7zFM[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7zFM.exe
Size

421KB
MD5

e5a56dc1782d5fe2017121e70b3c0b3b
SHA1

c6aa6dc41db1e8fe3aa0641e1cbfe3c96a3869b5
SHA256

3a2a1d0609cd9836665c0bb5d1edf62022c0c57b294782203561d53f7abb6aa6
SHA512

e6983be65f1f933a137aa7f0d27da7eb4862df9806c2029c64da304c7995f5e1f123020623d4efec98846119c3bfd6bb0f9b170e22d95bcbdeda0a3d12c01110
SSDEEP

6144:U7L8m+Dh+beln4vw6DyRRoSz8BmVN+uXrRMtjQ5QpR+yPiYdnAGL1rAM7Uza+yx0:Uv6h5nTHDTz/VfqDplPpdnHL1gF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7zFM.exe

Files

7zFM.exe
.exe windows:4 windows x86 arch:x86

c7bd44ed1484b2302f5b9b7a2ddca8b9

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

PropertySheetA
PropertySheetW
ImageList_ReplaceIcon
InitCommonControlsEx
CreateToolbarEx
CreateStatusWindowW
ord17
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Create
ImageList_Destroy

comdlg32

GetOpenFileNameW
GetOpenFileNameA

mpr

WNetAddConnection2A
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceA
WNetEnumResourceW
WNetGetResourceParentA
WNetGetResourceParentW
WNetGetResourceInformationA
WNetAddConnection2W
WNetOpenEnumA
WNetGetResourceInformationW

gdi32

DeleteObject

oleaut32

VariantClear
SysAllocString
SysFreeString
VariantCopy
SysStringByteLen
SysAllocStringByteLen

ole32

ReleaseStgMedium
CoCreateInstance
CoInitialize
CoUninitialize
RevokeDragDrop
RegisterDragDrop
OleInitialize
OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
DoDragDrop

user32

MapVirtualKeyA
SendMessageA
GetClassInfoW
GetClassInfoA
DialogBoxParamW
DialogBoxParamA
SystemParametersInfoA
GetDialogBaseUnits
GetWindowTextLengthW
GetWindowTextW
GetWindowTextLengthA
GetWindowTextA
SetWindowTextW
SetWindowTextA
CreateWindowExW
RegisterClassW
RegisterClassA
SendMessageW
LoadStringW
LoadStringA
AppendMenuW
AppendMenuA
InsertMenuItemA
InsertMenuItemW
SetMenuItemInfoA
SetMenuItemInfoW
GetMenuItemInfoA
GetMenuItemInfoW
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
CharLowerW
CharUpperW
CharLowerA
CharUpperA
DestroyIcon
KillTimer
SetCursor
wsprintfA
SetDlgItemTextA
MapDialogRect
ClientToScreen
GetMenuItemCount
TrackPopupMenuEx
GetCursorPos
ScreenToClient
IsWindowEnabled
ChildWindowFromPointEx
WindowFromPoint
SetFocus
PostMessageA
InvalidateRect
UpdateWindow
SetWindowLongW
SetTimer
CallWindowProcW
CallWindowProcA
RegisterClipboardFormatA
GetKeyState
EnableMenuItem
RemoveMenu
CheckMenuRadioItem
CheckMenuItem
GetMenu
LoadMenuA
SetMenu
DrawMenuBar
CreatePopupMenu
GetSubMenu
DestroyMenu
GetParent
IsDlgButtonChecked
CheckDlgButton
CheckRadioButton
GetDlgItem
GetWindowRect
MoveWindow
IsZoomed
GetClientRect
ReleaseCapture
SetCapture
GetCapture
DefWindowProcW
DefWindowProcA
LoadIconA
LoadCursorA
GetWindowPlacement
SetWindowPlacement
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
DispatchMessageA
MessageBoxW
PostQuitMessage
EndDialog
EnableWindow
ShowWindow
LoadBitmapA
CreateWindowExA
DestroyWindow
GetWindowLongA
SetWindowLongA

advapi32

OpenProcessToken
RegCreateKeyExA
RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegSetValueExW
RegQueryValueExA
RegQueryValueExW
GetFileSecurityW
SetFileSecurityW
GetUserNameA
LookupPrivilegeValueA
AdjustTokenPrivileges
GetUserNameW

shell32

SHBrowseForFolderA
DragQueryFileW
DragQueryFileA
DragFinish
SHChangeNotify
ExtractIconExW
ShellExecuteA
SHGetSpecialFolderLocation
SHGetMalloc
SHFileOperationA
SHGetDesktopFolder
ShellExecuteExA
SHGetFileInfoA
SHGetPathFromIDListA

msvcrt

free
srand
rand
_controlfp
strlen
__getmainargs
malloc
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
_beginthreadex
_acmdln
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_onexit
__dllonexit
wcslen
??1type_info@@UAE@XZ
_except_handler3
__CxxFrameHandler
_CxxThrowException
memcpy
memmove
memcmp
_purecall
memset
_wcsicmp

kernel32

LeaveCriticalSection
EnterCriticalSection
InterlockedIncrement
GetStartupInfoA
InitializeCriticalSection
SetEvent
VirtualFree
VirtualAlloc
AreFileApisANSI
CreateEventA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetFileInformationByHandle
GetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
GetDiskFreeSpaceA
GetDiskFreeSpaceW
GetDriveTypeA
GetDriveTypeW
GetVolumeInformationA
GetVolumeInformationW
GetSystemTime
SystemTimeToFileTime
FileTimeToDosDateTime
FileTimeToSystemTime
CreateProcessA
CreateProcessW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
CreateFileA
GetLogicalDriveStringsA
GetLogicalDriveStringsW
FindFirstChangeNotificationA
FindFirstChangeNotificationW
FindCloseChangeNotification
FindNextFileA
FindNextFileW
FindFirstFileA
FindFirstFileW
FindClose
GetCurrentThreadId
GetCurrentProcessId
GetTempPathA
GetTempPathW
GetCurrentDirectoryW
GetFullPathNameA
GetFullPathNameW
DeleteFileA
DeleteFileW
CreateDirectoryA
CreateDirectoryW
MoveFileA
MoveFileW
RemoveDirectoryA
RemoveDirectoryW
SetFileAttributesA
SetFileAttributesW
SetLastError
CreateFileW
SetFileTime
GetWindowsDirectoryA
GetWindowsDirectoryW
FormatMessageA
FormatMessageW
LocalFree
GetModuleFileNameA
GetModuleFileNameW
LoadLibraryW
LoadLibraryExA
LoadLibraryExW
WideCharToMultiByte
MultiByteToWideChar
ExpandEnvironmentStringsW
GetCurrentProcess
SetPriorityClass
lstrcatA
lstrlenA
GetTickCount
Sleep
FileTimeToLocalFileTime
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
WaitForMultipleObjects
CloseHandle
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
GetSystemDefaultLangID
GetUserDefaultLangID
GetModuleHandleW
CopyFileW
GetModuleHandleA
CopyFileA
WaitForSingleObject
FindNextChangeNotification
CompareFileTime
GetCompressedFileSizeW
LoadLibraryA
FreeLibrary
GetCommandLineW
GetVersionExA
GetProcAddress
DeleteCriticalSection
GetLastError
InterlockedDecrement

Sections

.text
Size: 302KB - Virtual size: 301KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 43KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c7bd44ed1484b2302f5b9b7a2ddca8b9

Headers

File Characteristics

Imports

comctl32

comdlg32

mpr

gdi32

oleaut32

ole32

user32

advapi32

shell32

msvcrt

kernel32

Sections

.text Size: 302KB - Virtual size: 301KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 43KB - Virtual size: 43KB

.text
Size: 302KB - Virtual size: 301KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 43KB - Virtual size: 43KB