TFQFym2NF9[.]exe | Triage™

General

Target
TFQFym2NF9.exe
Size 301KB
Sample240723-sn1cqszapg
SHA256 d99e41c304f50b2548a79f43cfea1de5d96ceb38b254ed8057b59ae190916200
MD5 547d22725d299a21760e957f1522d03b
SHA1 5fc9a7b3d3b118b38d1b76f33eba59ba3f49e33e
SHA512 ee486698fa1952464d08a9987679b2a28fc1d54cb9635ed92392f896368375f60ed139bc82ee846d35ea1f6ec409989a7aa9bbd1c39912fdbec15f375a0cb4ea
SSDEEP 3072:eMbOOm6/FBMTUrZXzYzRbWW2DA6mMY0bX2pk0Bhi25P3SSklv9ATu:eMDLt5ZXkzRitDcMpbXMk0Dvx3kN9AT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
TFQFym2NF9.exe

File Explorer

TFQFym2NF9.exe

.exe 301KB

TFQFym2NF9.exe

IMPHASH 58093ffabb9a2185417f2ba8d6a1667e
SHA256 d99e41c304f50b2548a79f43cfea1de5d96ceb38b254ed8057b59ae190916200
MD5 547d22725d299a21760e957f1522d03b
SHA1 5fc9a7b3d3b118b38d1b76f33eba59ba3f49e33e
SHA512 ee486698fa1952464d08a9987679b2a28fc1d54cb9635ed92392f896368375f60ed139bc82ee846d35ea1f6ec409989a7aa9bbd1c39912fdbec15f375a0cb4ea
SSDEEP 3072:eMbOOm6/FBMTUrZXzYzRbWW2DA6mMY0bX2pk0Bhi25P3SSklv9ATu:eMDLt5ZXkzRitDcMpbXMk0Dvx3kN9AT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19859

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile LocalCompact GlobalLock CreateHardLinkA GetModuleHandleW CreateNamedPipeW GetConsoleCP GlobalAlloc LoadLibraryW IsProcessInJob CreateEventA GetSystemDirectoryA CreateJobObjectA GetConsoleAliasesW GetLastError SetLastError GetProcAddress GetProcessHeaps PeekConsoleInputW EnumDateFormatsExA VerLanguageNameW LoadLibraryA FindFirstVolumeMountPointW IsBadHugeReadPtr AddAtomW HeapWalk EnumResourceTypesW SetEnvironmentVariableA GetModuleFileNameA GetOEMCP EnumResourceNamesA GetFileTime FatalAppExitA SetProcessShutdownParameters SetFileShortNameA GetDiskFreeSpaceExA TerminateJobObject LCMapStringW CloseHandle WriteConsoleW FlushFileBuffers SetStdHandle GetConsoleMode HeapReAlloc GetStringTypeW SetConsoleCtrlHandler CreateFileA InterlockedIncrement InterlockedDecrement EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException RtlUnwind WideCharToMultiByte MultiByteToWideChar GetCPInfo IsProcessorFeaturePresent GetACP IsValidCodePage TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId HeapCreate SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess WriteFile GetModuleFileNameW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW

user32

CharUpperBuffW GetMessageExtraInfo DrawStateW SetMenu GetSysColorBrush SetCaretPos SetClipboardViewer

advapi32

RegSetValueA

Sharing