nonagon_loader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
nonagon_loader.exe
Size 17.2MB
Sample261014-nz3vsafh69
SHA256 a1867ff1c05138d2958143de30ad5528d11a281e9d0c3333aaebcddf2be31fb7
MD5 46bf17cf4bf74421bd4a298eb7c8a554
SHA1 e3286b98c873b9a75c4726a13e48a74008a189ef
SHA512 5cda182a72e599b838fb241cf3625d71e6cad8d7ab37a10fa757840ca68c25f3c60fcbf8abfa3eebde9d439f7f734b65941d4a1c0369362519cbd917ad650cd8
SSDEEP 393216:62NxuSchCWTiyCA4ZrEwNtFIsQpPVfy8H:6GU5RGZrEwDFREf
TLSH
T12F0723CF62BED2DAC0932B607C4257BF2494312E58AC861E35CE1CCA7E50F5949C9B76
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

themida

Malware Config

Signatures

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
sample	themida

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nonagon_loader.exe

File Explorer

nonagon_loader.exe

.exe 17.2MB

nonagon_loader.exe

IMPHASH a63071856aa65e2a1e37b4cbce1aba1e
SHA256 a1867ff1c05138d2958143de30ad5528d11a281e9d0c3333aaebcddf2be31fb7
MD5 46bf17cf4bf74421bd4a298eb7c8a554
SHA1 e3286b98c873b9a75c4726a13e48a74008a189ef
SHA512 5cda182a72e599b838fb241cf3625d71e6cad8d7ab37a10fa757840ca68c25f3c60fcbf8abfa3eebde9d439f7f734b65941d4a1c0369362519cbd917ad650cd8
SSDEEP 393216:62NxuSchCWTiyCA4ZrEwNtFIsQpPVfy8H:6GU5RGZrEwDFREf
TLSH
T12F0723CF62BED2DAC0932B607C4257BF2494312E58AC861E35CE1CCA7E50F5949C9B76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Themida packer

Detects Themida, an advanced Windows software protection system.

themida
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16517741

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

ws2_32

WSACleanup

iphlpapi

GetAdaptersInfo

kernel32

AcquireSRWLockExclusive

user32

ClientToScreen

gdi32

CreateRectRgn

shell32

ShellExecuteA

advapi32

AdjustTokenPrivileges

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

crypt32

CryptProtectData

ntdll

RtlInitUnicodeString

imm32

ImmGetContext

dwmapi

DwmEnableBlurBehindWindow

vcruntime140

_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

645KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

Virtual Size

10.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.themida

Size

512B

Virtual Size

496B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.themida

Size

16.9MB

Virtual Size

16.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nonagon_loader.exe

d3d11

d3dx11_43

d3dcompiler_43

ws2_32

iphlpapi

kernel32

user32

gdi32

shell32

advapi32

msvcp140

crypt32

ntdll

imm32

dwmapi

vcruntime140

vcruntime140_1

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic