Static task
static1
Behavioral task
behavioral1
Sample
cfxloader.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
cfxloader.exe
Resource
win10v2004-20230915-en
General
-
Target
cfxloader.exe
-
Size
3.3MB
-
MD5
366bd9980ca46e32f4551b0f1be305f9
-
SHA1
4776762cb1275c59cb6c65048ddb20cfbc807c2c
-
SHA256
3c4064a3a0b0d947faee53ff39a5ad964a644e4799f54dcd3141cbe6cb850944
-
SHA512
6c50f6d7cd854f42d4967eeb514b5bd14305b00582c62fd029fedcb27b865b8bc6c8f03653c78ba511509c4d01fbca9bbfa4d429e401507f7a201bf68c7751f7
-
SSDEEP
49152:aRT0b8g+mANGhIVVsj9tHTtcjAzD33lE8fZAKNzJWNXj7T7lWCWJjBmnX6wAp:RXSsBptcip3Xz0NNuJjBmnX63
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource cfxloader.exe
Files
-
cfxloader.exe.exe windows:6 windows x64
1a60710b267a53c4a0f73bf7c2e327d9
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
d3d11
D3D11CreateDeviceAndSwapChain
kernel32
AreFileApisANSI
CloseHandle
ConvertFiberToThread
ConvertThreadToFiber
CreateDirectoryW
CreateEventW
CreateFiber
CreateFileW
CreateToolhelp32Snapshot
DecodePointer
DeleteCriticalSection
DeleteFiber
EnterCriticalSection
FindClose
FindFirstFileA
FindFirstFileW
FindNextFileA
FormatMessageA
FreeConsole
FreeLibrary
GetConsoleMode
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentVariableW
GetFileAttributesExW
GetFileInformationByHandleEx
GetFileType
GetLastError
GetLocaleInfoEx
GetModuleHandleA
GetModuleHandleExA
GetModuleHandleW
GetProcAddress
GetStdHandle
GetSystemTimeAsFileTime
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringW
Process32First
Process32Next
QueryPerformanceCounter
QueryPerformanceFrequency
ReadConsoleA
ReadConsoleW
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetConsoleMode
SetEvent
SetLastError
SetUnhandledExceptionFilter
SwitchToFiber
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VerSetConditionMask
WaitForSingleObjectEx
WideCharToMultiByte
WriteFile
user32
ClientToScreen
CloseClipboard
CreateWindowExW
DefWindowProcA
DispatchMessageA
EmptyClipboard
GetAsyncKeyState
GetCapture
GetClientRect
GetClipboardData
GetCursorPos
GetDC
GetForegroundWindow
GetKeyState
GetMessageExtraInfo
GetProcessWindowStation
GetSystemMetrics
GetUserObjectInformationW
GetWindowRect
IsWindowUnicode
LoadCursorA
MessageBoxA
MonitorFromWindow
MoveWindow
OpenClipboard
PeekMessageA
RegisterClassExA
ReleaseCapture
ReleaseDC
ScreenToClient
SetCapture
SetClipboardData
SetCursor
SetCursorPos
SetProcessDPIAware
SetWindowPos
ShowWindow
TrackMouseEvent
TranslateMessage
UnregisterClassA
UpdateWindow
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1ios_base@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Syserror_map@std@@YAPEBDH@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Winerror_map@std@@YAHH@Z
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?uncaught_exceptions@std@@YAHXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Xtime_get_ticks
ws2_32
WSACleanup
WSAGetLastError
WSASetLastError
WSAStartup
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostbyname
getnameinfo
getsockname
getsockopt
htons
inet_ntop
inet_pton
ioctlsocket
listen
ntohs
recv
send
setsockopt
socket
oleaut32
SysAllocString
SysAllocStringLen
SysFreeString
SysStringLen
VarBstrCat
VariantClear
VariantInit
ole32
CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
advapi32
DeregisterEventSource
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegisterEventSourceA
ReportEventA
gdi32
CreateRectRgn
DeleteObject
GetDeviceCaps
iphlpapi
GetAdaptersAddresses
imm32
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
d3dcompiler_47
D3DCompile
dwmapi
DwmEnableBlurBehindWindow
DwmGetColorizationColor
DwmIsCompositionEnabled
bcrypt
BCryptGenRandom
vcruntime140
_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
__std_terminate
memchr
memcmp
memcpy
memmove
memset
strchr
strrchr
strstr
wcsstr
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
__stdio_common_vsprintf_s
__stdio_common_vsscanf
_fileno
_fseeki64
_get_stream_buffer_pointers
_set_fmode
_setmode
_wfopen
fclose
feof
ferror
fflush
fgetc
fgetpos
fgets
fopen
fopen_s
fputc
fputs
fread
fseek
fsetpos
ftell
fwrite
setvbuf
ungetc
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_errno
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
raise
signal
strerror_s
terminate
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_localtime64_s
_time64
strftime
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_stat64i32
_unlock_file
api-ms-win-crt-string-l1-1-0
_strdup
_stricmp
_strnicmp
isspace
strcat
strcmp
strcpy
strcspn
strlen
strncmp
strncpy
strspn
wcslen
api-ms-win-crt-math-l1-1-0
__setusermatherr
acosf
atan2f
ceilf
cosf
fmodf
ldexp
log
logf
pow
powf
sinf
sqrtf
api-ms-win-crt-convert-l1-1-0
atof
atoi
strtol
strtoul
api-ms-win-crt-heap-l1-1-0
_callnewh
_set_new_mode
calloc
free
malloc
realloc
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-utility-l1-1-0
qsort
Sections
.text Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 545KB - Virtual size: 544KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 86KB - Virtual size: 124KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 52KB - Virtual size: 51KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.00cfg Size: 512B - Virtual size: 56B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 45B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 424B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 766KB - Virtual size: 2.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE