falcon[.]dll | Triage™

Resubmissions

05/04/2024, 15:16

240405-snretsfh6410

13/03/2024, 17:07

240313-vm19raad8v8

Sharing

Copy URL Twitter E-mail

General

Target
falcon.dll
Size 694KB
Sample240405-snretsfh64
SHA256 aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
MD5 da8ae8e1de522b20a462239c6893613e
SHA1 7f65ef885815d81d220f9f42877ff0d696b0134c
SHA512 d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
SSDEEP 12288:tBx7p/GvTjNe0Za4+Lpf6DdeFvSMX/ekiBvu7FYgN96:tBx7FGvvNea+tSDoFvB/edBB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
falcon.dll

File Explorer

falcon.dll

.dll 694KB

falcon.dll

IMPHASH dad9f669bb19a6ea9c2b335d7292cfc7
SHA256 aee22a35cbdac3f16c3ed742c0b1bfe9739a13469cf43b36fb2c63565111028c
MD5 da8ae8e1de522b20a462239c6893613e
SHA1 7f65ef885815d81d220f9f42877ff0d696b0134c
SHA512 d2dca9ba9272a0bdfa88f7520545e21a1f4d18dcacec36b072369cee8e28ba635a0214b47caef74b6f7fcd06e120d898da997e71c8955c72510972c66d2a855d
SSDEEP 12288:tBx7p/GvTjNe0Za4+Lpf6DdeFvSMX/ekiBvu7FYgN96:tBx7FGvvNea+tSDoFvB/edBB
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

387008

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\builds\ARK23181_2\bin_win7\x64\Release\trufos.pdb

secur32

GetUserNameExW

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind RtlUnwindEx RtlUnwind RtlCompareMemory NtQueryFullAttributesFile NtQueryInformationFile ZwClose RtlNtStatusToDosError ZwOpenFile ZwQueryDirectoryFile

fltlib

FilterLoad FilterSendMessage FilterGetMessage FilterReplyMessage FilterConnectCommunicationPort

kernel32

GetDriveTypeW FindFirstFileW SetLastError FindNextFileW FindClose InitializeCriticalSection DeleteCriticalSection GetFileSizeEx VirtualFree VirtualAlloc UnlockFileEx WaitForSingleObject GetFileAttributesW GetCurrentThreadId CreateEventW ResetEvent LockFileEx GetTickCount FlushFileBuffers OpenProcess GetCurrentThread GetCurrentProcessId DeviceIoControl GetCurrentProcess SetFilePointer LeaveCriticalSection GetLogicalDrives GetEnvironmentVariableW GetProcAddress GetModuleHandleW ReleaseMutex GetComputerNameW OpenMutexW GetVolumeNameForVolumeMountPointW Sleep InitializeCriticalSectionAndSpinCount SetEvent GetVersion WaitForMultipleObjects CreateSemaphoreW RaiseException GetLocalTime ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW WaitNamedPipeW GetOverlappedResult CancelIo SetWaitableTimer CreateWaitableTimerW CreateThread CreateTimerQueueTimer ExpandEnvironmentStringsW DeleteTimerQueueTimer SetFilePointerEx UnmapViewOfFile CreateFileMappingW MapViewOfFile GetCommandLineA GetDiskFreeSpaceW WriteFile EnterCriticalSection ReadFile GetSystemTimeAsFileTime CloseHandle DeleteFileW GetLastError CreateMutexW GetLogicalDriveStringsW GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStringTypeW SetStdHandle GetConsoleOutputCP HeapSize HeapReAlloc ReleaseSemaphore CreateFileW WriteConsoleW QueryDosDeviceW VirtualQuery GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedFlushSList TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW CompareStringW LCMapStringW HeapFree HeapAlloc GetStdHandle GetFileType WideCharToMultiByte GetConsoleMode

advapi32

SetSecurityDescriptorDacl SetSecurityDescriptorOwner GetTraceLoggerHandle GetTraceEnableFlags GetTraceEnableLevel RegisterTraceGuidsW UnregisterTraceGuids InitializeSecurityDescriptor GetTokenInformation LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken RevertToSelf CryptDestroyKey CryptGetUserKey CryptGetKeyParam CryptAcquireContextW CloseEncryptedFileRaw CryptDecrypt TraceMessage OpenEncryptedFileRawW CryptSetKeyParam CryptImportKey GetUserNameW ReadEncryptedFileRaw CryptReleaseContext

Name

.text

Size

494KB

Virtual Size

493KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

114KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

falcon.dll

secur32

ntdll

fltlib

kernel32

advapi32

generic