oneGFN[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

oneGFN.exe
Size

52KB
MD5

4d188b08e9274e1360062b22e88a2f3f
SHA1

f93374196f5f6e19b370cddd9332ac248937e5ef
SHA256

0f28c8d166c7a671b0048137232e9ca6973f1ec826104834ae310681c1866e62
SHA512

5b0d1d2f0e48fb3b250891163c2f1e935663b6865483180edd1167b8f3269508977893e3faf905d0676ef0a5cbfdd3486a66d3d521643d68dda7e55528337207
SSDEEP

768:CciB9nbl48DFyNO63/JoH4jEjwlz18rOq5+fQgD77uPhyHijOuPhtflM7J5SpxdG:Fy9nbktRoH4jAOz7CPZpPBMLSp7Kr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
oneGFN.exe

Files

oneGFN.exe
.exe windows x64

518d7f2d8793287656651908beca1b27

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

api-ms-win-crt-string-l1-1-0

memset
strcspn
strncmp
strcmp
wcsncpy

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-stdio-l1-1-0

_open

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vfprintf
_o___stdio_common_vsprintf
_o__cexit
_o__close
_o__configthreadlocale
_o__configure_narrow_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_narrow_environment
_o__get_osfhandle
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__localtime64
_o__read
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__setmode
_o__stat64i32
_o__strdup
memmove
_o_atoi
_o_calloc
_o_exit
_o_fclose
_o_feof
_o_ferror
_o_fflush
_o_fopen
_o_fputs
_o_fread
_o_free
_o_getenv
_o_isprint
_o_isspace
_o_iswctype
_o_malloc
_o_mbtowc
_o_putchar
_o_realloc
_o_setlocale
_o_strerror
_o_strftime
_o_strtol
_o_terminate
__C_specific_handler
_o___acrt_iob_func
strrchr
strchr
_o___p__commode
_o___p___argv
_o___p___argc
memcpy

api-ms-win-core-file-l1-1-0

SetFilePointerEx
ReadFile
GetFullPathNameW
WriteFile

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryA
GetStdHandle
SetCurrentDirectoryW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-console-l1-1-0

SetConsoleMode
GetConsoleMode

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
TerminateProcess
GetCurrentProcess
GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

archiveint

archive_match_new
archive_match_free
archive_match_exclude_pattern_from_file
archive_match_include_file_time
archive_version_details
archive_match_include_date
archive_read_support_filter_program
archive_write_add_filter_by_name
archive_write_add_filter_program
archive_read_data_into_fd
archive_read_set_options
archive_match_path_unmatched_inclusions_next
archive_read_extract2
archive_entry_set_uname
archive_entry_set_gid
archive_read_extract_set_progress_callback
archive_read_add_passphrase
archive_read_support_format_all
archive_read_new
archive_entry_set_uid
archive_read_support_filter_all
archive_write_disk_set_standard_lookup
archive_entry_size
archive_read_free
archive_match_include_pattern_from_file
archive_filter_bytes
archive_read_data_skip
archive_entry_set_gname
archive_write_disk_new
archive_write_free
archive_entry_pathname
archive_clear_error
archive_read_next_header
archive_write_disk_set_options
archive_filter_name
archive_read_open_filename
archive_match_excluded
archive_read_close
archive_format_name
archive_match_path_unmatched_inclusions
archive_read_set_passphrase_callback
archive_entry_rdevmajor
archive_entry_hardlink
archive_match_include_pattern
archive_entry_strmode
archive_entry_copy_pathname
archive_entry_mtime
archive_entry_symlink
archive_entry_filetype
archive_error_string
archive_entry_gid
archive_entry_uname
archive_entry_rdevminor
archive_entry_uid
archive_entry_gname
archive_entry_linkresolver_set_strategy
archive_write_header
archive_write_open_fd
archive_read_disk_gname
archive_write_set_passphrase_callback
archive_read_support_format_tar
archive_read_disk_set_matching
archive_errno
archive_entry_free
archive_write_set_format_by_name
archive_write_set_options
archive_write_data
archive_read_disk_new
archive_read_support_format_gnutar
archive_entry_linkresolver_free
archive_entry_linkify
archive_write_set_format
archive_write_set_bytes_in_last_block
archive_write_new
archive_read_next_header2
archive_read_data_block
archive_filter_code
archive_entry_set_size
archive_read_disk_set_symlink_hybrid
archive_read_open_fd
archive_format
archive_read_disk_open
archive_read_disk_descend
archive_entry_linkresolver_new
archive_match_exclude_entry
archive_write_set_passphrase
archive_write_set_bytes_per_block
archive_entry_sourcepath
archive_write_set_format_pax_restricted
archive_entry_new
archive_read_disk_can_descend
archive_read_support_format_empty
archive_read_disk_set_behavior
archive_read_disk_set_symlink_physical
archive_read_disk_set_symlink_logical
archive_read_disk_set_metadata_filter_callback
archive_read_header_position
archive_read_disk_set_standard_lookup
archive_write_close
archive_read_disk_uname
archive_write_open_filename
archive_entry_nlink
archive_match_exclude_pattern
archive_entry_copy_hardlink

Sections

.text
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 1020B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 952B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

518d7f2d8793287656651908beca1b27

Headers

DLL Characteristics

File Characteristics

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

archiveint

Sections

.text Size: 28KB - Virtual size: 28KB

.rdata Size: 19KB - Virtual size: 19KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 1020B

.rsrc Size: 1024B - Virtual size: 952B

.reloc Size: 512B - Virtual size: 364B

.text
Size: 28KB - Virtual size: 28KB

.rdata
Size: 19KB - Virtual size: 19KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 1020B

.rsrc
Size: 1024B - Virtual size: 952B

.reloc
Size: 512B - Virtual size: 364B