Static task
static1
Behavioral task
behavioral1
Sample
FG-Tool.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
FG-Tool.exe
Resource
win10v2004-20231215-en
General
-
Target
FG-Tool.exe
-
Size
156KB
-
MD5
576a1d9e79bf32120d74eabae45f17ab
-
SHA1
56df507f945d6149a1f0090a19c71254cc08c84e
-
SHA256
75878356f2e131cefb8aeb07e777fcc110475f8c92417fcade97e207a94ac372
-
SHA512
5d8d5129a7f9d94d2c9e17a118e882afff8266c1a2bfe205883a7b0ff9cbeeb1bcf76c25c9794cec84bf9d139ade6562ccac5a0b283c566deface8d4c0a0c8ea
-
SSDEEP
3072:NFX2siZyM/WT1HMAh9HBbv+W10AvXix7GS0fnPD1zTXN4KiK+KX0:DX2siZyMKsGHBqQhPiFGhE
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FG-Tool.exe
Files
-
FG-Tool.exe.exe windows:6 windows x64 arch:x64
a5dd8b448456ef8ea6c5dc359eaecc60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetLastError
CloseHandle
MultiByteToWideChar
GetModuleHandleW
HeapFree
GetCommandLineW
InitializeCriticalSectionEx
HeapSize
CreateEventW
HeapReAlloc
RaiseException
HeapAlloc
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
Sleep
CreateThread
GlobalLock
GlobalUnlock
CreateFileW
ReadFile
SetEndOfFile
WriteConsoleW
SetFilePointerEx
FlushFileBuffers
GetStringTypeW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetCPInfo
GetOEMCP
IsValidCodePage
FindNextFileA
FindFirstFileExA
FindClose
WriteFile
EnterCriticalSection
LeaveCriticalSection
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
OutputDebugStringW
RtlPcToFileHeader
EncodePointer
RtlUnwindEx
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
SetLastError
ExitProcess
GetModuleHandleExW
GetModuleFileNameA
GetStdHandle
GetACP
GetConsoleCP
GetConsoleMode
GetFileType
LCMapStringW
ReadConsoleW
user32
OpenClipboard
CloseClipboard
GetClipboardData
GetMessageW
GetKeyState
CallNextHookEx
GetAsyncKeyState
DispatchMessageW
GetWindowTextA
TranslateMessage
SetWindowsHookExW
GetWindowThreadProcessId
GetForegroundWindow
GetKeyNameTextA
advapi32
GetUserNameW
shell32
CommandLineToArgvW
Sections
.text Size: 97KB - Virtual size: 96KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 46KB - Virtual size: 45KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 3KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 6KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gfids Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ