neverlosecs2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
neverlosecs2.exe
Size 18.9MB
Sample261107-vqqmesev3r
SHA256 844ead0376e2d920f42887ba2839b74f0a05eb83268bd2012fce7bd9ef84d87a
MD5 b73b73b096ce251093c4da51f3e95818
SHA1 dbd2ed3caa424dae486477bd920cef81e3c36e7b
SHA512 947b5d64d34c4257d8ae7d2d8fdedc6fb62c8925db483e66a2d1bd3e36498a794aa2ea9b76bb50377678a9ef53f3bb906dcf32f623325230f213997983a53918
SSDEEP 196608:b0r00jdkAl3nS7RR38Lp/PPrDc2cNcpdyvx0aha:gr5XU7rMRPE22Tv
TLSH
T1D3178D05B39182EDC43AA3758997AF1BF330F844477996FB23B4161D1FE27E84A7A610
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
neverlosecs2.exe

File Explorer

neverlosecs2.exe

.exe 18.9MB

neverlosecs2.exe

IMPHASH 38b9aec6a7cd7731c4186fd9bd286111
SHA256 844ead0376e2d920f42887ba2839b74f0a05eb83268bd2012fce7bd9ef84d87a
MD5 b73b73b096ce251093c4da51f3e95818
SHA1 dbd2ed3caa424dae486477bd920cef81e3c36e7b
SHA512 947b5d64d34c4257d8ae7d2d8fdedc6fb62c8925db483e66a2d1bd3e36498a794aa2ea9b76bb50377678a9ef53f3bb906dcf32f623325230f213997983a53918
SSDEEP 196608:b0r00jdkAl3nS7RR38Lp/PPrDc2cNcpdyvx0aha:gr5XU7rMRPE22Tv
TLSH
T1D3178D05B39182EDC43AA3758997AF1BF330F844477996FB23B4161D1FE27E84A7A610
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmEnableBlurBehindWindow DwmGetColorizationColor DwmIsCompositionEnabled

shell32

CommandLineToArgvW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

ole32

CoCreateGuid CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize CreateStreamOnHGlobal StringFromGUID2

comdlg32

CommDlgExtendedError GetOpenFileNameW

advapi32

GetTokenInformation OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateHardLinkW CreateMutexW CreateRemoteThread CreateSymbolicLinkW CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FindResourceW FlsAlloc FlsGetValue FlsSetValue FlushFileBuffers FormatMessageA FormatMessageW FreeLibrary GetACP GetActiveProcessorCount GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSizeEx GetFinalPathNameByHandleW GetLastError GetLocaleInfoA GetLocaleInfoEx GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessTimes GetStartupInfoW GetSystemTime GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount64 GlobalAlloc GlobalFree GlobalLock GlobalUnlock InitOnceExecuteOnce InitializeCriticalSection IsWow64Process K32EnumProcessModulesEx K32GetModuleBaseNameW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockResource MoveFileExW MultiByteToWideChar OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadProcessMemory ReleaseMutex ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread TryAcquireSRWLockExclusive TryEnterCriticalSection VerSetConditionMask VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteFile WriteProcessMemory

user32

ClientToScreen CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW EmptyClipboard GetCapture GetClientRect GetClipboardData GetCursorPos GetDC GetForegroundWindow GetKeyState GetKeyboardLayout GetMessageExtraInfo GetMonitorInfoW GetSystemMetrics GetWindowLongPtrW GetWindowRect IsIconic IsWindowUnicode LoadCursorA MessageBoxW MonitorFromPoint MonitorFromWindow MsgWaitForMultipleObjectsEx OpenClipboard PeekMessageW PostQuitMessage RegisterClassExW ReleaseCapture ReleaseDC ScreenToClient SetCapture SetClipboardData SetCursor SetCursorPos SetLayeredWindowAttributes SetProcessDPIAware SetWindowLongPtrW SetWindowPos SetWindowRgn ShowWindow TrackMouseEvent TranslateMessage UnregisterClassW

gdi32

CreateRectRgn CreateRoundRectRgn DeleteObject GetDeviceCaps

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf __stdio_common_vsscanf _close _fseeki64 _ftelli64 _get_osfhandle _wfopen _wopen fclose feof ferror fflush fgetc fopen fputc fputwc fread fseek ftell fwrite getc setbuf setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln __sys_nerr _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsicmp _wcsnicmp _wcsxfrm_l isalnum isdigit isspace isxdigit mbrlen memset strcmp strlen strncmp strncpy strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_localtime64_s _mktime64 _strftime_l _time64 strftime

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acosf atan2f ceilf cosf expf fmodf log logf lroundf pow powf sinf sqrtf

api-ms-win-crt-convert-l1-1-0

_strtod_l atof mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strstr

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

129KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

neverlosecs2.exe

d3d11

dwmapi

shell32

ole32

comdlg32

advapi32

bcrypt

kernel32

user32

gdi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic