Nigger[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nigger.exe
Size 29.3MB
Sample260925-vfxb8a1flg
SHA256 965aca0171d69f7b37314e2e6ce4eb7045ead32746217ce9837e1119ef6078bb
MD5 407325cf5c91b118f2c552a54d65eb36
SHA1 4e257154faa784fdba26ca5f0cc064e6f9d107db
SHA512 2a4d3415365aa6e30cc1630144fe24411dd0318a3bd2e69a16da432da8e9a602249b61e86bd078e24cc084cfcf5651a1d26741f58582e8092c3a085f0b3347d4
SSDEEP 393216:bSvahpZCdeKs1QSPAmkZs00GaJT76mhfPAmkgML1:hQZsfJX6QfQZL
TLSH
T1BC67D042F7848EA3C089977985638797D332FC4ABB1317A732987D257E93BD05E26381
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nigger.exe

File Explorer

Nigger.exe

.exe 29.3MB

Nigger.exe

IMPHASH 9313c37c319a51be584bc61fe6f53286
SHA256 965aca0171d69f7b37314e2e6ce4eb7045ead32746217ce9837e1119ef6078bb
MD5 407325cf5c91b118f2c552a54d65eb36
SHA1 4e257154faa784fdba26ca5f0cc064e6f9d107db
SHA512 2a4d3415365aa6e30cc1630144fe24411dd0318a3bd2e69a16da432da8e9a602249b61e86bd078e24cc084cfcf5651a1d26741f58582e8092c3a085f0b3347d4
SSDEEP 393216:bSvahpZCdeKs1QSPAmkZs00GaJT76mhfPAmkgML1:hQZsfJX6QfQZL
TLSH
T1BC67D042F7848EA3C089977985638797D332FC4ABB1317A732987D257E93BD05E26381
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2494176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sdfhdsfhshsdfsf\Downloads\crime v1.8 public source\crime public external\crime public external\crime public external\crime public external\crime public external\build\Crime.pdb

shlwapi

PathFindFileNameW

ws2_32

inet_ntop ntohl WSAIoctl freeaddrinfo getsockopt getaddrinfo inet_pton WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError ntohs WSASetLastError WSAStartup WSACleanup bind connect getpeername getsockname htons recv setsockopt socket gethostname ioctlsocket sendto recvfrom listen htonl accept select __WSAFDIsSet send

iphlpapi

GetAdaptersInfo

advapi32

GetLengthSid CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptAcquireContextW CryptReleaseContext CryptGetHashParam RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegQueryValueExA RegCloseKey GetTokenInformation AddAccessAllowedAce SystemFunction036 SetSecurityInfo InitializeAcl OpenProcessToken IsValidSid RegDeleteKeyA CopySid ConvertSidToStringSidA

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlUnwind RtlCaptureContext RtlUnwindEx RtlLookupFunctionEntry RtlPcToFileHeader RtlVirtualUnwind VerSetConditionMask

kernel32

GlobalMemoryStatusEx GetDiskFreeSpaceExA GetTickCount IsDebuggerPresent GetModuleFileNameA VirtualProtect HeapFree SetDefaultDllDirectories AddDllDirectory GetCurrentProcess GetModuleFileNameW InitializeCriticalSectionEx CreateFileW GetCurrentThreadId GetSystemDirectoryW UnmapViewOfFile HeapSize GetTickCount64 GetLastError GetFileAttributesA HeapReAlloc HeapAlloc DecodePointer HeapDestroy DeleteCriticalSection GetProcessHeap QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile SetDllDirectoryW VirtualQuery LocalFree CreateFileA GetFileSizeEx ReadFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive FormatMessageW EnterCriticalSection LeaveCriticalSection LoadLibraryW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW InitializeCriticalSection VirtualAlloc GlobalFree FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GlobalAlloc GetTimeFormatW GetDateFormatW LoadLibraryExW GetConsoleOutputCP ReadConsoleW GetConsoleMode GetCommandLineW GetCommandLineA WriteFile SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW IsProcessorFeaturePresent UnhandledExceptionFilter Process32Next DuplicateHandle TerminateProcess ExitProcess FreeLibraryAndExitThread ExitThread CreateThread FlsFree FlsSetValue FlsGetValue FlsAlloc OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime GetStartupInfoW SetUnhandledExceptionFilter GetStringTypeW GetCPInfo EncodePointer LCMapStringEx GetFileInformationByHandleEx AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle GetFileAttributesExW GetVolumeInformationA FindClose FindNextFileA FindFirstFileA Process32First GetExitCodeProcess FreeConsole ReadProcessMemory GetCurrentThread SetThreadPriority lstrcmpiW CloseHandle Process32FirstW Process32NextW QueryPerformanceCounter FreeLibrary GetProcAddress QueryPerformanceFrequency CreateToolhelp32Snapshot OpenProcess LoadLibraryA FindNextFileW FindFirstFileExW FindFirstFileW CreateDirectoryW Module32First GetProcessId Module32Next GetConsoleWindow VirtualQueryEx GetCurrentDirectoryW GetLocaleInfoEx WakeAllConditionVariable WakeConditionVariable FormatMessageA InitOnceBeginInitialize InitOnceComplete GetModuleHandleExW CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWork FreeLibraryWhenCallbackReturns RaiseException GetLogicalProcessorInformationEx GetExitCodeThread SleepConditionVariableSRW AcquireSRWLockShared ReleaseSRWLockShared MultiByteToWideChar GetLocaleInfoA VirtualFreeEx FlushInstructionCache GetModuleHandleW VirtualAllocEx VirtualProtectEx GetLocalTime GetSystemInfo SetLastError SwitchToThread GetSystemTimePreciseAsFileTime Sleep GlobalUnlock WideCharToMultiByte GetModuleHandleA WaitForSingleObject GetTimeZoneInformation DeleteFileW CreatePipe SetStdHandle SetEndOfFile GetCurrentProcessId CreateProcessW GlobalLock IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CompareStringW WriteConsoleW

user32

SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient GetDC LoadCursorA GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard SendInput FindWindowA ShowWindow IsWindowVisible SetWindowDisplayAffinity EnumWindows IsWindow GetWindowThreadProcessId EndPaint BeginPaint UpdateWindow PostQuitMessage SendMessageA TranslateMessage SetWindowPos SetFocus CreateWindowExA DefWindowProcA RegisterClassA MessageBoxA SetClassLongPtrA SetWindowLongA GetAsyncKeyState GetCursorPos ReleaseDC IsDialogMessageA GetSystemMetrics FillRect PostMessageA DestroyWindow DispatchMessageA GetMessageA RegisterClassExA UnregisterClassA PeekMessageA SetLayeredWindowAttributes GetMonitorInfoA EnumDisplayMonitors GetWindowRect MonitorFromPoint IsWindowUnicode ReleaseCapture SetCursorPos GetClientRect

gdi32

CreateSolidBrush SetBkColor MoveToEx GetDeviceCaps SetBkMode TextOutA SetTextColor SelectObject CreateFontA LineTo DeleteObject CreatePen

shell32

SHGetFolderPathA ShellExecuteW ShellExecuteA

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

winmm

waveOutUnprepareHeader waveOutClose waveOutReset waveOutOpen waveOutPrepareHeader waveOutWrite timeBeginPeriod PlaySoundA

wininet

HttpSendRequestA InternetReadFile InternetCloseHandle InternetOpenA HttpAddRequestHeadersA InternetGetConnectedState InternetConnectA HttpQueryInfoA HttpOpenRequestA InternetCheckConnectionA

wintrust

WinVerifyTrust

dnsapi

DnsFree DnsQuery_A

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

crypt32

CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertOpenStore CertFreeCertificateChain CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertFindExtension CertCloseStore

Name

.text

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

24.8MB

Virtual Size

24.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nigger.exe

shlwapi

ws2_32

iphlpapi

advapi32

d3d11

ntdll

kernel32

user32

gdi32

shell32

d3dcompiler_47

dwmapi

imm32

winmm

wininet

wintrust

dnsapi

userenv

bcrypt

crypt32

generic