Static task
static1
General
-
Target
FFWKN
-
Size
663KB
-
MD5
b99a36b87273333b28fd5b4fd76cc727
-
SHA1
d517e72bd9e970f807d0ae71c8954c61594978c3
-
SHA256
dfb6b235948eff5d356a566db9d270609ccfc54442b0cd46162e2c42a2a7fded
-
SHA512
461b45d409c0c6c08ae7d1811849ee935db3004415642c10537958d0f6c2bd2eeb83717a081406e561e9a8ff18af2ead31889bf9c94b2d43dfa24c1b36d3dfa9
-
SSDEEP
6144:S4qAVktoZ+i74VeB1WI84TIRx6sNqGorHogXySRzleFeorqrldq4uohL+rlsXRpg:S4jVkE+i74q87Os2UgXySR5uosrI
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource FFWKN
Files
-
FFWKN.exe windows:6 windows x64 arch:x64
327ca94c8fbc403589f3409ecfee5608
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
Sleep
GetCurrentProcess
LoadLibraryExA
GetSystemDirectoryA
K32GetModuleInformation
FreeLibrary
CloseHandle
GetLastError
LoadLibraryW
GetModuleFileNameW
GetModuleHandleW
GetCurrentThread
GetTempPathW
SetEndOfFile
WriteConsoleW
HeapSize
DeleteFileW
GetModuleHandleA
CreateFileW
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
DeviceIoControl
VirtualFree
GetEnvironmentVariableA
EnterCriticalSection
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
WideCharToMultiByte
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
MultiByteToWideChar
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapFree
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
RtlUnwind
user32
MessageBeep
advapi32
LookupPrivilegeValueW
AdjustTokenPrivileges
OpenProcessToken
OpenThreadToken
RegCloseKey
RegDeleteTreeW
RegSetValueExW
RegCreateKeyW
RegOpenKeyW
Sections
.text Size: 236KB - Virtual size: 235KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 379KB - Virtual size: 379KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 22KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.gehcont Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.wferwgr Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ