FSTYLE[.]vmp[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FSTYLE.vmp.exe
Size

11.0MB
MD5

c57afb69ed133e1860d8b5fa0a7b33d2
SHA1

62d8ece6190df518316fdf878eff4c3d1c567e48
SHA256

9b9ac60f5de55877ce9372185333edfb0cbf5726b63d011d9287ac08d5c18b9c
SHA512

bf6b40e51c85df8885ccd16f88ee827f70366f483c4ef13e4e0efe14568ada62ec87cffb53c08082a16507982bbd42908661a306144b8fcc4e8a4ba9fc789df9
SSDEEP

196608:HXD5Z9cMowsvDBzRv7I8bewKYUARFerxomvtTE/PnrSId77IV8a6F4++Aq9EjmpT:Ht2vI8bxKYzz6xoStTE/PnVd7Za6oM

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FSTYLE.vmp.exe

Files

FSTYLE.vmp.exe
.exe windows:5 windows x64 arch:x64

76deb2887ca63164f2ecb0187cd2946e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

msvcrt

getenv

user32

GetForegroundWindow

libcrypto

EVP_CIPHER_CTX_new

crypt32

CryptStringToBinaryA

kernel32

FindFirstFileA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

wininet

InternetOpenA

Sections

.text
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

./,V
Size: - Virtual size: 6.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.QfX
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

. Yy
Size: 11.0MB - Virtual size: 11.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ