Nexomia (1)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nexomia (1).exe
Size 19.1MB
Sample260926-tehl1axake
SHA256 e062e4574e031395e0d308766b919a63352501dde2118cb56efc63d9d246a43e
MD5 2039b70bcc9c7a38aa9ae3faa9007f47
SHA1 2ab0e5650622504acdca92a02b699e9e0357293d
SHA512 0304e0b44a7622d882093fb4adab56cb0871413c32f9dedde716f398beee5b4bee7c1c2b2de941b0f5764c3fe0a6feb41252bbb8ff39ce98d6fc6d78a0c135b2
SSDEEP 196608:prmU6m/hDAQkLBTUMqBiVR8z2tYtK7lDJpzH5IStbhjz7g+zdY4HciDr2cpQvEO8:8U22MqBzzIYtK5ZIgbhnhzCkbrpwB5
TLSH
T149179D42F66280E8D16AC175835A6233FB31B85D07357AEB5BE04A213F6AFD0673DB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nexomia (1).exe

File Explorer

Nexomia (1).exe

.exe 19.1MB

Nexomia (1).exe

IMPHASH ac492fc048e918251fdb9140e1935fae
SHA256 e062e4574e031395e0d308766b919a63352501dde2118cb56efc63d9d246a43e
MD5 2039b70bcc9c7a38aa9ae3faa9007f47
SHA1 2ab0e5650622504acdca92a02b699e9e0357293d
SHA512 0304e0b44a7622d882093fb4adab56cb0871413c32f9dedde716f398beee5b4bee7c1c2b2de941b0f5764c3fe0a6feb41252bbb8ff39ce98d6fc6d78a0c135b2
SSDEEP 196608:prmU6m/hDAQkLBTUMqBiVR8z2tYtK7lDJpzH5IStbhjz7g+zdY4HciDr2cpQvEO8:8U22MqBzzIYtK5ZIgbhnhzCkbrpwB5
TLSH
T149179D42F66280E8D16AC175835A6233FB31B85D07357AEB5BE04A213F6AFD0673DB14
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

nexomia

Minor OS version

Major OS version

Entry point

10342704

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Nexomia.pdb

kernel32

MoveFileExW TerminateProcess FlushFileBuffers RtlCaptureContext LocalFree ReleaseMutex GetProcessId FindNextFileW SetFileInformationByHandle OpenProcess FindClose GetQueuedCompletionStatusEx GetProcAddress PostQueuedCompletionStatus ReadFile GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx GetModuleHandleA VirtualAlloc GetExitCodeProcess OpenMutexW lstrlenW GetCurrentThreadId VirtualProtect CreateProcessW GetSystemTimePreciseAsFileTime GetCurrentProcessId QueryPerformanceFrequency GetModuleHandleW WakeAllConditionVariable SleepConditionVariableSRW InitializeSListHead SetUnhandledExceptionFilter RtlUnwindEx RtlPcToFileHeader CreateThreadpoolTimer SetThreadpoolTimer FlsGetValue EncodePointer SystemTimeToFileTime CreateWaitableTimerExW LoadLibraryW WaitForSingleObjectEx CancelIo CreateFileW ReadDirectoryChangesW GetSystemInfo SetWaitableTimer WaitForSingleObject QueryPerformanceCounter Sleep QueryFullProcessImageNameW WriteConsoleW GetConsoleOutputCP LCIDToLocaleName GetUserDefaultUILanguage SleepEx WriteFileEx CreateSemaphoreW RtlLookupFunctionEntry RtlVirtualUnwind SetLastError CreateMutexA WideCharToMultiByte FormatMessageW MultiByteToWideChar FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber ReadFileEx GetConsoleMode GetStdHandle SetHandleInformation GetFullPathNameW SetFileTime FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW WaitForMultipleObjects GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW CopyFileExW DeviceIoControl LoadLibraryExW ReleaseSemaphore GetProcessTimes GetSystemTimes GetProcessIoCounters LoadLibraryA SwitchToThread AddVectoredExceptionHandler CloseHandle GetLastError CreateThread ReadProcessMemory HeapReAlloc VirtualQueryEx CreateToolhelp32Snapshot CreateMutexW PeekNamedPipe SetFilePointerEx HeapFree GetProcessHeap DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI HeapCreate GetDiskFreeSpaceW GetCurrentThread SetThreadStackGuarantee OutputDebugStringA LockFile SetFilePointer GetFullPathNameA Process32FirstW SetEndOfFile Process32NextW DuplicateHandle UnlockFileEx UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW GetCurrentProcess OutputDebugStringW FlushViewOfFile LoadLibraryExA CreateFileA DeleteFileA InitializeSRWLock ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared InitOnceExecuteOnce TlsAlloc TlsGetValue TlsSetValue GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact GetNativeSystemInfo InitializeCriticalSectionEx FreeEnvironmentStringsW GetEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentDirectoryW GetCommandLineW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

shell32

CommandLineToArgvW SHAppBarMessage Shell_NotifyIconGetRect ShellExecuteW Shell_NotifyIconW SHGetFileInfoW DragFinish DragQueryFileW SHCreateItemFromParsingName SHGetKnownFolderPath

user32

CloseTouchInputHandle IsIconic GetRawInputData VkKeyScanW GetKeyboardState GetAsyncKeyState GetKeyState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx SetFocus MonitorFromWindow GetSystemMenu SetWindowLongW SetWindowTextW ShowCursor EnumDisplayMonitors GetWindowLongPtrW GetActiveWindow GetClipCursor ClipCursor GetMenu SetPropW MonitorFromPoint RegisterClassExW IsProcessDPIAware TrackPopupMenu DrawTextW GetWindowDC OffsetRect MapWindowPoints SendInput ShowWindow MapVirtualKeyW FindWindowExW GetTouchInputInfo SetWindowRgn RedrawWindow SendMessageW PostQuitMessage SystemParametersInfoA CreatePopupMenu CreateMenu CreateIcon RemoveMenu SetCapture InsertMenuW CheckMenuItem EnableMenuItem SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu PostMessageW AdjustWindowRectEx CreateWindowExW ReleaseDC DrawIconEx GetDC RegisterTouchWindow SetLayeredWindowAttributes TranslateAcceleratorW GetUpdateRect ValidateRect DrawMenuBar SetMenu GetMenuItemInfoW ChangeWindowMessageFilterEx RegisterClassW IsWindowEnabled GetParent EnumChildWindows DispatchMessageA GetMessageA EnableWindow AdjustWindowRect RegisterRawInputDevices MsgWaitForMultipleObjectsEx GetMessageW IsWindow GetSystemMetrics TrackMouseEvent SetForegroundWindow SetWindowDisplayAffinity KillTimer SetTimer GetWindowThreadProcessId EnumWindows CallWindowProcW IsWindowVisible GetWindowTextW GetCursorPos AppendMenuW RegisterWindowMessageA ReleaseCapture PostThreadMessageW DispatchMessageW TranslateMessage GetWindowTextLengthW DestroyWindow SystemParametersInfoW FillRect MonitorFromRect GetWindowLongW ScreenToClient GetWindow DefWindowProcW SetWindowLongPtrW SetCursor LoadCursorW GetWindowPlacement SetWindowPlacement PeekMessageW GetMonitorInfoW ChangeDisplaySettingsExW UpdateWindow InvalidateRect GetMenuBarInfo SetCursorPos GetForegroundWindow InvalidateRgn SetWindowPos GetWindowRect GetClientRect FlashWindowEx ClientToScreen SetParent

gdi32

CreateRectRgn SetBkMode SetTextColor DeleteObject CombineRgn CreateDIBSection BitBlt CreateCompatibleDC CreateSolidBrush GetDeviceCaps DeleteDC CreateCompatibleBitmap SelectObject GetDIBits

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

oleaut32

SysFreeString GetErrorInfo SysStringLen SetErrorInfo

ole32

CoInitializeEx OleInitialize RegisterDragDrop RevokeDragDrop CoCreateInstance CoUninitialize

comctl32

DefSubclassProc SetWindowSubclass RemoveWindowSubclass TaskDialogIndirect

combase

CoCreateFreeThreadedMarshaler CoTaskMemFree CoTaskMemAlloc

ntdll

NtQueryInformationProcess NtQuerySystemInformation NtSetInformationThread NtQueryObject NtDeviceIoControlFile RtlGetVersion NtCancelIoFileEx RtlNtStatusToDosError NtCreateNamedPipeFile NtResumeThread LdrGetProcedureAddress NtCreateFile NtRemoveProcessDebug NtSetInformationProcess NtWriteFile NtOpenFile NtReadFile NtGetContextThread

psapi

GetModuleFileNameExW GetProcessMemoryInfo EnumDeviceDrivers GetDeviceDriverFileNameW

advapi32

RegEnumKeyExW IsValidSid GetLengthSid CopySid RegQueryValueExW RegGetValueW RegOpenKeyExW RegCloseKey OpenProcessToken GetTokenInformation EventSetInformation EventWriteTransfer EventUnregister EventRegister

ws2_32

WSASocketW ioctlsocket closesocket connect getsockopt getpeername WSAGetLastError WSAIoctl bind WSAStartup WSACleanup getaddrinfo freeaddrinfo WSASend getsockname recv send shutdown setsockopt

shlwapi

SHCreateMemStream

crypt32

CertFreeCertificateContext CertCloseStore CertCreateCertificateChainEngine CertAddEncodedCertificateToStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertFreeCertificateChain CertSetCertificateContextProperty CertOpenStore CertFreeCertificateChainEngine CryptProtectData

powrprof

CallNtPowerInformation

pdh

PdhRemoveCounter PdhCloseQuery

api-ms-win-crt-math-l1-1-0

__setusermatherr pow round floor trunc log roundf

api-ms-win-crt-string-l1-1-0

_wcsicmp strcspn strncmp strcmp wcscmp strspn strlen wcslen strcpy_s

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _crt_atexit _exit exit _initterm_e abort _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe _errno _initialize_onexit_table _endthreadex _beginthreadex _wassert

api-ms-win-crt-convert-l1-1-0

strtol wcstol _ultow_s _wtoi

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __stdio_common_vsscanf fclose fflush fgets fopen feof ferror __stdio_common_vfprintf _setmode fwrite ftell fseek _set_fmode _fileno __acrt_iob_func __p__commode fread

api-ms-win-crt-heap-l1-1-0

_msize calloc malloc realloc _set_new_mode _callnewh free

api-ms-win-crt-utility-l1-1-0

qsort bsearch

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale