NexuraFree[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
NexuraFree.exe
Size 4.4MB
Sample260928-tp9s8syakd
SHA256 5a9048d9f985d2f104c9c6536a652e81602087e89cc8ee560208e8c363988304
MD5 f3d51dba3d30738f7a6cc1c35dba99ca
SHA1 f4dc4a99866bff326da050b618737ad35dc91898
SHA512 3d0682e361cb84c3a3b5efc473dcba2052ff3639b2be9375292742d8d407610422d03b748934a00802c2c71deaf9e56bca38da00bd7b8d730147c205f3d29cb9
SSDEEP 98304:7kOCNFjKK7bTRSuULHO9y7MCXGTTYZMwXBYt8IeXurI:7qpQuULHJg+Z5Yt8bJ
TLSH
T1F4260216F192D4A9C225B03F96A2E617D675BC140B22D6CB33907B6F7FB26D08FA5300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NexuraFree.exe

File Explorer

NexuraFree.exe

.exe 4.4MB

NexuraFree.exe

IMPHASH d65d520ae0494bd9a52df193e13b5e7a
SHA256 5a9048d9f985d2f104c9c6536a652e81602087e89cc8ee560208e8c363988304
MD5 f3d51dba3d30738f7a6cc1c35dba99ca
SHA1 f4dc4a99866bff326da050b618737ad35dc91898
SHA512 3d0682e361cb84c3a3b5efc473dcba2052ff3639b2be9375292742d8d407610422d03b748934a00802c2c71deaf9e56bca38da00bd7b8d730147c205f3d29cb9
SSDEEP 98304:7kOCNFjKK7bTRSuULHO9y7MCXGTTYZMwXBYt8IeXurI:7qpQuULHJg+Z5Yt8bJ
TLSH
T1F4260216F192D4A9C225B03F96A2E617D675BC140B22D6CB33907B6F7FB26D08FA5300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

645272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\byner\Desktop\Nexura-V1\Build\Cheat\Nexura.pdb

gdiplus

GdipGetImageGraphicsContext GdipDeleteGraphics GdipBitmapLockBits GdipFree GdiplusStartup GdipSetCompositingQuality GdipCloneImage GdipBitmapUnlockBits GdipCreateBitmapFromStream GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipSetSmoothingMode GdipSetInterpolationMode GdipGraphicsClear GdipCreateBitmapFromScan0

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

IsProcessorFeaturePresent InitializeSListHead GetSystemTimeAsFileTime MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter Process32First WriteProcessMemory SetConsoleTitleA GetCurrentProcess SetUnhandledExceptionFilter SetConsoleMode TerminateProcess Module32Next Module32First GetCurrentThreadId OpenProcess CreateToolhelp32Snapshot Sleep GetConsoleMode GetTickCount64 QueryFullProcessImageNameA Process32Next CloseHandle FreeConsole CreateThread VirtualProtectEx Beep VirtualAllocEx ReadProcessMemory GetConsoleWindow VirtualFreeEx GetTickCount VirtualQueryEx GetExitCodeProcess GetModuleHandleW IsDebuggerPresent GetStartupInfoW UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetCurrentProcessId RtlCaptureContext SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive GetStdHandle

user32

GetWindowThreadProcessId UnregisterHotKey SetProcessDpiAwarenessContext DispatchMessageA DestroyWindow SetWindowPos PostMessageA GetSystemMetrics EmptyClipboard ShowWindow GetAsyncKeyState SetWindowLongA CreateIconIndirect SetWindowDisplayAffinity AttachThreadInput RegisterHotKey DefWindowProcA CreateWindowExA SetLayeredWindowAttributes SetFocus TranslateMessage SendMessageA mouse_event GetClipboardData GetWindowDisplayAffinity UnregisterClassA FindWindowA RegisterClassExA UpdateWindow SetForegroundWindow GetKeyState GetMessageExtraInfo LoadCursorA GetDC ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow SetCapture SetCursor GetClientRect IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos PeekMessageA OpenClipboard CloseClipboard SetClipboardData

gdi32

CreateBitmap CreateDIBSection DeleteObject

shell32

ShellExecuteW ShellExecuteA

ole32

CreateStreamOnHGlobal CoCreateInstance

msvcp140

?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??Bios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?good@ios_base@std@@QEBA_NXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Xtime_get_ticks _Thrd_join _Mtx_unlock ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z

imm32

ImmGetContext ImmReleaseContext ImmSetCandidateWindow ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memcmp memchr memset _CxxThrowException __current_exception_context __current_exception __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate strstr strchr

api-ms-win-crt-stdio-l1-1-0

_fseeki64 fsetpos ungetc setvbuf fgetpos __stdio_common_vsprintf_s ftell fputc __acrt_iob_func _get_stream_buffer_pointers __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __p__commode _set_fmode __stdio_common_vfprintf fseek fclose fflush fgetc

api-ms-win-crt-runtime-l1-1-0

_set_app_type _get_narrow_winmain_command_line _initterm _beginthreadex _initterm_e exit _cexit _crt_atexit _c_exit terminate _register_thread_local_exe_atexit_callback _invoke_watson _errno _register_onexit_function _exit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_exe

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-string-l1-1-0

strncmp tolower strcmp strncpy

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof strtoul

api-ms-win-crt-time-l1-1-0

clock _time64 _localtime64_s strftime

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

sqrtf cosf acosf powf _hypotf __setusermatherr sinf fmodf logf ceilf _fdclass

api-ms-win-crt-locale-l1-1-0

_configthreadlocale