7zFM[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

7zFM.exe
Size

557KB
MD5

e2b6c32d4ed3b253ca750b03b55acad1
SHA1

e630f10249f521c5802e79d6f44c67f310384ad1
SHA256

a0b92392ade4ad7218239ac6a3e96ec6a626b71c187960cd077c92dc34d2330d
SHA512

f2f541b3bd118d57d7fe76694a19172d8828680397d1be2a44b928059099c9ece5e58b9a1bea2dc41bd8482a6f10ceb29cb8d858b8875ce05ecb23901040aa80
SSDEEP

12288:8/nNbnEtB2xMbDshgVqd9lK1aWV1/8Juw9ZL5Uvm:8/NbnEtBZbDshgVqd97WnvQUvm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7zFM.exe

Files

7zFM.exe
.exe windows:4 windows x86 arch:x86

9201552352d858917aaaa6eb5d8a5bd7

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

comctl32

PropertySheetA
PropertySheetW
InitCommonControlsEx
CreateToolbarEx
CreateStatusWindowW
ord17
ImageList_GetImageCount
ImageList_AddMasked
ImageList_Create
ImageList_Destroy

comdlg32

GetOpenFileNameA
GetOpenFileNameW

mpr

WNetAddConnection2W
WNetOpenEnumA
WNetOpenEnumW
WNetCloseEnum
WNetEnumResourceA
WNetEnumResourceW
WNetGetResourceParentA
WNetGetResourceParentW
WNetGetResourceInformationA
WNetGetResourceInformationW
WNetAddConnection2A

gdi32

DeleteObject

oleaut32

VariantCopy
VariantClear
SysAllocString
SysFreeString
SysAllocStringByteLen
SysStringByteLen

ole32

OleUninitialize
CoTaskMemFree
CoTaskMemAlloc
OleInitialize
CoInitialize
ReleaseStgMedium
RegisterDragDrop
RevokeDragDrop
CoUninitialize
DoDragDrop

user32

GetWindowTextLengthW
GetDialogBaseUnits
SystemParametersInfoA
DialogBoxParamA
GetWindowTextW
GetWindowTextLengthA
GetWindowTextA
SetWindowTextW
SetWindowTextA
CreateWindowExW
RegisterClassW
RegisterClassA
SendMessageW
LoadStringW
LoadStringA
AppendMenuW
AppendMenuA
InsertMenuItemA
InsertMenuItemW
SetMenuItemInfoA
SetMenuItemInfoW
GetMenuItemInfoA
GetMenuItemInfoW
CharPrevA
SetClipboardData
EmptyClipboard
CloseClipboard
OpenClipboard
CharLowerW
CharLowerA
CharUpperW
CharUpperA
KillTimer
SetCursor
wsprintfA
SetDlgItemTextA
MapDialogRect
ClientToScreen
GetMenuItemCount
TrackPopupMenuEx
GetCursorPos
ScreenToClient
IsWindowEnabled
ChildWindowFromPointEx
WindowFromPoint
RegisterClipboardFormatA
PostMessageA
SetWindowLongW
InvalidateRect
UpdateWindow
SetTimer
MapVirtualKeyA
CallWindowProcW
CallWindowProcA
GetKeyState
EnableMenuItem
RemoveMenu
CheckMenuRadioItem
CheckMenuItem
GetMenu
LoadMenuA
SetMenu
DrawMenuBar
CreatePopupMenu
GetSubMenu
DestroyMenu
GetParent
IsDlgButtonChecked
CheckDlgButton
CheckRadioButton
GetDlgItem
GetWindowRect
MoveWindow
IsZoomed
GetClientRect
MessageBoxW
ReleaseCapture
SetCapture
GetCapture
DefWindowProcW
DefWindowProcA
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
LoadAcceleratorsA
GetMessageA
TranslateAcceleratorA
DispatchMessageA
LoadIconA
LoadCursorA
GetWindowPlacement
SetWindowPlacement
PostQuitMessage
EndDialog
EnableWindow
ShowWindow
LoadBitmapA
CreateWindowExA
DestroyWindow
GetWindowLongA
SetWindowLongA
SetFocus
SendMessageA
DialogBoxParamW
GetClassInfoA
GetClassInfoW

advapi32

RegOpenKeyExA
RegCloseKey
RegDeleteKeyA
RegEnumKeyExA
RegSetValueExA
RegSetValueExW
RegQueryValueExA
RegQueryValueExW
GetUserNameW
RegCreateKeyExA

shell32

SHGetSpecialFolderLocation
SHGetMalloc
SHFileOperationA
ShellExecuteA
ShellExecuteExA
SHGetFileInfoA
SHChangeNotify
DragFinish
DragQueryFileA
SHGetPathFromIDListA
DragQueryFileW
SHBrowseForFolderA
SHGetDesktopFolder

msvcrt

memcmp
__setusermatherr
_initterm
__getmainargs
_acmdln
_controlfp
__set_app_type
__p__fmode
exit
_XcptFilter
_exit
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
_except_handler3
_beginthreadex
strlen
wcsncmp
rand
srand
__p__commode
free
malloc
__CxxFrameHandler
_CxxThrowException
_adjust_fdiv
_purecall
memset
memmove
memcpy
_wcsicmp
wcslen

kernel32

EnterCriticalSection
GetStartupInfoA
InitializeCriticalSection
SetEvent
VirtualFree
VirtualAlloc
CreateEventA
CreateFileMappingA
MapViewOfFile
UnmapViewOfFile
GetStdHandle
HeapAlloc
GetProcessHeap
HeapFree
GetDiskFreeSpaceA
GetVolumeInformationW
GetVolumeInformationA
GetSystemTime
SystemTimeToFileTime
FileTimeToDosDateTime
FileTimeToSystemTime
CreateProcessA
CreateProcessW
SetEndOfFile
WriteFile
ReadFile
DeviceIoControl
SetFilePointer
GetFileSize
CreateFileA
GetLogicalDriveStringsW
GetLogicalDriveStringsA
FindFirstChangeNotificationW
FindFirstChangeNotificationA
FindCloseChangeNotification
FindNextFileW
FindNextFileA
FindFirstFileW
FindFirstFileA
FindClose
GetTempFileNameW
GetTempFileNameA
GetTempPathW
GetTempPathA
GetCurrentDirectoryW
GetFullPathNameW
GetFullPathNameA
DeleteFileW
DeleteFileA
CreateDirectoryW
CreateDirectoryA
MoveFileW
RemoveDirectoryW
SetFileAttributesW
MoveFileA
RemoveDirectoryA
SetFileAttributesA
SetLastError
CreateFileW
SetFileTime
GetWindowsDirectoryW
GetWindowsDirectoryA
FormatMessageW
FormatMessageA
LocalFree
GetModuleFileNameW
GetModuleFileNameA
LoadLibraryW
LoadLibraryExW
LoadLibraryExA
WideCharToMultiByte
MultiByteToWideChar
GetDriveTypeA
GetCurrentProcess
SetPriorityClass
lstrcatA
lstrlenA
GetTickCount
FileTimeToLocalFileTime
WaitForMultipleObjects
Sleep
CloseHandle
CompareFileTime
GlobalAlloc
GlobalFree
GlobalSize
GlobalLock
GlobalUnlock
GetSystemDefaultLangID
GetUserDefaultLangID
AreFileApisANSI
GetModuleHandleW
CopyFileW
GetModuleHandleA
CopyFileA
WaitForSingleObject
FindNextChangeNotification
GetCompressedFileSizeW
LoadLibraryA
FreeLibrary
GetCommandLineW
GetVersionExA
GetProcAddress
DeleteCriticalSection
GetLastError
InterlockedDecrement
InterlockedIncrement
LeaveCriticalSection

Sections

.text
Size: 292KB - Virtual size: 292KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.text
Size: 144KB - Virtual size: 148KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

9201552352d858917aaaa6eb5d8a5bd7

Headers

File Characteristics

Imports

comctl32

comdlg32

mpr

gdi32

oleaut32

ole32

user32

advapi32

shell32

msvcrt

kernel32

Sections

.text Size: 292KB - Virtual size: 292KB

.rdata Size: 64KB - Virtual size: 63KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 45KB - Virtual size: 44KB

.text Size: 144KB - Virtual size: 148KB

.text
Size: 292KB - Virtual size: 292KB

.rdata
Size: 64KB - Virtual size: 63KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 45KB - Virtual size: 44KB

.text
Size: 144KB - Virtual size: 148KB