Nebula[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nebula.exe
Size 2.5MB
Sample261014-jpc46afb82
SHA256 b339f8b04a3ed4f7bec0c2d47f7d19afc98021208e05b10ad88e67108633b445
MD5 12c09ec3a37f219328a244f0d120fba3
SHA1 d7ae2b7e196071a09d72f3208ad053f08732cb9f
SHA512 6161968d23befec3b92c5ece057c72adb8a786b7e4f61b730ea7d36b9194d643c92af2a996af892848d53943e9044ca60e8193bdcbf003b55667f08349c41397
SSDEEP 49152:cv4LGo+rBKQRdYqOF0+8OlghYzFrU7nhfEr+:0QtO+3
TLSH
T1C1C51987D7F741E4C176E138A242722BF5323419873893E76BD44B5A4BA67E0DABE310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Nebula.exe

File Explorer

Nebula.exe

.exe 2.5MB

Nebula.exe

IMPHASH f85bd1d28ee060f857ebc395361323e7
SHA256 b339f8b04a3ed4f7bec0c2d47f7d19afc98021208e05b10ad88e67108633b445
MD5 12c09ec3a37f219328a244f0d120fba3
SHA1 d7ae2b7e196071a09d72f3208ad053f08732cb9f
SHA512 6161968d23befec3b92c5ece057c72adb8a786b7e4f61b730ea7d36b9194d643c92af2a996af892848d53943e9044ca60e8193bdcbf003b55667f08349c41397
SSDEEP 49152:cv4LGo+rBKQRdYqOF0+8OlghYzFrU7nhfEr+:0QtO+3
TLSH
T1C1C51987D7F741E4C176E138A242722BF5323419873893E76BD44B5A4BA67E0DABE310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1604164

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea DwmIsCompositionEnabled DwmGetColorizationColor DwmEnableBlurBehindWindow

kernel32

DeviceIoControl Sleep GetProcessTimes OpenProcess GetModuleHandleW GetConsoleMode SetConsoleMode SetConsoleTitleA CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW GlobalAlloc GlobalUnlock GlobalLock GlobalFree MultiByteToWideChar WideCharToMultiByte VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA GetLocaleInfoA CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapReAlloc HeapFree GetProcessHeap MapViewOfFile UnmapViewOfFile CreateFileMappingA GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage SetFilePointerEx CloseHandle FlushFileBuffers GetFileType ReadConsoleW ReadConsoleInputW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc CreateProcessW GetExitCodeProcess WaitForSingleObject GetCommandLineW GetCommandLineA WriteFile GetModuleFileNameW GetConsoleCP FreeLibraryAndExitThread ExitThread CreateThread GetModuleHandleExW ExitProcess LoadLibraryExW Beep CreateFileW GetStdHandle FreeEnvironmentStringsW TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind SetLastError SetEnvironmentVariableW SetStdHandle WriteConsoleW HeapSize GetConsoleOutputCP LocalFree FormatMessageA GetLocaleInfoEx GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive SleepConditionVariableSRW SetEndOfFile CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetLastError GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime WakeAllConditionVariable EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx

user32

CreateWindowExW RegisterClassExW TranslateMessage DefWindowProcW PeekMessageW GetClipboardData DestroyWindow SetProcessDPIAware MonitorFromWindow LoadCursorW ScreenToClient ClientToScreen SetCursor SetCursorPos GetClientRect ReleaseDC GetDC GetForegroundWindow IsWindowUnicode ReleaseCapture SetCapture GetCapture GetKeyState GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard ShowWindow SetClipboardData CloseClipboard OpenClipboard SetWindowLongPtrW GetWindowLongPtrW GetCursorPos ShowCursor UpdateWindow GetSystemMetrics GetAsyncKeyState SetWindowDisplayAffinity SetWindowPos SetLayeredWindowAttributes DispatchMessageW

gdi32

DeleteObject GetDeviceCaps CreateRectRgn

shell32

ShellExecuteA

ole32

CoCreateInstance

wininet

InternetCloseHandle InternetOpenUrlA InternetReadFile InternetOpenA

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

321KB

Virtual Size

321KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

425KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nebula.exe

d3d11

dwmapi

kernel32

user32

gdi32

shell32

ole32

wininet

imm32

d3dcompiler_47

generic