TiFileFetcher[.]7z

Sharing

Copy URL

Twitter E-mail

General

Target

TiFileFetcher.7z
Size

186KB
MD5

f5643bad130a166a1b4cfe7fab54dd2f
SHA1

5c9b93103fb037b143a3a3dd077c1248567ff4ed
SHA256

8df42b44562cdce5801b77241bc2d667e07bbec0a3d6934739467fb00cdacdd1
SHA512

ec88d3f8db41dbc2567f99ea74c9e8f6e6f43a460a66b8241944dcc428885ae19c62abed85d840bfbc51f9cfa17a4a72e3e832dde34481dcfe4d65a33b36ccf0
SSDEEP

3072:fs2GlO4bvnQNSbZh7onM6CY83e3cJtP5Jh06eXYvb3bfhDOpdO2QeSUOawHTARh5:0DlO4GSb77oM6CGg5Jh0rYaaA5w50

Score

1^/10

Malware Config

Signatures

Files

TiFileFetcher.7z
.7z

Password: infected
TiFileFetcher.exe
.exe windows:10 windows x64 arch:x64

Password: infected

9e79b3624ceeb8936ff77c1fec94ddb0

Code Sign

33:00:00:03:3b:65:5f:ae:fa:db:75:e9:d6:00:00:00:00:03:3b
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

02-09-2021 18:23

Not After

01-09-2022 18:23

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19-10-2011 18:41

Not After

19-10-2026 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

e8:5e:1e:39:2c:f6:24:90:2c:ce:21:88:f5:3e:f0:30:ed:54:98:1a:e1:44:17:6e:a8:b3:64:22:b9:46:46:e1
Signer

Actual PE Digest

e8:5e:1e:39:2c:f6:24:90:2c:ce:21:88:f5:3e:f0:30:ed:54:98:1a:e1:44:17:6e:a8:b3:64:22:b9:46:46:e1

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TiFileFetcher.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__initialize_onexit_table
_o__initialize_wide_environment
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o__wcsnicmp
memmove
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_memcpy_s
_o_qsort
_o_strcpy_s
_o_terminate
_o_towupper
_o__get_initial_wide_environment
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
wcsrchr
wcschr
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___p__commode
_o___p___wargv
_o___p___argc
_o__exit
__C_specific_handler
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

wcscmp
memset
memmove_s
wcsncmp

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive
AcquireSRWLockExclusive
ReleaseSemaphore
WaitForSingleObject
InitializeCriticalSectionAndSpinCount
CreateEventW
ResetEvent
SetEvent
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection

api-ms-win-core-com-l1-1-0

CoRegisterClassObject
CoReleaseServerProcess
CoRevokeClassObject
CoReleaseMarshalData
CoAddRefServerProcess
CoInitializeEx
CoResumeClassObjects
CoCreateInstance
CoUninitialize
CoInitializeSecurity
CoMarshalInterface
CreateStreamOnHGlobal
GetHGlobalFromStream

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetLastError
RaiseException
SetUnhandledExceptionFilter
GetLastError

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle
GetHandleInformation

api-ms-win-core-file-l1-1-0

SetEndOfFile
LockFileEx
GetFinalPathNameByHandleW
GetVolumeInformationW
LocalFileTimeToFileTime
SetFileTime
RemoveDirectoryW
GetVolumePathNameW
DeleteFileW
UnlockFileEx
WriteFile
GetLongPathNameW
GetFileSizeEx
SetFilePointerEx
ReadFile
FindClose
FindFirstFileW
FlushFileBuffers
GetFileInformationByHandle
GetVolumeInformationByHandleW
SetFileInformationByHandle
GetFileAttributesW
CreateFileW
SetFilePointer
FindNextFileW
GetFullPathNameW
SetFileAttributesW
CreateDirectoryW

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
TlsGetValue
TlsAlloc
TlsSetValue
GetCurrentThreadId
GetCurrentProcess
OpenProcessToken
TlsFree
GetCurrentProcessId

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapSetInformation
HeapAlloc
HeapReAlloc

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
VirtualProtect
CreateFileMappingW
MapViewOfFile
VirtualQuery

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetSystemInfo

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-1

OpenProcess
IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-1-0

LoadLibraryExW
GetModuleHandleW
FreeLibrary
GetProcAddress
LoadLibraryExA

ntdll

NtQueryInformationProcess
NtQueryInformationToken
NtClose
RtlNtStatusToDosError
NtQueryInformationFile
RtlSetControlSecurityDescriptor
NtSetSecurityObject
NtSetInformationFile
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
RtlDosPathNameToNtPathName_U
NtCreateFile
NtSetEaFile
RtlImpersonateSelf
RtlAdjustPrivilege
RtlInitializeResource
RtlAcquireResourceExclusive
RtlAcquireResourceShared
RtlReleaseResource
RtlDeleteResource
RtlReAllocateHeap
RtlRaiseStatus
NtYieldExecution
DbgPrintEx
RtlAllocateHeap
RtlFreeHeap
RtlFindAceByType

bcrypt

BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptCloseAlgorithmProvider
BCryptGetProperty
BCryptFinishHash
BCryptDestroyHash

cabinet

ord20
ord22
ord23

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentVariableW
GetCurrentDirectoryW

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime
WaitForMultipleObjects

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringW
WideCharToMultiByte

api-ms-win-core-io-l1-1-0

DeviceIoControl
GetOverlappedResult

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree
GlobalSize
GlobalUnlock
LocalAlloc
GlobalLock

api-ms-win-security-base-l1-1-0

GetAclInformation
AdjustTokenPrivileges
RevertToSelf
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
GetSecurityDescriptorLength

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-core-string-l2-1-0

CharUpperW

rpcrt4

UuidToStringW
RpcStringFreeW
UuidCreate

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 357KB - Virtual size: 356KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 708B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

9e79b3624ceeb8936ff77c1fec94ddb0

Code Sign

33:00:00:03:3b:65:5f:ae:fa:db:75:e9:d6:00:00:00:00:03:3bCertificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e8:5e:1e:39:2c:f6:24:90:2c:ce:21:88:f5:3e:f0:30:ed:54:98:1a:e1:44:17:6e:a8:b3:64:22:b9:46:46:e1Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-1-0

ntdll

bcrypt

cabinet

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-string-l2-1-0

rpcrt4

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 357KB - Virtual size: 356KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 1024B - Virtual size: 4KB

.pdata Size: 10KB - Virtual size: 10KB

.didat Size: 512B - Virtual size: 32B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 708B

33:00:00:03:3b:65:5f:ae:fa:db:75:e9:d6:00:00:00:00:03:3b
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e8:5e:1e:39:2c:f6:24:90:2c:ce:21:88:f5:3e:f0:30:ed:54:98:1a:e1:44:17:6e:a8:b3:64:22:b9:46:46:e1
Signer

.text
Size: 357KB - Virtual size: 356KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 1024B - Virtual size: 4KB

.pdata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 32B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 708B