sfk[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

sfk.exe
Size

2.5MB
MD5

10cbc2a1d241e4d46555bbc9992de6f8
SHA1

88be81a010bd35544e2c3b81a80d8450ce7181dd
SHA256

758e2fa91db7d8afb6428993de002151e90671a4d2badf17a68ff984c92768ce
SHA512

9f9b79c351bcf2d5bb37ce7bbde1ded8a754ac3c58bd612ff1607474c20eff903027d92faed4bc235806b633e28e70f0b1f6be028c3fafb832f58ab0cfb22265
SSDEEP

49152:9CIRrreZqkn5Ctg60lvuS62uNowoauLylMZYv0/hvP2TPrsTJAJZRtfX:skreZqkns6vuSioGMWLX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sfk.exe

Files

sfk.exe
.exe windows x86

a282631cf02ceba49f430deb1f18a00f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

QueryPerformanceFrequency
Sleep
GetCurrentProcess
GetCurrentProcessId
ExitProcess
SwitchToThread
SetPriorityClass
GetTickCount
VirtualAlloc
VirtualFree
GetModuleFileNameA
GlobalAlloc
GlobalLock
GlobalUnlock
LocalFree
FormatMessageA
LoadLibraryA
GetVolumeInformationA
FileTimeToSystemTime
SystemTimeToFileTime
MultiByteToWideChar
WideCharToMultiByte
GetACP
GetOEMCP
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetNumberOfConsoleInputEvents
PeekConsoleInputA
ReadConsoleInputA
SetConsoleCtrlHandler
SetEnvironmentVariableA
DeleteFileW
DosDateTimeToFileTime
CopyFileExA
FileTimeToLocalFileTime
FindClose
FindFirstFileA
FileTimeToDosDateTime
QueryPerformanceCounter
FindNextFileA
GetDriveTypeA
GetFullPathNameA
SetEndOfFile
SetFilePointer
GetLocalTime
SetVolumeLabelA
GetLocaleInfoA
GetConsoleMode
SetConsoleMode
HeapAlloc
HeapFree
GetProcessHeap
CloseHandle
EnterCriticalSection
LeaveCriticalSection
ReleaseMutex
WaitForSingleObject
CreateMutexA
lstrcmpiA
lstrcpynA
lstrlenA
HeapSize
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
IsValidCodePage
FindFirstFileExA
SetFileAttributesW
HeapReAlloc
RemoveDirectoryW
CreatePipe
GetVersion
GetLastError
SetFilePointerEx
FlushFileBuffers
GetExitCodeProcess
GetStringTypeW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetConsoleCP
GetTimeZoneInformation
ReadConsoleW
GetCurrentDirectoryW
GetCurrentDirectoryA
DecodePointer
SetCurrentDirectoryA
SetEnvironmentVariableW
GetCommandLineW
GetCommandLineA
WriteFile
SetStdHandle
GetCPInfo
SetFileTime
SetFileAttributesA
ReadFile
LocalFileTimeToFileTime
GetFileTime
GetFileAttributesExW
GetFileAttributesExA
GetFileAttributesW
GetFileAttributesA
GetDiskFreeSpaceExA
CreateFileW
CreateFileA
InitializeCriticalSection
GetStdHandle
FindNextFileW
FindFirstFileExW
MoveFileExW
GetFullPathNameW
CreateDirectoryW
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileType
GetDriveTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
SetLastError
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
RtlUnwind
GetModuleHandleExW
DuplicateHandle
CreateProcessA

user32

CloseClipboard
OpenClipboard
GetClipboardData
SetClipboardData
IsClipboardFormatAvailable
CharToOemA
GetWindowDC
ReleaseDC
MessageBoxA
MessageBeep
GetDesktopWindow
wsprintfA
OemToCharA
EmptyClipboard

gdi32

GetDeviceCaps

ws2_32

send
select
recvfrom
sendto
ntohs
shutdown
listen
inet_ntoa
inet_addr
htons
htonl
getsockname
connect
closesocket
bind
accept
setsockopt
socket
gethostbyname
gethostname
WSAStartup
WSACleanup
__WSAFDIsSet
ioctlsocket
WSAGetLastError
recv
ntohl

advapi32

SetKernelObjectSecurity
IsValidSid
IsValidSecurityDescriptor
IsValidAcl
GetSecurityDescriptorSacl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorControl
GetKernelObjectSecurity
AdjustTokenPrivileges
OpenProcessToken
LookupPrivilegeValueA

shell32

SHGetDesktopFolder
SHGetMalloc
SHGetPathFromIDListA
SHGetSpecialFolderLocation
ShellExecuteA

ole32

OleInitialize
OleUninitialize
CoCreateInstance

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 817KB - Virtual size: 817KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 790KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 232B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a282631cf02ceba49f430deb1f18a00f

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

ws2_32

advapi32

shell32

ole32

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 817KB - Virtual size: 817KB

.data Size: 52KB - Virtual size: 790KB

.gfids Size: 512B - Virtual size: 232B

.reloc Size: 66KB - Virtual size: 66KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 817KB - Virtual size: 817KB

.data
Size: 52KB - Virtual size: 790KB

.gfids
Size: 512B - Virtual size: 232B

.reloc
Size: 66KB - Virtual size: 66KB