OneTerm-setup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
OneTerm-setup.exe
Size 4.6MB
Sample261002-k4x9basakd
SHA256 5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e
MD5 82511fcfa1162c971127a9063175e67e
SHA1 5de0c8879ebc0a6f6fdd293d8bdefef9b4b90809
SHA512 54e861b70971cb5f51bf62d261aa8b04a18a6135064637b406636fb09a047526c6c4db1c2b4f3cb5ba5db9a5a87a4daed495b2793fffd90f951374ac83d09b3e
SSDEEP 98304:j14Qqbr99DxJrB+uqDAEvXg5NuSIpO0l0fssNhSYuBRPfQ:jC9v3PqcEP6und0EouBRPfQ
TLSH
T1E926335E9E019EE5F30AC4392675D4B6487A7DF8E45F1295DE830D328C3B780FE6A206
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
OneTerm-setup.exe
unpack001/$PLUGINSDIR/NSISdl.dll
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/nexterm.exe

File Explorer

OneTerm-setup.exe

.exe 4.6MB
$PLUGINSDIR/NSISdl.dll

.dll 160KB
$PLUGINSDIR/StartMenu.dll

.dll 12KB
$PLUGINSDIR/System.dll

.dll 28KB
$PLUGINSDIR/modern-wizard.bmp

25KB
$PLUGINSDIR/nsDialogs.dll

.dll 14KB
$PLUGINSDIR/nsis_tauri_utils.dll

.dll 33KB
nexterm.exe

.exe 15.4MB

OneTerm-setup.exe

IMPHASH f4d1e4cd7416ef83f79f7c6a038875b3
SHA256 5b288132f126e009d486f2125b1b7cdb126ae2fa55a96bcebaf9dcc20f0acd1e
MD5 82511fcfa1162c971127a9063175e67e
SHA1 5de0c8879ebc0a6f6fdd293d8bdefef9b4b90809
SHA512 54e861b70971cb5f51bf62d261aa8b04a18a6135064637b406636fb09a047526c6c4db1c2b4f3cb5ba5db9a5a87a4daed495b2793fffd90f951374ac83d09b3e
SSDEEP 98304:j14Qqbr99DxJrB+uqDAEvXg5NuSIpO0l0fssNhSYuBRPfQ:jC9v3PqcEP6und0EouBRPfQ
TLSH
T1E926335E9E019EE5F30AC4392675D4B6487A7DF8E45F1295DE830D328C3B780FE6A206
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17880

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegCloseKey RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

comctl32

ImageList_AddMasked ImageList_Create ImageList_Destroy InitCommonControls

gdi32

CreateBrushIndirect CreateFontIndirectW DeleteObject GetDeviceCaps SelectObject SetBkColor SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CopyFileW CreateDirectoryW CreateFileW CreateProcessW CreateThread DeleteFileW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetCurrentProcess GetDiskFreeSpaceW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileStringW GetProcAddress GetShortPathNameW GetSystemDirectoryW GetTempFileNameW GetTempPathW GetTickCount GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock LoadLibraryExW MoveFileExW MoveFileW MulDiv MultiByteToWideChar ReadFile RemoveDirectoryW SearchPathW SetCurrentDirectoryW SetEnvironmentVariableW SetErrorMode SetFileAttributesW SetFilePointer SetFileTime Sleep WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW lstrcatW lstrcmpW lstrcmpiA lstrcmpiW lstrcpyA lstrcpynW lstrlenA lstrlenW

ole32

CoCreateInstance CoTaskMemFree IIDFromString OleInitialize OleUninitialize

shell32

SHBrowseForFolderW SHFileOperationW SHGetFileInfoW SHGetPathFromIDListW ShellExecuteExW

user32

AppendMenuW BeginPaint CallWindowProcW CharNextA CharNextW CharPrevW CheckDlgButton CloseClipboard CreateDialogParamW CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW DrawTextW EmptyClipboard EnableMenuItem EnableWindow EndDialog EndPaint ExitWindowsEx FillRect FindWindowExW GetClassInfoW GetClientRect GetDC GetDlgItem GetDlgItemTextW GetMessagePos GetSysColor GetSystemMenu GetSystemMetrics GetWindowLongW GetWindowRect InvalidateRect IsWindow IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MessageBoxIndirectW OpenClipboard PeekMessageW PostQuitMessage RegisterClassW ReleaseDC ScreenToClient SendMessageTimeoutW SendMessageW SetClassLongW SetClipboardData SetCursor SetDlgItemTextW SetForegroundWindow SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu wsprintfA wsprintfW

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

125KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ndata

Size

512B

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

$PLUGINSDIR/NSISdl.dll

IMPHASH f3a8d9b087fe3f967fe766bf590224a4
SHA256 0cee4c182ea92b2e7bce942db990e5bd88ab6f8927704209817d04cfab25cf1f
MD5 94bed44c269786f8f99db87819171975
SHA1 6f29a1b26d31d49037a4fca2e704f5cafef97423
SHA512 00188e6c170698c950bbbfd5a406277ee5af672c03e727033623b8ab78aff07be042b7abc751a0f13f0c60df208ebec5c6b933dd93c52f60084b57d8bee066b1
SSDEEP 3072:I8E3/fryaDndgiHIW+G+Ftvb00mPvOUnhh6SOY:I82/fWYVHIbGmlYZPWUna
TLSH
T1C8F33B9DFA4344F6E1AB10F80CDFE7FB456472018426AAF6EBCF9D47B8B27521884149
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13481

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

CloseHandle CreateFileW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FreeLibrary GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetThreadId GetTickCount GlobalAlloc GlobalFree InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA MulDiv MultiByteToWideChar SetLastError Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcatA lstrcmpiA lstrcpyA lstrcpyW lstrcpynA lstrcpynW lstrlenA

msvcrt

__mb_cur_max _amsg_exit _errno _initterm _iob _lock _unlock abort atoi calloc fputc fputs free fwrite getenv localeconv malloc memcmp memcpy memset realloc setlocale strchr strcmp strerror strlen strncmp strtoul vfprintf wcslen

user32

CallWindowProcW CharPrevA CreateWindowExW DestroyWindow EnableWindow FindWindowExW GetClientRect GetDlgItem GetFocus GetWindowLongW GetWindowRect IsWindowVisible RegisterWindowMessageW SendMessageW SetDlgItemTextA SetWindowLongW SetWindowTextA ShowWindow wsprintfA wsprintfW

wsock32

WSACleanup WSAGetLastError WSAStartup __WSAFDIsSet closesocket connect gethostbyname getsockname htons inet_addr ioctlsocket recv select send shutdown socket

Name

.text

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

95B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/StartMenu.dll

IMPHASH c20327fced07b6e73d2262fc88b11552
SHA256 dfa02ad29e171ba94e2ed1cf67fb125d4b976bfe6ef2258fc2666d811c7e7ff0
MD5 603fc3c0741ebb52d480e254bfe725b9
SHA1 b09a8a1fe852832ce14c9c1970e257794b4fafa0
SHA512 7264b19d3859791d13e98a4abdfa9501742ef4d50e7102ff5eb19158f0f57f77a99ff84482a03d5f698d021e5d8f428059a459119244b8ef49cf17b4cbd9608f
SSDEEP 192:+1husyjb04+hG13uw0Y/5jiEelSxDObJ/:My84euuw0YhZelSIJ/
TLSH
T17D429419BF4745F6E9B39534405FEBEF451BA520DA2F4E0AEB090A09FE77271580E342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

540B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

101B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/System.dll

IMPHASH b844086d4b3e59aa7b4439d88bcb40cb
SHA256 54167ae0968e05910ef8dcd8bbc345afe3dad810fd3c9d2d3f47ad4caffc456d
MD5 4fd5a2cd0c65c6552fea0cc11938f251
SHA1 e8f11c1f919eee06f8ebfde989ff53a15243e57f
SHA512 7703a4a59be8a1e349ae7435f9f3f25698aa774428c7e99cc34a27ce51cc41fe6ca09102dab6ead10fd71e30db14852f12ef57587845ec9ab85e70be2ad85609
SSDEEP 384:m9YwotlRxnX/+XWmsKP73mwYbhzc7qxD6jT6s6HXRes59:mOrRtXjtWGMqgjW6U
TLSH
T19DD2081AFF06C9F2C1E2D57049DFFB77C626B92847260E6BFF1E5E08B8236125909205
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13277

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

179B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsDialogs.dll

IMPHASH c442f1649aa0670a32c622fadfcd00bd
SHA256 3564ce8b510acfe456f7135e0c1ac1f71cfa39c787909192be8f8ed40dcbe305
MD5 a396d30099517546b62c0aa673929f93
SHA1 f3eea24ee7faf86638dfd8c730a544a94716378b
SHA512 b9d4f025c6858f0483cf34a53d07b60673dcba7e782bfe51a7e00294a87de8de0b5ede4c28bfc3869f2a11dff76a96d9da9dce2f1558a315116f182b73ba886f
SSDEEP 192:8SOu+kSRU4pMhMoITEZR1w5kY/5OlVcJSUDKCWw6SZS7ZDk7IQH:Ofk6TpMhMoIwZR6OYIlWJS6KCWw4UF
TLSH
T15E52D50DBB0A44F6D572E935548FE73F868CA515D66B4F06EF170B0CADA72B1281E342
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8812

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

Name

.text

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

363B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

nexterm.exe

IMPHASH 5bfbad7910df2c5c9d81972919b9dacc
SHA256 6f13a663f25891b9815b737b5b3bdce647616266b6a73eed655d9f6ccb865cfc
MD5 56ceb29d91706a3e7a050a130ba8e657
SHA1 68e072f473077b175262479f30bf177b635d8d60
SHA512 deadea2d08b8c95df623ceb552242be86c85b4c4500b8990079b8ede18677a10689b15d8486754a3c21d698f669568c04b4a9b1c05fcd62eeafb6b94d02f3e10
SSDEEP 196608:zavtDT0Tu56kY5XNHKqWZNl2wxGKD3b+:Ct30iclFWZNwwMKv
TLSH
T122F62A01BE4B5998D08ACCB0C38B8A638E2234DB1936F9BF55C942293F7D7B55F19319
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11015968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

nexterm.pdb

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AddVectoredExceptionHandler CancelIo CloseHandle CompareStringOrdinal CopyFileExW CreateDirectoryW CreateEventW CreateFileW CreateIoCompletionPort CreateMutexA CreateMutexW CreatePipe CreateProcessW CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsSetValue FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeInfo GetNativeSystemInfo GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessWorkingSetSizeEx GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathW GetUserDefaultUILanguage GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapFree HeapReAlloc InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsThreadAFiber LCIDToLocaleName LoadLibraryA LoadLibraryExA LoadLibraryExW LoadLibraryW MoveFileExW MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadFileEx ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetErrorMode SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetProcessWorkingSetSizeEx SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepConditionVariableSRW SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter UpdateProcThreadAttribute VirtualLock VirtualUnlock WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteFileEx lstrlenW

advapi32

EventRegister EventSetInformation EventUnregister EventWriteTransfer ImpersonateAnonymousToken RegCloseKey RegEnumValueW RegGetValueW RegOpenKeyExW RegQueryValueExW RevertToSelf SystemFunction036

dnsapi

DnsFree DnsQuery_W

ntdll

NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtDeviceIoControlFile NtOpenFile NtReadFile NtWriteFile RtlGetVersion RtlNtStatusToDosError

oleaut32

GetErrorInfo SetErrorInfo SysFreeString SysStringLen

ole32

CoCreateFreeThreadedMarshaler CoCreateInstance CoInitialize CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize OleInitialize RegisterDragDrop RevokeDragDrop

api-ms-win-core-winrt-error-l1-1-0

RoOriginateErrorW

bcryptprimitives

ProcessPrng

user32

AdjustWindowRect AdjustWindowRectEx AllowSetForegroundWindow AppendMenuW ChangeDisplaySettingsExW CheckMenuItem ClientToScreen ClipCursor CloseClipboard CloseTouchInputHandle CreateAcceleratorTableW CreateIcon CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawIconEx DrawMenuBar DrawTextW EmptyClipboard EnableMenuItem EnableWindow EnumChildWindows EnumDisplayMonitors FillRect FindWindowExW FindWindowW FlashWindowEx GetActiveWindow GetAsyncKeyState GetClientRect GetClipCursor GetClipboardData GetCursorPos GetDC GetForegroundWindow GetIconInfo GetKeyState GetKeyboardLayout GetKeyboardLayoutNameW GetKeyboardState GetMenu GetMenuBarInfo GetMenuItemInfoW GetMessageA GetMessageW GetMonitorInfoW GetParent GetRawInputData GetSystemMenu GetSystemMetrics GetTouchInputInfo GetUpdateRect GetWindow GetWindowDC GetWindowLongPtrW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId InsertMenuW InvalidateRect InvalidateRgn IsClipboardFormatAvailable IsIconic IsProcessDPIAware IsWindowEnabled IsWindowVisible LoadCursorW LoadImageW MapVirtualKeyExW MapVirtualKeyW MapWindowPoints MonitorFromPoint MonitorFromRect MonitorFromWindow MsgWaitForMultipleObjectsEx OffsetRect OpenClipboard PeekMessageW PostMessageW PostQuitMessage PostThreadMessageW RedrawWindow RegisterClassExW RegisterClipboardFormatW RegisterRawInputDevices RegisterTouchWindow RegisterWindowMessageA ReleaseCapture ReleaseDC RemoveMenu ScreenToClient SendInput SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetMenu SetMenuItemInfoW SetParent SetPropW SetWindowDisplayAffinity SetWindowLongPtrW SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW ShowCursor ShowWindow SystemParametersInfoA SystemParametersInfoW ToUnicodeEx TrackMouseEvent TrackPopupMenu TranslateAcceleratorW TranslateMessage UpdateWindow ValidateRect VkKeyScanW

bcrypt

BCryptGenRandom

gdi32

BitBlt CombineRgn CreateCompatibleDC CreateDIBSection CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps SelectObject SetBkMode SetTextColor

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertOpenStore CryptAcquireCertificatePrivateKey

comctl32

DefSubclassProc RemoveWindowSubclass SetWindowSubclass TaskDialogIndirect

shell32

DragFinish DragQueryFileW ILCreateFromPathW ILFree SHAppBarMessage SHCreateItemFromParsingName SHGetKnownFolderPath SHGetStockIconInfo SHOpenFolderAndSelectItems ShellExecuteExW ShellExecuteW

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

imm32

ImmGetCompositionStringW ImmGetContext ImmReleaseContext

ncrypt

NCryptExportKey NCryptFreeObject

shlwapi

SHCreateMemStream

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket listen recv send sendto setsockopt shutdown

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vsscanf _fileno _set_fmode _setmode fclose feof ferror fflush fgets fopen fread fseek ftell fwrite

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type _wassert abort exit strerror terminate

api-ms-win-crt-utility-l1-1-0

bsearch

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc realloc

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-convert-l1-1-0

_ultow_s _wtoi strtol wcstol

api-ms-win-crt-string-l1-1-0

_wcsicmp strcmp strcpy_s strlen wcscmp wcslen wcsncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil floor pow round roundf trunc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

10.7MB

Virtual Size

10.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

198KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

518KB

Virtual Size

518KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

653B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

50KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

OneTerm-setup.exe

advapi32

comctl32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/NSISdl.dll

advapi32

kernel32

msvcrt

user32

wsock32

generic

$PLUGINSDIR/StartMenu.dll

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/System.dll

kernel32

msvcrt

ole32

user32

generic

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/nsDialogs.dll

comdlg32

gdi32

kernel32

ole32

shell32

user32

generic

$PLUGINSDIR/nsis_tauri_utils.dll

kernel32

advapi32

user32

shell32

generic

nexterm.exe

kernel32

advapi32

dnsapi

ntdll

oleaut32

ole32

api-ms-win-core-winrt-error-l1-1-0

bcryptprimitives

user32

bcrypt

gdi32

crypt32

comctl32

shell32

dwmapi

imm32

ncrypt

shlwapi

api-ms-win-core-synch-l1-2-0

ws2_32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic