NUSANTARA-LS_%5BDN%5D[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
NUSANTARA-LS_%5BDN%5D.exe
Size 47KB
Sample260930-ancbssxt2l
SHA256 75ed1a9f5a3297a71b4493d080a2c42c98f897302cb4682c27b7a7c2d79f22ca
MD5 9b54a8ba0c742dbdb40181b746b0bc5d
SHA1 155afbf31f7d6f2e4320e304bac3c17c4db6db91
SHA512 701d1b7f947b9e2d65b2535318242f2a7daef86bbe1dbe9cb996ac979ca17e0dbe9636a51b248eba85ac45ba1cbb2e7b10bd001bae8df76ad380e94ad406b0df
SSDEEP 768:Sej4mi1fLiwdLgLYBRRdk7tfxeOlQl0WG6/JaqVxB3BHsv97OX+JvrT:Vj4m+f/dLg0etbw7/Ja8xrUoX+Jv
TLSH
T1F2235B63BA4A8471D09402F1AC7A6BD787BFA8B10B1C93E7B3C6C9691A543D0FC7154E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
NUSANTARA-LS_%5BDN%5D.exe

File Explorer

NUSANTARA-LS_%5BDN%5D.exe

.exe 47KB

NUSANTARA-LS_%5BDN%5D.exe

IMPHASH 437c304199646d1be7f8057d8c727727
SHA256 75ed1a9f5a3297a71b4493d080a2c42c98f897302cb4682c27b7a7c2d79f22ca
MD5 9b54a8ba0c742dbdb40181b746b0bc5d
SHA1 155afbf31f7d6f2e4320e304bac3c17c4db6db91
SHA512 701d1b7f947b9e2d65b2535318242f2a7daef86bbe1dbe9cb996ac979ca17e0dbe9636a51b248eba85ac45ba1cbb2e7b10bd001bae8df76ad380e94ad406b0df
SSDEEP 768:Sej4mi1fLiwdLgLYBRRdk7tfxeOlQl0WG6/JaqVxB3BHsv97OX+JvrT:Vj4m+f/dLg0etbw7/Ja8xrUoX+Jv
TLSH
T1F2235B63BA4A8471D09402F1AC7A6BD787BFA8B10B1C93E7B3C6C9691A543D0FC7154E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30479

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\New folder\New Inject\NCZ\NUSANTARA-LS.pdb

kernel32

DeviceIoControl GetLastError CreateFileA GetVersionExA CloseHandle Process32First WriteProcessMemory SetConsoleTitleA WriteFile TerminateProcess WaitForSingleObject lstrcmpA GetCurrentProcess OpenProcess CreateToolhelp32Snapshot Sleep DeleteFileA Process32Next GetSystemInfo CreateThread Beep GetProcAddress VirtualAllocEx ExitProcess VirtualFreeEx GetModuleHandleA GetModuleHandleW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId SetPriorityClass SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter UnhandledExceptionFilter

user32

MessageBoxA

shell32

ShellExecuteA

msvcp140

?good@ios_base@std@@QBE_NXZ ??1_Lockit@std@@QAE@XZ ??0_Lockit@std@@QAE@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PAD1AAPAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QBEHAAU_Mbstatet@@PBD1AAPBDPAD3AAPAD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ ?always_noconv@codecvt_base@std@@QBE_NXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Xlength_error@std@@YAXPBD@Z ?uncaught_exception@std@@YA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?_Xbad_alloc@std@@YAXXZ

wininet

InternetOpenUrlA InternetOpenA InternetReadFile HttpQueryInfoA InternetCloseHandle

iphlpapi

GetAdaptersInfo

vcruntime140

__current_exception_context memcpy __current_exception _CxxThrowException __std_exception_copy memset __std_exception_destroy _except_handler4_common __std_terminate __CxxFrameHandler3 memmove

api-ms-win-crt-string-l1-1-0

tolower isalnum strncpy isprint isspace _stricmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s fputc fflush _set_fmode _get_stream_buffer_pointers __stdio_common_vsprintf _fseeki64 fread fsetpos ungetc fclose fgetc setvbuf fgetpos fwrite __p__commode

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _configure_narrow_argv _set_app_type exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _seh_filter_exe _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit _controlfp_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale