419804de80892b86a93c451828fc5b24039f3ae06a15733fab3b1bf8690c0bd4
- SHA256 419804de80892b86a93c451828fc5b24039f3ae06a15733fab3b1bf8690c0bd4
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nex.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
nex.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 419804de80892b86a93c451828fc5b24039f3ae06a15733fab3b1bf8690c0bd4
- Size 73KB
- Sample261107-nks22aef97
- SHA256 419804de80892b86a93c451828fc5b24039f3ae06a15733fab3b1bf8690c0bd4
- MD5 742870eacab9a057c04aed43ff9ce43e
- SHA1 528313254aee4d1ae1d585ddc7b64ce8e4d3d9f9
- SHA512 190ee25f4c99e5f152963162fc98ca17e36a7a915a96fdafed8c3841439c52ad6c9786c0849522b88a1afd68b92ef503952fb0e470047866fd79d7f7af56ecfb
- SSDEEP 1536:CzPJ5jssQlIELXZKe/UfEe2btcmHQzQ/zTH5rBZNZYGhwLGkv3L5W0rX:CzzssQlEE1HQcLNrfNZlhwLxPFW0rX
- TLSH T1C2730237B4EE78BC430F8B667BBDB23A5D350544E2E22D1E1D0DD22C2905507B39993A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nex.exe
File Explorer
-
419804de80892b86a93c451828fc5b24039f3ae06a15733fab3b1bf8690c0bd4.zip 73KB
-
nex.exe.exe 497KB
-
source.txt8B
nex.exe
- IMPHASH 49be563b8887198da2bb73c8aa675677
- SHA256 b805dc4d53eb0beb1734e5c3e9f0c1f41c319436e402b7a9061222e710308ee1
- MD5 c065b85c912da4c5dec37c581f8618cb
- SHA1 24d5170ee544ad88709a074f5c1aef7eea336fbe
- SHA512 ee89acd6c25778433c440aa003247097367db50759c36623f798efe32d8b04882533df4cf7303aeb5707629c59f363b51a67bc518c7d4ea980e89d07302e54c2
- SSDEEP 3072:5BvmLhmm7H89r/1j1dPoGWvrXS6p0wFAxLPTuWGX+ceu+F+ScADcAD:5lahEVdj1divn+dTuWWex
- TLSH T1F5B420065E0BC8DDEBA2947460FBC4F492317D8C49E5908E6CD7B7E8A17C06E2167D2B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5104
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegEnumKeyExW
RegGetValueW
RegOpenKeyExW
RegQueryValueExW
RegSetValueExW
kernel32
CloseHandle
CopyFileW
CreateDirectoryW
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DeleteFileW
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileW
FindNextFileW
GetCurrentProcessId
GetEnvironmentVariableA
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileSizeEx
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStartupInfoA
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemTimes
GetTempPathW
GetTickCount
GetTickCount64
GetVolumeInformationW
GetWindowsDirectoryW
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MoveFileExW
MultiByteToWideChar
OpenProcess
Process32FirstW
Process32NextW
ReadFile
SetEnvironmentVariableA
SetFilePointerEx
SetThreadExecutionState
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
VirtualProtect
VirtualQuery
WaitForSingleObject
WideCharToMultiByte
lstrcmpiW
lstrcpyW
msvcrt
__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_acmdln
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_ismbblead
_lock
_snprintf
_snwprintf
_stricmp
_strtoui64
_unlock
_wcsicmp
_wfopen
abort
atexit
atof
atoi
calloc
exit
fclose
fgets
fprintf
fputc
fread
free
fwrite
getc
isdigit
isspace
isxdigit
localeconv
malloc
memcpy
memmove
memset
realloc
signal
strcat
strchr
strcmp
strerror
strlen
strncat
strncmp
strncpy
strpbrk
strrchr
strstr
strtol
strtoul
tolower
toupper
ungetc
vfprintf
wcscpy
wcslen
wcsncpy
wcsrchr
_strtoui64
_strtoi64
shell32
SHCreateDirectoryExW
SHFileOperationW
SHGetFolderPathW
winhttp
WinHttpAddRequestHeaders
WinHttpCloseHandle
WinHttpConnect
WinHttpOpen
WinHttpOpenRequest
WinHttpQueryDataAvailable
WinHttpQueryHeaders
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpSetTimeouts
Name
.text
Size
96KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
source.txt
- SHA256 c40dbc2cd71d1b140cfb7fc96454e1e92522bfccd177bbd2fd44a32115f54597
- MD5 2d31b04dda02950a61b3268959710a87
- SHA1 f92116655602381fb16a276272cff89cf9e526f8
- SHA512 accf4b76ea15e843854ad7cabe9fd1bacdf789256d7129cd90f19b1112174bd50248f1045d490edcefebaa3432da0b11cfd8a1faea4790907066fbe8ad6d3e50
- MD5 SHA1 SHA512