Nᴇ︎x︎ᴏ︎ʀ︎ʏ︎ Fʀᴇᴇ Pᴀɴᴇʟ[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
Nᴇ︎x︎ᴏ︎ʀ︎ʏ︎ Fʀᴇᴇ Pᴀɴᴇʟ.dll
Size 26.5MB
Sample260930-nphf4a1w2p
SHA256 b0a8c767ec51a9af39fa0a4f235cebe8ec22d0a2c772b63c35b19e4525866395
MD5 3b2e6d58c8831947a2285ef41d82e789
SHA1 d2f3ded10a7b8ec39b0bda3c06c8320ae8a41ed8
SHA512 ef3bc09a49558ec63996e9d885af95a8996a70adbe6bf625f22f53ee6f8296d89f6ebe05584aadc837996975f0ad2b58f204c4a35d50e63408174b02183d9984
SSDEEP 393216:EuYfSTTN+qIf/efJ1Z34jRKT0WdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoBXX:+/ADdclNJNfSpzAPXX
TLSH
T198570243A2C64356DFA2B93DA1129323E1A2FCD6231186C75F9D0F1ADB17AF0497DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nᴇ︎x︎ᴏ︎ʀ︎ʏ︎ Fʀᴇᴇ Pᴀɴᴇʟ.dll

File Explorer

Nᴇ︎x︎ᴏ︎ʀ︎ʏ︎ Fʀᴇᴇ Pᴀɴᴇʟ.dll

.dll 26.5MB

Nᴇ︎x︎ᴏ︎ʀ︎ʏ︎ Fʀᴇᴇ Pᴀɴᴇʟ.dll

IMPHASH 4b02d7b12c4746b6e7181b3753b8d953
SHA256 b0a8c767ec51a9af39fa0a4f235cebe8ec22d0a2c772b63c35b19e4525866395
MD5 3b2e6d58c8831947a2285ef41d82e789
SHA1 d2f3ded10a7b8ec39b0bda3c06c8320ae8a41ed8
SHA512 ef3bc09a49558ec63996e9d885af95a8996a70adbe6bf625f22f53ee6f8296d89f6ebe05584aadc837996975f0ad2b58f204c4a35d50e63408174b02183d9984
SSDEEP 393216:EuYfSTTN+qIf/efJ1Z34jRKT0WdcSG4F4N6DdvhN/i18EczA7nfoPDpwQSpQoBXX:+/ADdclNJNfSpzAPXX
TLSH
T198570243A2C64356DFA2B93DA1129323E1A2FCD6231186C75F9D0F1ADB17AF0497DB18
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1160236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

advapi32

AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam

kernel32

SetCurrentDirectoryA Process32NextW Process32FirstW CreateProcessA GetExitCodeProcess CreateDirectoryA WriteProcessMemory OutputDebugStringA InitializeCriticalSectionEx GetFileAttributesA VirtualProtectEx DeleteCriticalSection ReadProcessMemory GetTickCount VirtualQueryEx GetTickCount64 CreateFileA GetFileSizeEx GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetModuleFileNameW WaitForSingleObject CreatePipe TerminateProcess WriteFile SetHandleInformation GetModuleFileNameA ReadFile OpenThread SetThreadContext FlushInstructionCache GetModuleHandleW GetCurrentProcessId GetThreadContext FormatMessageA HeapDestroy GetLocaleInfoEx HeapAlloc CloseHandle GetCurrentDirectoryW HeapReAlloc GetLastError CreateDirectoryW FindClose CreateToolhelp32Snapshot ResumeThread FindFirstFileW SuspendThread GetCurrentThreadId Thread32First Thread32Next HeapFree VirtualProtect HeapCreate VirtualQuery GetSystemInfo VirtualAlloc VirtualFree Beep CreateThread DisableThreadLibraryCalls Sleep FreeLibraryAndExitThread GetCurrentProcess SetPriorityClass GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask ReleaseSRWLockExclusive GetFileAttributesExW AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetSystemTimeAsFileTime InitializeSListHead GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA QueryFullProcessImageNameW SetLastError FormatMessageW InitializeCriticalSection LocalFree GetSystemDirectoryW LoadLibraryW SleepEx MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType PeekNamedPipe WaitForMultipleObjects VerifyVersionInfoW HeapSize AddVectoredExceptionHandler AreFileApisANSI CreateFileW LeaveCriticalSection EnterCriticalSection OutputDebugStringW SetFileInformationByHandle InitOnceBeginInitialize InitOnceComplete OpenProcess GetModuleHandleA CreateFileMappingW GetFileInformationByHandleEx

user32

GetClientRect SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent ClientToScreen GetCapture ScreenToClient LoadCursorA IsWindowUnicode ReleaseCapture SetCursorPos GetMessageExtraInfo SetWindowPos GetSystemMetrics MessageBoxA SystemParametersInfoA SetWindowLongPtrA SetForegroundWindow EnumChildWindows GetClassNameA GetWindowTextA GetWindowRect CreateWindowExW UnregisterClassW RegisterClassExW ShowWindow MapWindowPoints MoveWindow DefWindowProcA SetLayeredWindowAttributes UpdateWindow IsWindow EnumWindows GetWindowTextW GetWindowThreadProcessId PostMessageA FindWindowExA mouse_event GetCursorPos GetCursorInfo MapVirtualKeyW GetAsyncKeyState GetKeyNameTextW DispatchMessageA MessageBoxW SetWindowDisplayAffinity TranslateMessage PeekMessageA IsIconic OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData GetKeyState

gdi32

CreateSolidBrush

shell32

SHGetFolderPathA ShellExecuteA

msvcp140

?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?width@ios_base@std@@QEAA_J_J@Z ?width@ios_base@std@@QEBA_JXZ ?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ _Thrd_join _Thrd_id ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Xtime_get_ticks _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?id@?$ctype@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Strxfrm ?_Random_device@std@@YAIXZ ?_Xout_of_range@std@@YAXPEBD@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_counter _Query_perf_frequency ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Xlength_error@std@@YAXPEBD@Z

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCompositionWindow ImmGetContext ImmSetCandidateWindow

urlmon

URLDownloadToFileA

ntdll

RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

wtsapi32

WTSEnumerateProcessesExW WTSFreeMemoryExW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy strstr strchr __std_terminate longjmp memcpy memmove memset __std_exception_destroy strrchr memchr memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException __std_type_info_destroy_list wcschr

api-ms-win-crt-runtime-l1-1-0

_resetstkoflw __sys_nerr __sys_errlist abort exit _invalid_parameter_noinfo_noreturn _errno _invalid_parameter_noinfo _initterm_e _initterm _seh_filter_dll _configure_narrow_argv terminate _beginthreadex _initialize_narrow_environment _initialize_onexit_table _wassert _invoke_watson _register_onexit_function system _cexit _crt_atexit _execute_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf fseek _wfopen fflush __acrt_iob_func ftell __stdio_common_vsprintf fread __stdio_common_vsscanf _get_stream_buffer_pointers _fseeki64 fsetpos fopen ungetc setvbuf fgets _pclose _popen fputc __stdio_common_vsprintf_s fgetc fputs feof _wopen _lseeki64 fwrite _close _fileno _write fclose fgetpos _read

api-ms-win-crt-utility-l1-1-0

srand qsort rand

api-ms-win-crt-string-l1-1-0

strncmp strcpy_s strncpy _strdup wcsncpy strpbrk wcsncmp strspn wcspbrk strcspn _wcsdup tolower _wcsicmp strcmp strncpy_s towlower _stricmp

api-ms-win-crt-heap-l1-1-0

_msize free calloc realloc _callnewh malloc

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll wcstombs strtoull atoi strtoul atof

api-ms-win-crt-math-l1-1-0

_dsign acosf sqrtf atan2f _hypotf _fdclass ceilf cosf fmodf log logf pow copysignf powf roundf sinf sqrt _fdopen

api-ms-win-crt-filesystem-l1-1-0

_unlink _unlock_file remove _wstat64 _fstat64 _lock_file

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _time64 _gmtime64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-locale-l1-1-0

localeconv ___lc_codepage_func

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

ws2_32

sendto htonl recvfrom gethostname getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop WSAStartup WSACleanup bind connect getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept freeaddrinfo listen getaddrinfo ioctlsocket

crypt32

CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryW CertCloseStore CertGetCertificateChain PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChain CertOpenStore CertFreeCertificateChainEngine

psapi

GetModuleInformation

shlwapi

PathFindFileNameW