Nuwo.exe?ex=670c4c08&is=670afa88&hm=f938514c9e9024c18f4095e1ecae55d44e84f3578b761e0970464c0f75a816d9&
First submission 2024-10-13 19:46:02
File details
| File type: | PE32+ executable (console) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 5691.35 KB (5827942 bytes) |
| Compile time: | 2024-01-01 00:27:29 |
| MD5: | 013ea4a21aaca3ed7996813e64aa7bba |
| SHA1: | d0014c7dee9b7ebd81ffc393dd959108763d8d10 |
| SHA256: | 5cef45602b843003d06ee762499e1606134be8ce6567e046961863cbc96e9c72 |
| Import Hash : | 380d2cbec5e800eecb6612f15b9ac012 |
| Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
| Directories 4 | import resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 11/76 VT report date: 2024-10-13 19:15:14 |
| Malware Type 1 | trojan |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXps://cdn.discordapp.com/attachments/1294783544970842123/1294791476345176157/Nuwo.exe?ex=670c4c08&is=670afa88&hm=f938514c9e9024c18f4095e1ecae55d44e84f3578b761e0970464c0f75a816d9&  |
cdn.discordapp.com |
2024-10-13 19:46:02 |
PE Sections 1 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x29c40 | 171520 | 5640e4a052eb6407bc37bed4bfca199bd7d6a57b | c397ff3614675a2121ff4c1ca501bf6e | |
| .rdata | 0x2b000 | 0x126a2 | 75776 | 1e7b1153d7dc7236b769b12cf2d213f934402567 | 6682c279dea05a32ab33ba8d9017b1c1 | |
| .data | 0x3e000 | 0x3318 | 3584 | 09cb66814bd71ae151c51007f492df97ba54224c | 90ad139d0222e63ad4eb3d3d23dbd963 | |
| .pdata | 0x42000 | 0x22c8 | 9216 | 632f1c477eb31edea47ce933231682829f8f4dfb | a9d2e8b79500abfd8a9ff7fe5cede90b | |
| _RDATA | 0x45000 | 0x15c | 512 | 6ff9fcfa10371aac22fbea9d39df131a09915a1a | 756b5d3163916be93d6812ecf3e68ffb | |
| .rsrc | 0x46000 | 0x1ec8 | 8192 | b45e79a3591354873675cf61c5aef775910c32d5 | 47779e0a82020ae57829ffcf5e513aa3 | |
| .reloc | 0x48000 | 0x754 | 2048 | 8080f76a7753131feb796033a8bb5aca7f069e38 | 91d414a1bcb67647b8e8c49320056e0b |
PE Resources 3
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x46e4c | 2829 | |
| RT_GROUP_ICON | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x4795c | 90 | |
| RT_MANIFEST | LANG_NEUTRAL | SUBLANG_NEUTRAL | 0x479b8 | 1293 |
Packers detected 2
| Microsoft Visual C++ 8.0 (DLL) |
| Microsoft Visual C++ 8.0 |
Anti debug functions 7
| GetLastError |
| GetWindowThreadProcessId |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| Compressed |
| bbase_library.zip |
| base_library.zip |
| Text |
| bcolorful-0.5.5.dist-info\top_level.txt |
| bcolorful\data\rgb.txt |
| Library |
| mscoree.dll |
| ADVAPI32.dll |
| ucrtbase.dll |
| bpython310.dll |
| bapi-ms-win-crt-runtime-l1-1-0.dll |
| bapi-ms-win-core-rtlsupport-l1-1-0.dll |
| bapi-ms-win-core-file-l1-2-0.dll |
| bapi-ms-win-crt-environment-l1-1-0.dll |
| USER32.dll |
| bapi-ms-win-core-namedpipe-l1-1-0.dll |
| bapi-ms-win-core-util-l1-1-0.dll |
| KERNEL32.dll |
| bapi-ms-win-core-timezone-l1-1-0.dll |
| bapi-ms-win-core-file-l2-1-0.dll |
| bapi-ms-win-crt-filesystem-l1-1-0.dll |
| 6python310.dll |
| bapi-ms-win-core-string-l1-1-0.dll |
| bapi-ms-win-core-console-l1-1-0.dll |
| bapi-ms-win-core-sysinfo-l1-1-0.dll |
| blibcrypto-1_1.dll |
| bapi-ms-win-core-processenvironment-l1-1-0.dll |
| bapi-ms-win-crt-convert-l1-1-0.dll |
| bapi-ms-win-crt-stdio-l1-1-0.dll |
| bapi-ms-win-core-processthreads-l1-1-1.dll |
| bapi-ms-win-core-localization-l1-2-0.dll |
| bapi-ms-win-core-heap-l1-1-0.dll |
| bapi-ms-win-core-file-l1-1-0.dll |
| bapi-ms-win-core-datetime-l1-1-0.dll |
| bapi-ms-win-core-libraryloader-l1-1-0.dll |
| bapi-ms-win-core-memory-l1-1-0.dll |
| bapi-ms-win-core-handle-l1-1-0.dll |
| bapi-ms-win-crt-utility-l1-1-0.dll |
| bapi-ms-win-core-errorhandling-l1-1-0.dll |
| blibffi-7.dll |
| bapi-ms-win-crt-locale-l1-1-0.dll |
| bapi-ms-win-crt-conio-l1-1-0.dll |
| bucrtbase.dll |
| bapi-ms-win-crt-math-l1-1-0.dll |
| bapi-ms-win-core-interlocked-l1-1-0.dll |
| bVCRUNTIME140.dll |
| bapi-ms-win-core-synch-l1-1-0.dll |
| bapi-ms-win-core-debug-l1-1-0.dll |
| Bapi-ms-win-core-synch-l1-2-0.dll |
| bapi-ms-win-crt-string-l1-1-0.dll |
| bapi-ms-win-crt-heap-l1-1-0.dll |
| bapi-ms-win-crt-time-l1-1-0.dll |
| bapi-ms-win-core-processthreads-l1-1-0.dll |
| bapi-ms-win-core-profile-l1-1-0.dll |
| bapi-ms-win-crt-process-l1-1-0.dll |
Strings analysis - Possible URLs found 1
| http://schemas.microsoft.com/SMI/2016/WindowsSettings |