nyx[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
nyx.exe
Size 399KB
Sample261016-2vm6esew7y
SHA256 9da477c2a1f24e6ad6c0d6c0eba24d3bc6882eb59ea6d09951de5e7804e82c28
MD5 dc9c65fdd3b43406eb878bf2ce0b2fde
SHA1 c70f40a449ae5e1b9c457ae2358667604a2a97bf
SHA512 22f6a4fd9be101296989ca6f0ee0e8a5da97975806c25433d8fcfda97aa02e70d0bbcf06be33805db2920f5b111caabfc29ca9ddb32f2ca4efad4317388512b1
SSDEEP 6144:923RBxGVpuDl3BR1jTDvF/E9N7vWuqM9tNVlOXwX7HFSLsOpzhH+RmuU5K5knf2r:9KRBxGVkDVJyuuF9j3SLzN9S5QqN
TLSH
T1AD944B4BE34841F9D816E17E824EE225FD7178A04751F8CB23B496212E97AF06E7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nyx.exe

File Explorer

nyx.exe

.exe 399KB

nyx.exe

IMPHASH 9c10223f9db03e1ccefeace4f615bcfe
SHA256 9da477c2a1f24e6ad6c0d6c0eba24d3bc6882eb59ea6d09951de5e7804e82c28
MD5 dc9c65fdd3b43406eb878bf2ce0b2fde
SHA1 c70f40a449ae5e1b9c457ae2358667604a2a97bf
SHA512 22f6a4fd9be101296989ca6f0ee0e8a5da97975806c25433d8fcfda97aa02e70d0bbcf06be33805db2920f5b111caabfc29ca9ddb32f2ca4efad4317388512b1
SSDEEP 6144:923RBxGVpuDl3BR1jTDvF/E9N7vWuqM9tNVlOXwX7HFSLsOpzhH+RmuU5K5knf2r:9KRBxGVkDVJyuuF9j3SLzN9S5QqN
TLSH
T1AD944B4BE34841F9D816E17E824EE225FD7178A04751F8CB23B496212E97AF06E7EF14
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fflush fputc fputwc setvbuf

api-ms-win-crt-string-l1-1-0

_stricmp memset strcmp strlen strnlen wcslen wcsnlen

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func _configthreadlocale localeconv

api-ms-win-crt-convert-l1-1-0

atoi mbrtowc strtof strtol strtoll strtoul strtoull wcrtomb wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strstr

kernel32

AcquireSRWLockExclusive CloseHandle DeleteCriticalSection EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue GetCurrentThreadId GetLastError GetModuleHandleW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetThreadId InitOnceExecuteOnce InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

309KB

Virtual Size

308KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

nyx.exe

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic