Nature-Client-DLL-1.26.x.zip
- SHA256 a9b70a250b42db014be88c8d1b2490edaf8a5ad6d552a41d9334219d030e7142
Static task
static1
1 signatures
General
- Target Nature-Client-DLL-1.26.x.zip
- Size 8.3MB
- Sample261009-2z3rnsxt7j
- SHA256 a9b70a250b42db014be88c8d1b2490edaf8a5ad6d552a41d9334219d030e7142
- MD5 666d2311aee2344f970eb285f8a0b99f
- SHA1 f61dd7593798732f8544e12c9ee848c06e381187
- SHA512 f7a831440bbf74527d1756407215f297f6a6f81d988c730766c565eaa9fed666f1608fc45ec959eb96947b4cf7a7663fb020b322f8e57316e551911af313d758
- SSDEEP 196608:PAjECOvjpQl2G1TVUErF85k96FjB/Dxj6uG3n8BuWg9o7nes:PgEvLuiEruksfDxWaffqs
- TLSH T13E9633AFC8CD11B9CA15F14AD233C9F72C006B91D6B7134F9EDBB0A06516AD48367366
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Nature.dll
File Explorer
-
Nature-Client-DLL-1.26.x.zip.zip 8.3MB
-
Nature.dll.dll 15.8MB
Nature.dll
- IMPHASH 5a2c1bae5d17d2964b309deaf3cf60e8
- SHA256 1cb9e9aecbab5dea524e30673b8fdea7679a2e5a2ac2ab4e941a6bc5dd942008
- MD5 970422c6ada34518b5621607c40d3b16
- SHA1 072ae7a9bdd57b13b0b1845e95b97ea557c0d339
- SHA512 fb83c5098f73ce48b14300cc6dfcc7ca4facb18255b7e6c7f668429832f40d270549b8e9e75e6c19d82a140636a0e56f1f1de862555a105407105796db1da115
- SSDEEP 196608:UTDAnytwViyc7iEp2yRSAVjEiaqXFSHuEicF1x1K2hO9qEs7BOsfEMRF6+i8Ihun:UTDAnytlE91thPhREMRFTIhuWo
- TLSH T107F6AD836219388BC061A7BC4403927DF19EF80D9B55C7F79AD7FC2A99E71811E11FA8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
3143664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
d2d1
ord1
d3d11
D3D11On12CreateDevice
d3dcompiler_47
D3DCompile
api-ms-win-core-version-l1-1-1
GetFileVersionInfoW
api-ms-win-core-version-l1-1-0
VerQueryValueW
api-ms-win-core-handle-l1-1-0
CloseHandle
api-ms-win-core-file-l1-2-0
CreateFile2
api-ms-win-core-file-l1-1-0
CreateDirectoryW
CreateFileA
CreateFileW
FindClose
FindFirstFileExW
FindFirstFileW
FindNextFileW
FlushFileBuffers
GetDriveTypeW
GetFileAttributesExW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
api-ms-win-core-memory-l1-1-1
CreateFileMappingFromApp
MapViewOfFileFromApp
api-ms-win-core-processthreads-l1-1-0
CreateThread
ExitProcess
ExitThread
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetExitCodeThread
GetStartupInfoW
SetThreadPriority
SwitchToThread
TerminateProcess
api-ms-win-core-libraryloader-l1-2-0
DisableThreadLibraryCalls
FreeLibrary
FreeLibraryAndExitThread
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleExW
GetModuleHandleW
GetProcAddress
LoadLibraryExW
LoadResource
LockResource
SizeofResource
api-ms-win-core-kernel32-legacy-l1-1-0
CreateFileMappingA
FindResourceA
api-ms-win-core-errorhandling-l1-1-0
GetLastError
RaiseException
SetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-sysinfo-l1-1-0
GetLogicalProcessorInformationEx
GetSystemInfo
GetSystemTimeAsFileTime
api-ms-win-core-heap-l2-1-0
GlobalAlloc
GlobalFree
LocalFree
api-ms-win-core-heap-obsolete-l1-1-0
GlobalLock
GlobalUnlock
api-ms-win-core-libraryloader-l1-2-1
LoadLibraryA
LoadLibraryW
api-ms-win-core-string-l1-1-0
CompareStringEx
CompareStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
QueryPerformanceFrequency
api-ms-win-core-synch-l1-2-0
Sleep
SleepConditionVariableSRW
WakeAllConditionVariable
WakeConditionVariable
api-ms-win-core-memory-l1-1-0
MapViewOfFile
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
ws2_32
WSAAccept
WSACleanup
WSAPoll
WSASocketW
WSAStartup
bind
closesocket
freeaddrinfo
getaddrinfo
getnameinfo
getpeername
getsockname
listen
ntohs
recv
send
setsockopt
shutdown
socket
winhttp
WinHttpCloseHandle
WinHttpConnect
WinHttpCrackUrl
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
version
GetFileVersionInfoSizeW
gameinput
ord1
user32
CallWindowProcW
ClientToScreen
CloseClipboard
CreateWindowExA
DefWindowProcA
DestroyWindow
EmptyClipboard
FindWindowA
GetAsyncKeyState
GetClientRect
GetClipboardData
GetDpiForWindow
GetKeyState
GetKeyboardLayout
LoadCursorA
MapVirtualKeyExA
MessageBoxW
OpenClipboard
RegisterClassExA
SetClipboardData
SetCursor
SetCursorPos
SetWindowLongPtrW
SetWindowTextW
ToUnicodeEx
UnregisterClassA
shell32
SHGetKnownFolderPath
ShellExecuteW
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
api-ms-win-core-synch-l1-1-0
AcquireSRWLockExclusive
CreateEventA
DeleteCriticalSection
EnterCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
ResetEvent
SetEvent
TryAcquireSRWLockExclusive
WaitForSingleObject
WaitForSingleObjectEx
api-ms-win-core-synch-ansi-l1-1-0
CreateSemaphoreA
api-ms-win-core-localization-l1-2-0
EnumSystemLocalesW
FormatMessageA
GetACP
GetCPInfo
GetLocaleInfoEx
GetLocaleInfoW
GetOEMCP
GetUserDefaultLCID
IsValidCodePage
IsValidLocale
LCMapStringEx
LCMapStringW
api-ms-win-core-rtlsupport-l1-1-0
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
api-ms-win-core-sysinfo-l1-2-0
GetSystemTimePreciseAsFileTime
api-ms-win-core-processenvironment-l1-1-0
FreeEnvironmentStringsW
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryW
GetEnvironmentStringsW
GetStdHandle
SetEnvironmentVariableW
SetStdHandle
api-ms-win-core-file-l1-2-2
AreFileApisANSI
api-ms-win-core-file-l2-1-0
GetFileInformationByHandleEx
api-ms-win-core-heap-l1-1-0
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
kernel32
IsBadReadPtr
IsBadWritePtr
api-ms-win-core-errorhandling-l1-1-1
AddVectoredExceptionHandler
RemoveVectoredExceptionHandler
api-ms-win-core-util-l1-1-0
DecodePointer
EncodePointer
oleaut32
GetErrorInfo
SysFreeString
SysStringLen
api-ms-win-core-winrt-error-l1-1-1
RoOriginateLanguageException
api-ms-win-core-interlocked-l1-1-0
InitializeSListHead
InterlockedFlushSList
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
api-ms-win-core-namedpipe-l1-1-0
PeekNamedPipe
api-ms-win-core-timezone-l1-1-0
FileTimeToSystemTime
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
api-ms-win-core-fibers-l1-1-0
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
api-ms-win-core-console-l1-1-0
GetConsoleMode
GetConsoleOutputCP
ReadConsoleW
WriteConsoleW
?Loader@@YA_KPEAX@Z
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
10KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
100KB
Virtual Size
99KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
11.3MB
Virtual Size
11.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ