628f0f74daca16af371baad200c926026fafbdf8515a355fc1ba851
SSDEEP 196608:Erec1mTOAbK3nR2O2uz3bK0V85IO5S5uS3W6QP5J1wP5993CiMs7UfCI2CWl:E3maAE7z3bKdFEuuWlJM99yiMQUP2C+
TLSH
T1EC279D43F26290E8D56AC175830A6232FA71BC4D47347AEB5BE48B213F66FA0673D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nexomia.exe

File Explorer

Nexomia.exe

.exe 19.4MB

Nexomia.exe

IMPHASH 7e75f0e131fe3827c24c3dbafa9cd523
SHA256 c23a06fa1fddbed8b6d96464044bff63e651e2927faeac5c054c16c34b117b46
MD5 e5e63841966c32e38bd62127c99b5ec8
SHA1 dfa3cb6ab1a500bd474079ca2ea27fd70953db59
SHA512 7a2405e639ff0c721a935686f2d92537e12e6b0d32c44326dd433fdc15ce33610d031a2cd628f0f74daca16af371baad200c926026fafbdf8515a355fc1ba851
SSDEEP 196608:Erec1mTOAbK3nR2O2uz3bK0V85IO5S5uS3W6QP5J1wP5993CiMs7UfCI2CWl:E3maAE7z3bKdFEuuWlJM99yiMQUP2C+
TLSH
T1EC279D43F26290E8D56AC175830A6232FA71BC4D47347AEB5BE48B213F66FA0673D744
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11126160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Nexomia.pdb

kernel32

WriteFile CancelIoEx CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx SetFileInformationByHandle FindNextFileW CreateProcessW GetProcessId GetExitCodeProcess OpenMutexW PeekNamedPipe DuplicateHandle GetCurrentProcess Process32NextW Process32FirstW CreateToolhelp32Snapshot ReleaseSemaphore CreateSemaphoreW K32GetPerformanceInfo GlobalMemoryStatusEx WriteFileEx SleepEx QueryPerformanceFrequency Sleep QueryPerformanceCounter SetWaitableTimer WaitForSingleObjectEx CancelIo CreateFileW ReadDirectoryChangesW GetSystemInfo CreateWaitableTimerExW GetCurrentProcessId MoveFileExW TerminateProcess OpenProcess FindClose GetCurrentThreadId WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError CreateMutexA FormatMessageW FlsAlloc FlsFree FlsSetValue HeapAlloc IsThreadAFiber ReadFileEx ReleaseMutex SetHandleInformation GetFullPathNameW SetFileTime FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW WaitForMultipleObjects GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW CopyFileExW DeviceIoControl SystemTimeToFileTime GetProcessTimes GetSystemTimes GetProcessIoCounters WaitForSingleObject CreateMutexW RtlPcToFileHeader FlsGetValue LocalFree WriteConsoleW ReadProcessMemory GetConsoleOutputCP VirtualQueryEx GetConsoleMode GetStdHandle LoadLibraryExW GetModuleFileNameW CompareStringOrdinal GetModuleHandleExW MultiByteToWideChar InitializeCriticalSectionEx WideCharToMultiByte LoadLibraryW LCIDToLocaleName GetUserDefaultUILanguage FlushFileBuffers LoadLibraryA GetModuleHandleW SetFilePointerEx EncodePointer lstrlenW GetModuleHandleA LoadLibraryExA GetProcAddress GetSystemTimePreciseAsFileTime SwitchToThread CloseHandle GetLastError CreateThread SetFileCompletionNotificationModes HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler DeleteCriticalSection TryEnterCriticalSection InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetNativeSystemInfo DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetEnvironmentVariableW GetCommandLineW SetEnvironmentVariableW GetCurrentDirectoryW GetEnvironmentStringsW FreeEnvironmentStringsW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

shell32

SHGetFileInfoW ShellExecuteW SHCreateItemFromParsingName DragQueryFileW DragFinish SHGetKnownFolderPath CommandLineToArgvW SHAppBarMessage

combase

CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoTaskMemFree

crypt32

CertCloseStore CertCreateCertificateChainEngine CertOpenStore CertSetCertificateContextProperty CertFreeCertificateChain CertFreeCertificateContext CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CryptProtectData CertFreeCertificateChainEngine CertGetCertificateChain

user32

SetWindowLongW GetWindowTextW GetWindowTextLengthW RegisterWindowMessageA MapVirtualKeyW GetKeyboardState GetAsyncKeyState GetKeyState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx SetFocus RegisterTouchWindow ShowCursor SetWindowTextW RedrawWindow SetWindowRgn SetPropW GetClipCursor ClipCursor IsWindowEnabled EnableWindow SendMessageW PostMessageW GetMenu GetCursorPos IsWindowVisible IsIconic MonitorFromWindow CloseTouchInputHandle GetTouchInputInfo EnumDisplayMonitors GetWindowLongPtrW IsProcessDPIAware VkKeyScanW TrackPopupMenu DrawTextW GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo ShowWindow PostQuitMessage RegisterRawInputDevices CreatePopupMenu CreateMenu CreateIcon RemoveMenu AppendMenuW InsertMenuW CheckMenuItem EnableMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu SetCapture MonitorFromPoint RegisterClassExW ReleaseDC DrawIconEx GetDC ReleaseCapture SetLayeredWindowAttributes TranslateAcceleratorW GetUpdateRect ValidateRect DrawMenuBar SetMenu GetMenuItemInfoW TrackMouseEvent EnumChildWindows DispatchMessageA GetMessageA GetActiveWindow AdjustWindowRect GetRawInputData GetWindowThreadProcessId EnumWindows MsgWaitForMultipleObjectsEx GetMessageW GetSystemMetrics AdjustWindowRectEx CreateWindowExW IsWindow FindWindowExW SetForegroundWindow SetWindowDisplayAffinity GetParent PostThreadMessageW DispatchMessageW TranslateMessage SetCursor LoadCursorW SendInput DestroyWindow SystemParametersInfoW FillRect MonitorFromRect GetWindowLongW ScreenToClient GetWindow DefWindowProcW SetWindowLongPtrW GetWindowPlacement SetWindowPlacement PeekMessageW GetMonitorInfoW ChangeDisplaySettingsExW UpdateWindow InvalidateRect SystemParametersInfoA SetCursorPos GetForegroundWindow InvalidateRgn SetWindowPos GetWindowRect GetClientRect FlashWindowEx ClientToScreen SetParent GetSystemMenu

advapi32

EventUnregister GetTokenInformation OpenProcessToken EventWriteTransfer GetLengthSid CopySid RegQueryValueExW EventSetInformation RegCloseKey RegGetValueW EventRegister IsValidSid RegOpenKeyExW

gdi32

DeleteDC DeleteObject CreateSolidBrush CombineRgn CreateDIBSection SelectObject SetBkMode BitBlt CreateCompatibleBitmap GetDIBits CreateCompatibleDC GetDeviceCaps SetTextColor CreateRectRgn

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

oleaut32

GetErrorInfo SysFreeString SetErrorInfo SysStringLen

ole32

OleInitialize CoInitializeEx RevokeDragDrop CoUninitialize RegisterDragDrop CoCreateInstance

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass TaskDialogIndirect

ws2_32

WSASocketW ioctlsocket closesocket connect getsockopt getpeername getsockname WSAIoctl WSAGetLastError WSAStartup WSACleanup getaddrinfo freeaddrinfo WSASend recv send shutdown bind setsockopt

ntdll

NtDeviceIoControlFile NtCreateNamedPipeFile NtCancelIoFileEx NtQuerySystemInformation RtlGetVersion NtCreateFile RtlNtStatusToDosError NtWriteFile NtQueryObject NtOpenFile NtReadFile NtQueryInformationProcess

shlwapi

SHCreateMemStream

psapi

GetProcessMemoryInfo GetModuleFileNameExW

powrprof

CallNtPowerInformation

pdh

PdhCloseQuery PdhRemoveCounter

api-ms-win-crt-string-l1-1-0

strcpy_s wcscmp wcslen strspn _wcsicmp strcmp strcspn strlen strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr pow trunc floor roundf round log

api-ms-win-crt-runtime-l1-1-0

_endthreadex _wassert _errno _beginthreadex _initialize_narrow_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit abort _get_initial_narrow_environment _initterm_e _initterm

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

_set_fmode fwrite _fileno _setmode fopen fgets ftell fread ferror feof fclose __p__commode fseek __acrt_iob_func __stdio_common_vsscanf fflush __stdio_common_vfprintf __stdio_common_vsprintf

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode realloc calloc _msize _callnewh

api-ms-win-crt-utility-l1-1-0

bsearch qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale