Static task
static1
Behavioral task
behavioral1
Sample
kfxServiceUI.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
kfxServiceUI.exe
Resource
win10v2004-20230703-en
General
-
Target
kfxServiceUI.exe
-
Size
322KB
-
MD5
f3dd0086673f8f213cb7b617e585f584
-
SHA1
b4fac3341fbd6277c469948d95eab68382d98cb2
-
SHA256
8fee96c37024304405d30d6147eb8a89a541bd870760d0a8a339041008f91662
-
SHA512
e9cc5a48516d5eeb1d0ef44857f6d4c11bfce4e84816521caf716cb0c2e7d210d8ae96953666794d2eab682ec24b9ce25f59f08cbd93f2609bb83064eff06d4c
-
SSDEEP
6144:ASr2RxU5xODrtZAt9YfipjEMwSV/QABvO:ASr2U5gDrtZAtxpjxwStP
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource kfxServiceUI.exe
Files
-
kfxServiceUI.exe.exe windows x86
dc6ffea1ae01ad9dba365c367e91da78
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mfc140
ord5003
ord4958
ord4896
ord4911
ord4972
ord4493
ord9647
ord4485
ord3050
ord14510
ord7887
ord14508
ord6848
ord11663
ord13628
ord5911
ord2680
ord12067
ord3933
ord3364
ord3363
ord3258
ord12111
ord5769
ord10207
ord9167
ord3825
ord10986
ord1389
ord890
ord5401
ord4468
ord8426
ord4869
ord3689
ord2241
ord2210
ord316
ord1044
ord4926
ord1507
ord4997
ord8347
ord12806
ord8285
ord3298
ord2484
ord12484
ord4920
ord14509
ord7886
ord14507
ord9353
ord4143
ord4082
ord12888
ord7905
ord2027
ord11927
ord11928
ord14380
ord12474
ord7964
ord14581
ord6322
ord14583
ord6324
ord14582
ord6323
ord3844
ord5894
ord12182
ord12190
ord8180
ord10383
ord12194
ord12162
ord12869
ord5228
ord5528
ord5739
ord9305
ord4981
ord5504
ord5742
ord5231
ord5390
ord4938
ord4944
ord4950
ord4932
ord8429
ord4987
ord5210
ord7687
ord7688
ord7677
ord5388
ord8182
ord10202
ord2200
ord1772
ord13677
ord6193
ord1751
ord1765
ord1739
ord1717
ord12201
ord12205
ord13798
ord3259
ord10950
ord6947
ord8922
ord14502
ord11881
ord3830
ord12032
ord9096
ord11672
ord11671
ord5631
ord10240
ord10236
ord10238
ord3395
ord3396
ord10239
ord10237
ord14699
ord2758
ord11343
ord8173
ord12485
ord3295
ord5336
ord7618
ord310
ord2407
ord10330
ord1509
kernel32
EnterCriticalSection
ReadFile
CreateFileA
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
CloseHandle
OutputDebugStringW
WaitForSingleObject
GetLastError
DeleteCriticalSection
GetModuleHandleW
GetProcAddress
SetEvent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateEventW
WaitForSingleObjectEx
ResetEvent
CreateProcessA
user32
GetSystemMetrics
GetClientRect
DrawIcon
EnableWindow
GetSystemMenu
IsIconic
SetTimer
SendMessageA
AppendMenuA
LoadIconW
advapi32
OpenSCManagerA
OpenServiceA
QueryServiceStatus
CloseServiceHandle
comctl32
ord17
bcgcbpro2510140
?DoModal@CBCGPDialog@@UAEHXZ
??0CBCGPWinApp@@QAE@H@Z
?SetVisualTheme@CBCGPWinApp@@QAEXW4BCGP_VISUAL_THEME@1@PAUCRuntimeClass@@@Z
?InitInstance@CBCGPWinApp@@UAEHXZ
??1CBCGPButton@@UAE@XZ
?GetRuntimeClass@CBCGPWinApp@@UBEPAUCRuntimeClass@@XZ
?OnCmdMsg@CBCGPWinApp@@UAEHIHPAXPAUAFX_CMDHANDLERINFO@@@Z
?ExitInstance@CBCGPWinApp@@UAEHXZ
?GetRecentFilesCount@CBCGPWinApp@@UBEHXZ
?GetRecentFilePath@CBCGPWinApp@@UBE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@H@Z
?SetActiveMenu@CBCGPDialog@@MAEXPAVCBCGPPopupMenu@@@Z
?OnDrawRibbonBackgroundImage@CBCGPDialog@@UAEXPAVCDC@@VCRect@@@Z
?GetRibbonStartPageLeftPaneWidth@CBCGPDialog@@UAEHXZ
?OnDrawBackstageWatermark@CBCGPDialog@@UAEXPAVCDC@@VCRect@@@Z
?OnSetPlacement@CBCGPDialog@@UAEHAAUtagWINDOWPLACEMENT@@@Z
?OnRTLChanged@CBCGPDialog@@UAEXH@Z
?OnAfterExpand@CBCGPDialog@@UAEXXZ
?OnBeforeExpand@CBCGPDialog@@UAEXXZ
?AdjustControlsLayout@CBCGPDialog@@UAEXXZ
?PreInitDialog@CBCGPDialog@@MAEXXZ
?OnCancel@CBCGPDialog@@UAEXXZ
?OnOK@CBCGPDialog@@UAEXXZ
?Create@CBCGPDialog@@UAEHPBDPAVCWnd@@@Z
?Create@CBCGPDialog@@UAEHIPAVCWnd@@@Z
?PreTranslateMessage@CBCGPDialog@@UAEHPAUtagMSG@@@Z
?OnCommand@CBCGPDialog@@MAEHIJ@Z
?GetRuntimeClass@CBCGPDialog@@UBEPAUCRuntimeClass@@XZ
?OnSysCommand@CBCGPDialog@@IAEXIJ@Z
?SetImage@CBCGPButton@@QAEXIIII@Z
?SetBackgroundImage@CBCGPDialog@@QAEHIW4BackgroundLocation@1@H@Z
?OnInitDialog@CBCGPDialog@@MAEHXZ
??0CBCGPButton@@QAE@XZ
?GetThisMessageMap@CBCGPDialog@@KGPBUAFX_MSGMAP@@XZ
?EnableVisualManagerStyle@CBCGPDialog@@QAEXHHPBV?$CList@II@@@Z
??0CBCGPDialog@@QAE@IPAVCWnd@@@Z
??1CBCGPWinApp@@UAE@XZ
??1CBCGPDialog@@UAE@XZ
?ReloadWindowPlacement@CBCGPWorkspace@@MAEHPAVCFrameWnd@@@Z
?StoreWindowPlacement@CBCGPWorkspace@@MAEHABVCRect@@HH@Z
?LoadWindowPlacement@CBCGPWorkspace@@MAEHAAVCRect@@AAH1@Z
?SaveCustomState@CBCGPWorkspace@@MAEXXZ
?PreSaveState@CBCGPWinApp@@MAEXXZ
?LoadCustomState@CBCGPWorkspace@@MAEXXZ
?PreLoadState@CBCGPWorkspace@@MAEXXZ
?OnClosingMainFrame@CBCGPWorkspace@@MAEXPAVCBCGPFrameImpl@@@Z
?OnSelectSkin@CBCGPWorkspace@@UAEXXZ
?OnBCGPIdle@CBCGPWorkspace@@UAEHPAVCWnd@@@Z
?OnAppContextHelp@CBCGPWorkspace@@UAEXPAVCWnd@@QBK@Z
?GetRegSectionPath@CBCGPWorkspace@@UAE?AV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@PBD@Z
?ShowPopupMenu@CBCGPWorkspace@@UAEHIABVCPoint@@PAVCWnd@@@Z
?OnViewDoubleClick@CBCGPWorkspace@@UAEHPAVCWnd@@H@Z
?SaveState@CBCGPWorkspace@@UAEHPBDPAVCBCGPFrameImpl@@@Z
?CleanState@CBCGPWorkspace@@UAEHPBD@Z
?LoadState@CBCGPWinApp@@UAEHPBDPAVCBCGPFrameImpl@@@Z
?OnAfterDownloadSkins@CBCGPWorkspace@@UAEXABV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@@Z
?OnBeforeCreateCustomizationDlg@CBCGPWinApp@@MAEXPAVCBCGPToolbarCustomize@@@Z
?OnCustomizeToolBars@CBCGPWinApp@@MAEHXZ
?OnAfterChangeVisualTheme@CBCGPWinApp@@MAEXPAVCWnd@@@Z
?OnBeforeChangeVisualTheme@CBCGPWinApp@@MAEXAAUCBCGPAppOptions@@PAVCWnd@@@Z
?GetRecentFileDisplayName@CBCGPWinApp@@UBEHAAV?$CStringT@DV?$StrTraitMFC_DLL@DV?$ChTraitsCRT@D@ATL@@@@@ATL@@HPBDHH@Z
msvcp140
?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
cjson
_cJSON_GetArrayItem@8
_cJSON_GetArraySize@4
_cJSON_GetObjectItem@8
_cJSON_Parse@4
_cJSON_Delete@4
vcruntime140
memmove
memset
__CxxFrameHandler3
__vcrt_InitializeCriticalSectionEx
_except_handler4_common
_CxxThrowException
memcpy
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
_register_thread_local_exe_atexit_callback
_c_exit
_configure_narrow_argv
_exit
exit
_initterm_e
_initterm
_get_narrow_winmain_command_line
_set_app_type
_seh_filter_exe
terminate
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_invalid_parameter_noinfo_noreturn
api-ms-win-crt-heap-l1-1-0
_set_new_mode
free
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf_s
__p__commode
_set_fmode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
_setmbcp
Sections
.text Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 48B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 291KB - Virtual size: 291KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ