fsx[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

fsx.exe
Size

2.6MB
MD5

883bdcf584cc7772e8b3d87c69ff5f20
SHA1

f8d897adadfb87ef7ddccc66d3856c392a900d58
SHA256

a1b71b38ef7b0fd139b3f990231cb667aeae25bc01698e08be0ad30f990a7839
SHA512

6b72dd4bdedb7dc9ea87576d72fa03674909fd6e9c8e5d6d2a17f11bc87ce616966f6b380aa6b8b45749dd9fb86edf22d91f12ff8c1687e7033427709b77f069
SSDEEP

49152:RPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPsjjjjjjjjjjjjjjjjjjjp:x22222222222222222228

Score

N/A

Malware Config

Signatures

Files

fsx.exe
.exe windows x86

14516d6a0e063a6493f0cd80c74d7ff6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

8f:86:65:18:0e:55:9f:8f:68:33:0d:8a:fc:da:c1:74
Certificate

Issuer

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

01/10/2014, 00:00

Not After

01/10/2015, 23:59

Subject

CN=RailSimulator T/A Dovetail,O=RailSimulator T/A Dovetail,POSTALCODE=ME4 4NT,STREET=Chatham Maritime+STREET=The Observatory 1St Floor Brunel,L=Chatham,ST=Kent,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

Issuer

CN=AddTrust External CA Root,OU=AddTrust External TTP Network,O=AddTrust AB,C=SE

Not Before

30/05/2000, 10:48

Not After

30/05/2020, 10:48

Subject

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

Issuer

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

09/05/2013, 00:00

Not After

08/05/2028, 23:59

Subject

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

6f:5c:f7:41:2a:a7:ab:69:0a:bb:97:bf:f6:81:83:30:64:51:3b:2f
Signer

Actual PE Digest

6f:5c:f7:41:2a:a7:ab:69:0a:bb:97:bf:f6:81:83:30:64:51:3b:2f

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=RailSimulator T/A Dovetail,O=RailSimulator T/A Dovetail,POSTALCODE=ME4 4NT,STREET=Chatham Maritime+STREET=The Observatory 1St Floor Brunel,L=Chatham,ST=Kent,C=GB

13/12/2014, 02:14
Valid: true

Chain 1

CN=RailSimulator T/A Dovetail,O=RailSimulator T/A Dovetail,POSTALCODE=ME4 4NT,STREET=Chatham Maritime+STREET=The Observatory 1St Floor Brunel,L=Chatham,ST=Kent,C=GB

CN=COMODO RSA Code Signing CA,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

CN=COMODO RSA Certification Authority,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

mfc80

ord3832
ord5382
ord6219
ord5102
ord1010
ord3806
ord5583
ord2018
ord2063
ord4326
ord6276
ord3801
ord1920
ord4014
ord4038
ord3169
ord2942
ord2856
ord1303
ord2165
ord3977
ord4207
ord4723
ord2931
ord5224
ord5226
ord3948
ord4568
ord5230
ord5213
ord2537
ord2731
ord2835
ord4307
ord2714
ord1207
ord2838
ord2540
ord2646
ord2533
ord3718
ord3719
ord3709
ord2644
ord3949
ord4481
ord4261
ord3333
ord1074
ord1290
ord1054
ord5379
ord1091
ord1126
ord700
ord474
ord2248
ord1979
ord757
ord566
ord3683
ord760
ord572
ord1084
ord762
ord6278
ord764

msvcr80

_crt_debugger_hook
_controlfp_s
_invoke_watson
_except_handler4_common
_decode_pointer
_onexit
_lock
__dllonexit
_unlock
__set_app_type
_encode_pointer
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_acmdln
exit
_ismbblead
_XcptFilter
_exit
_cexit
__getmainargs
__CxxFrameHandler3
_makepath_s
_splitpath_s
sprintf_s
_vsnprintf
_setmbcp
_amsg_exit
memset

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z

kernel32

InterlockedExchange
GetLastError
OutputDebugStringA
CreateEventA
CloseHandle
VerSetConditionMask
VerifyVersionInfoA
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleFileNameA
GetModuleHandleA
CreateThread
WaitForSingleObject
GetExitCodeThread
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
Sleep
InterlockedCompareExchange
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent

user32

MessageBoxIndirectA
LoadStringA
GetLastActivePopup

steam_api

SteamClient
SteamUser
SteamUtils
SteamAPI_Shutdown
SteamAPI_Init
SteamAPI_RestartAppIfNecessary
SteamFriends

ole32

CoInitializeSecurity
CoInitialize

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 940B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

14516d6a0e063a6493f0cd80c74d7ff6

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

8f:86:65:18:0e:55:9f:8f:68:33:0d:8a:fc:da:c1:74Certificate

Extended Key Usages

Key Usages

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22Certificate

Key Usages

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:afCertificate

Extended Key Usages

Key Usages

6f:5c:f7:41:2a:a7:ab:69:0a:bb:97:bf:f6:81:83:30:64:51:3b:2fSigner

Signature Validations

Verification

13/12/2014, 02:14 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

mfc80

msvcr80

msvcp80

kernel32

user32

steam_api

ole32

Sections

.text Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.idata Size: 3KB - Virtual size: 2KB

.rsrc Size: 2.6MB - Virtual size: 2.6MB

.reloc Size: 1024B - Virtual size: 940B

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

8f:86:65:18:0e:55:9f:8f:68:33:0d:8a:fc:da:c1:74
Certificate

27:66:ee:56:eb:49:f3:8e:ab:d7:70:a2:fc:84:de:22
Certificate

2e:7c:87:cc:0e:93:4a:52:fe:94:fd:1c:b7:cd:34:af
Certificate

6f:5c:f7:41:2a:a7:ab:69:0a:bb:97:bf:f6:81:83:30:64:51:3b:2f
Signer

13/12/2014, 02:14
Valid: true

.text
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.idata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 2.6MB - Virtual size: 2.6MB

.reloc
Size: 1024B - Virtual size: 940B