nuaguex_internal_ui[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nuaguex_internal_ui.exe
Size 10.5MB
Sample261014-2ahefaax6j
SHA256 d2d8a7f98672755a5bddfa4bbbcd9fe4e5041a802b8ce5502b0c2592ccd5941d
MD5 4270eea404ee0ec2bb99d5d35f128685
SHA1 72f8d4bb2a04c2e775fa301aef3546e8562e5543
SHA512 669702fd23a596f69eb2263f6ab1394794f0499971300f07e6fa95e2fdf7da775554697b72d899ece953e0986cdc17596aecbfd9c09483c68ea83ea481d096c7
SSDEEP 98304:kqUkGRrdDZ5OD6HlY+1bLjo88APH1xp/h1CaKTfjwbDQf4fsW:Kk4/FY+1bLjo8DH1xp/h1CaKD8
TLSH
T173B65B7AF7E8059AC127D17E86F3510AC27174896320E7CB65AC66A11F733D4BB7E280
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nuaguex_internal_ui.exe

File Explorer

nuaguex_internal_ui.exe

.exe 10.5MB

nuaguex_internal_ui.exe

IMPHASH fc8f690492c5808419d75edf1c122bfd
SHA256 d2d8a7f98672755a5bddfa4bbbcd9fe4e5041a802b8ce5502b0c2592ccd5941d
MD5 4270eea404ee0ec2bb99d5d35f128685
SHA1 72f8d4bb2a04c2e775fa301aef3546e8562e5543
SHA512 669702fd23a596f69eb2263f6ab1394794f0499971300f07e6fa95e2fdf7da775554697b72d899ece953e0986cdc17596aecbfd9c09483c68ea83ea481d096c7
SSDEEP 98304:kqUkGRrdDZ5OD6HlY+1bLjo88APH1xp/h1CaKTfjwbDQf4fsW:Kk4/FY+1bLjo8DH1xp/h1CaKD8
TLSH
T173B65B7AF7E8059AC127D17E86F3510AC27174896320E7CB65AC66A11F733D4BB7E280
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

729664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Volxp\source\repos\nuaguex_internal_ui\build\bin\x64\Release\nuaguex_internal_ui.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

comdlg32

GetOpenFileNameW GetSaveFileNameW

kernel32

CreateFileW OpenProcess GetTickCount64 DeleteFileW CloseHandle GetCurrentProcessId WideCharToMultiByte Sleep GetModuleHandleW GetModuleFileNameW MultiByteToWideChar GetExitCodeProcess OutputDebugStringA GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency IsDBCSLeadByte GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter CreateToolhelp32Snapshot Module32FirstW Module32NextW WriteFile CreateFile2 VirtualAllocEx ReadProcessMemory VirtualFreeEx VirtualQuery GetTempPathA VirtualProtectEx VirtualQueryEx GetCurrentProcess DuplicateHandle AreFileApisANSI GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx FormatMessageA LocalFree MoveFileExW GetFileInformationByHandleEx ReleaseSRWLockExclusive GetTempPathW SetFileInformationByHandle AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetLastError WriteProcessMemory

user32

GetWindowRect AdjustWindowRectEx GetKeyState GetMessageExtraInfo SetPropA GetDC MonitorFromWindow EnumDisplayMonitors ScreenToClient WindowFromPoint GetCapture GetMonitorInfoW ClientToScreen IsChild TrackMouseEvent GetKeyboardLayout GetForegroundWindow GetPropA SetLayeredWindowAttributes SetFocus BringWindowToTop SetCapture SetCursor SetWindowLongW GetClientRect SetProcessDPIAware IsWindowUnicode GetWindowLongW FindWindowA WaitForInputIdle GetWindowThreadProcessId MessageBoxW GetCursorPos ReleaseCapture SetForegroundWindow SetCursorPos ReleaseDC OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData DefWindowProcW SetWindowLongPtrW DestroyWindow CreateWindowExW GetSystemMetrics UnregisterClassW GetDpiForWindow GetWindowLongPtrW RegisterClassExW SetWindowPos ShowWindow DispatchMessageW PeekMessageW TranslateMessage LoadCursorW GetSystemMetricsForDpi IsZoomed PostQuitMessage UpdateWindow IsIconic

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??Bios_base@std@@QEBA_NXZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ

dbghelp

SymInitialize SymCleanup

ntdll

NtQueryObject NtCreateSection NtMapViewOfSection NtUnmapViewOfSection NtQueryInformationProcess

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy _CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memmove memcpy memcmp memchr __std_terminate strchr __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s fgetpos __p__commode __stdio_common_vsscanf __stdio_common_vsprintf fwrite _wfopen _set_fmode setvbuf fgetc __stdio_common_vfprintf fclose fseek __acrt_iob_func fflush fputc ftell _get_stream_buffer_pointers _fseeki64 fread fsetpos __stdio_common_vsnwprintf_s ungetc

api-ms-win-crt-string-l1-1-0

isxdigit isalnum isspace isdigit isalpha tolower wcsncpy_s strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-runtime-l1-1-0

_beginthreadex terminate _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type abort _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _register_thread_local_exe_atexit_callback _c_exit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-environment-l1-1-0

_wgetenv

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

acosf fmodf cosf sqrtf __setusermatherr sinf ceilf expf