makfnV4[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

makfnV4.exe
Size

333KB
MD5

d2b6046849c1803d3eb6fdf25201c3eb
SHA1

0a6f3b699868012019db5669fafcba24f1c4e35b
SHA256

8fc7f901bb1b05473b9937d07cdb1f70c03ab261930f3dc9dc96a3c0d81719df
SHA512

cb2f524daab9215beaa9625fee7f76ad451370bf743febd4b1513334975a74eef2f609b14869cce76e44a1a75d2bdcec065c1f392b88e2118410db93636837b1
SSDEEP

6144:kaYTh65mau2BCVDgIhutSGdSyaNsecgcIzvm/qCUun+/D:BYl68/eIhutbdpozvFun

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
makfnV4.exe

Files

makfnV4.exe
.exe windows:6 windows x64 arch:x64

89f0c98041b96a330c4d94afdef2603a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

dwmapi

DwmExtendFrameIntoClientArea

kernel32

GlobalLock
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
SetConsoleTitleA
VirtualAlloc
CreateToolhelp32Snapshot
MultiByteToWideChar
Sleep
Process32NextW
CreateFileA
Process32FirstW
CloseHandle
CreateThread
GetCurrentProcessId
WideCharToMultiByte
GetConsoleWindow
GlobalAlloc
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
GetModuleHandleW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GlobalFree
GetCurrentProcess
EnterCriticalSection
FlushFileBuffers

user32

UpdateWindow
FindWindowA
TranslateMessage
PostQuitMessage
SetClipboardData
GetWindowLongW
DefWindowProcW
GetWindow
GetWindowRect
DestroyWindow
SetWindowPos
keybd_event
CreateWindowExW
GetSystemMetrics
UnregisterClassW
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
PeekMessageW
GetForegroundWindow
MoveWindow
SendInput
GetKeyState
ScreenToClient
GetActiveWindow
GetCapture
ClientToScreen
LoadCursorW
SetCapture
SetCursor
GetClientRect
GetClipboardData
EmptyClipboard
ReleaseCapture
CloseClipboard
OpenClipboard
GetCursorPos
SetCursorPos
SetWindowLongW

imm32

ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow

msvcp140

?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Xlength_error@std@@YAXPEBD@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
_Mtx_destroy_in_situ
_Mtx_init_in_situ

d3d9

Direct3DCreate9Ex

ntdll

ZwOpenKey
ZwQueryValueKey
ZwCreateKey
RtlCaptureContext
RtlLookupFunctionEntry
ZwClose
ZwSetValueKey
RtlVirtualUnwind

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
__current_exception
_CxxThrowException
__std_exception_destroy
memset
__current_exception_context
memcmp
memchr
strstr
__std_terminate
memcpy
memmove
__std_exception_copy

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__stdio_common_vsnprintf_s
ftell
__acrt_iob_func
__stdio_common_vsprintf_s
fflush
fclose
__p__commode
_set_fmode
fseek
fwrite
_wfopen
__stdio_common_vsscanf
fread
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncpy
_wcsicmp
isprint
strcmp
wcscpy_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
_set_new_mode
free

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
_register_onexit_function
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_narrow_environment
_configure_narrow_argv
exit
system
terminate

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-math-l1-1-0

cosf
ceilf
sinf
pow
floorf
atan
asin
fmodf
tanf
sqrtf
__setusermatherr
powf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 269KB - Virtual size: 269KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 464B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

89f0c98041b96a330c4d94afdef2603a

Headers

DLL Characteristics

File Characteristics

Imports

dwmapi

kernel32

user32

imm32

msvcp140

d3d9

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 269KB - Virtual size: 269KB

.rdata Size: 48KB - Virtual size: 48KB

.data Size: 3KB - Virtual size: 6KB

.pdata Size: 10KB - Virtual size: 9KB

_RDATA Size: 512B - Virtual size: 464B

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 176B

.text
Size: 269KB - Virtual size: 269KB

.rdata
Size: 48KB - Virtual size: 48KB

.data
Size: 3KB - Virtual size: 6KB

.pdata
Size: 10KB - Virtual size: 9KB

_RDATA
Size: 512B - Virtual size: 464B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 176B