5af966f4b657d5d3e5d4576ffac696a2[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

5af966f4b657d5d3e5d4576ffac696a2.exe
Size

3.5MB
MD5

5af966f4b657d5d3e5d4576ffac696a2
SHA1

f4ec36d2be5a7dea6f4fbbbcd16151d77facf9e7
SHA256

fd65a36e69c42ab79d3511669560c83de0aad638a178029363aff56afe144911
SHA512

53bd09ee37297632f1d3e3bf0cd32e899a2e87287a418f6d08012ff61acab8c927db201e0fb5656195337439bd7bc1c69c747574326215f211ba688e47ce6d14
SSDEEP

49152:Ek6ufMjhnCBj5I+IOTAwj6E9vOzf6Y7Xrl8d:EkRfMN+Jibl8d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5af966f4b657d5d3e5d4576ffac696a2.exe

Files

5af966f4b657d5d3e5d4576ffac696a2.exe
.exe windows:6 windows x86 arch:x86

736bfd4299f665319991e00351115043

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\FCT0\GIT_CLONE_PARENT\FortiClientHS\service\FortiTray\Win32\Release\FortiTray.pdb

Imports

comctl32

_TrackMouseEvent

winmm

PlaySoundW

crypt32

CertVerifyTimeValidity
CryptProtectData
CryptUnprotectData
CryptDecodeObjectEx
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertEnumPhysicalStore
CertOpenSystemStoreW
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertGetNameStringW

wininet

InternetQueryOptionW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

shlwapi

SHDeleteKeyW
SHEnumKeyExW
SHCopyKeyW
StrStrIW

psapi

GetModuleFileNameExW

ws2_32

htonl
ioctlsocket
connect
closesocket
__WSAFDIsSet
freeaddrinfo
getaddrinfo
getservbyport
inet_addr
select
WSAGetLastError
WSACleanup
WSAStartup
gethostbyname
htons
socket
WSAAddressToStringW
inet_ntoa
ntohs
shutdown

rasapi32

RasGetProjectionInfoW
RasEnumConnectionsW
RasGetEntryPropertiesW

wtsapi32

WTSRegisterSessionNotification

iphlpapi

GetAdaptersInfo
NotifyRouteChange
CancelIPChangeNotify
NotifyAddrChange

kernel32

SetEnvironmentVariableA
ExitProcess
LoadLibraryExA
VirtualQuery
VirtualProtect
GetSystemInfo
DeleteFileW
Thread32Next
Thread32First
CreateToolhelp32Snapshot
GetSystemDirectoryW
GetVersion
GetUserDefaultUILanguage
SetThreadLocale
GetACP
SetDllDirectoryW
SetCurrentDirectoryW
GetCurrentThread
IsBadWritePtr
IsBadReadPtr
VerifyVersionInfoW
VerSetConditionMask
CreatePipe
WaitForMultipleObjectsEx
CreateNamedPipeW
DisconnectNamedPipe
ConnectNamedPipe
OutputDebugStringW
FlushFileBuffers
DuplicateHandle
lstrcatW
lstrcpyW
WinExec
GetWindowsDirectoryW
GlobalFindAtomW
GlobalAddAtomW
GlobalDeleteAtom
GetTickCount64
TerminateThread
OpenEventW
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
SetConsoleCtrlHandler
LoadLibraryW
FreeLibrary
ProcessIdToSessionId
CreateProcessW
GetExitCodeProcess
TerminateProcess
CreateWaitableTimerW
WaitForMultipleObjects
SetWaitableTimer
CreateMutexW
ReleaseMutex
ResetEvent
GetTempPathW
GetTempFileNameW
GetDriveTypeW
FindNextFileW
CompareFileTime
GetModuleFileNameW
GetCommandLineW
lstrlenW
lstrcpynW
GlobalFree
GlobalLock
GlobalUnlock
GlobalAlloc
SetDefaultDllDirectories
MapViewOfFile
OpenFileMappingW
OpenMutexW
GetOverlappedResult
SetNamedPipeHandleState
WriteFile
GetModuleHandleW
InitializeCriticalSectionEx
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetLastError
RaiseException
DecodePointer
GetLocaleInfoW
GetTimeFormatW
GetTimeFormatA
GetDateFormatW
SystemTimeToFileTime
FileTimeToSystemTime
FileTimeToLocalFileTime
InitializeCriticalSectionAndSpinCount
FindClose
MultiByteToWideChar
WTSGetActiveConsoleSessionId
LocalFree
OpenProcess
ReadFile
GetLongPathNameW
CreateFileW
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WideCharToMultiByte
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetTickCount
GetLocalTime
GetSystemTimeAsFileTime
GetCurrentThreadId
CreateThread
GetCurrentProcessId
GetCurrentProcess
Sleep
CreateEventW
WaitForSingleObject
SetEvent
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
QueryPerformanceFrequency
QueryPerformanceCounter
SetLastError
SetUnhandledExceptionFilter
CloseHandle
OutputDebugStringA
DeleteFileA
CreateFileA
ExpandEnvironmentStringsA
GetStdHandle
CreateHardLinkW
MoveFileExW
FindFirstFileW
CopyFileW
CreateDirectoryExW
LoadLibraryA
SetSearchPathMode
IsProcessorFeaturePresent
UnmapViewOfFile
UnhandledExceptionFilter
DeviceIoControl
AreFileApisANSI
SetFileTime
SetFileAttributesW
RemoveDirectoryW
GetFullPathNameW
GetFileInformationByHandle
GetFileAttributesExW
GetFileAttributesW
GetDiskFreeSpaceExW
FindFirstFileExW
CreateDirectoryW
GetCurrentDirectoryW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
WaitForSingleObjectEx

user32

wvsprintfW
EnableWindow
CreateWindowExW
IsWindow
MoveWindow
SetWindowPos
GetWindowPlacement
DialogBoxParamW
OpenClipboard
CloseClipboard
SetClipboardData
EmptyClipboard
GetClientRect
GetWindowRect
MessageBoxW
GetWindowLongW
SetWindowLongW
GetAncestor
UnhookWinEvent
SetWinEventHook
GetLastInputInfo
EnumDesktopWindows
EnumDesktopsW
OpenDesktopW
GetThreadDesktop
CloseDesktop
OpenInputDesktop
SetMenuDefaultItem
SendMessageW
SetWindowTextW
DefWindowProcW
GetDlgItemTextW
GetDlgItem
EndDialog
LoadStringW
GetDoubleClickTime
LockWindowUpdate
GetFocus
FindWindowExW
UpdateWindow
RegisterClassW
GetDesktopWindow
TranslateMessage
DispatchMessageW
PostMessageW
ShowWindow
IsWindowVisible
SetTimer
KillTimer
LoadMenuW
EnumThreadWindows
MsgWaitForMultipleObjects
PostThreadMessageW
MessageBeep
GetWindowThreadProcessId
GetForegroundWindow
AttachThreadInput
SystemParametersInfoW
CopyIcon
LoadCursorW
PtInRect
SetCursor
GetDC
DestroyIcon
GetSysColor
SetForegroundWindow
SetActiveWindow
SetMenuItemBitmaps
DeleteMenu
AppendMenuW
InsertMenuW
CheckMenuItem
GetMenuState
BringWindowToTop
IsIconic
PeekMessageW
ModifyMenuW
FindWindowW
GetSystemMetrics
CreateDialogParamW
DestroyWindow
PostQuitMessage
GetMessageW
RegisterWindowMessageW
GetUserObjectInformationW
GetProcessWindowStation
LoadImageW
DestroyCursor
RemoveMenu
GetWindowInfo
LoadIconW
GetWindow
GetClassNameW
GetParent
GetClassLongW
OffsetRect
UnionRect
InflateRect
SetRect
GetSysColorBrush
GetWindowTextW
RedrawWindow
InvalidateRect
ReleaseDC
GetWindowDC
GetIconInfo
CreateIconIndirect
FillRect
GetCursorPos
SetPropW
TrackPopupMenu
GetMenuItemCount
GetMenuItemID
GetSubMenu
EnableMenuItem
UnregisterClassW

advapi32

OpenSCManagerW
RegCloseKey
RegOpenKeyA
RegQueryValueExA
OpenProcessToken
ImpersonateLoggedOnUser
RevertToSelf
RegOpenCurrentUser
RegCreateKeyW
RegDeleteValueW
RegOpenKeyW
RegQueryValueExW
RegSetValueExW
RegOpenKeyExW
RegCreateKeyExW
RegEnumKeyExW
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
ChangeServiceConfigW
OpenServiceW
SetNamedSecurityInfoW
GetNamedSecurityInfoW
SetEntriesInAclW
LookupPrivilegeValueW
MapGenericMask
ImpersonateSelf
AdjustTokenPrivileges
AccessCheck
OpenThreadToken
RegDeleteKeyW
IsValidSid
FreeSid
EqualSid
DuplicateToken
CheckTokenMembership
AllocateAndInitializeSid
ConvertStringSecurityDescriptorToSecurityDescriptorW
GetTokenInformation
RegQueryValueW
StartServiceW
QueryServiceStatus
CloseServiceHandle

ole32

CoInitialize
CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
StringFromGUID2
CoCreateGuid
CoTaskMemFree
CoUninitialize

shell32

CommandLineToArgvW
SHOpenFolderAndSelectItems
ord190
ord155
ShellExecuteW
SHGetPathFromIDListW
ord2
ord4
Shell_NotifyIconW
ShellExecuteExW
SHGetKnownFolderPath
SHGetFolderPathW
SHGetSpecialFolderLocation

oleaut32

GetErrorInfo
SysAllocStringByteLen
SysStringByteLen
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantChangeType
VariantCopy
VariantClear
VariantInit
SysAllocString
SysFreeString
SetErrorInfo
CreateErrorInfo

gdi32

GetTextExtentPoint32W
GetStockObject
CreateFontIndirectW
CreatePolygonRgn
GetObjectW
SetRectRgn
FillRgn
CreateRectRgnIndirect
CreateRectRgn
CombineRgn
SelectObject
GetDIBits
DeleteObject
CreateSolidBrush
CreatePatternBrush
CreateCompatibleDC
BitBlt
DeleteDC

gdiplus

GdiplusShutdown

oleacc

AccessibleObjectFromEvent
GetRoleTextW

Exports

Exports

??0CSslvpnAgent@@QAE@ABV0@@Z
??0CSslvpnInfoXml@@QAE@ABV0@@Z
??4COptionOp@@QAEAAV0@ABV0@@Z
??4CSslvpnAgent@@QAEAAV0@ABV0@@Z
??4CSslvpnInfoXml@@QAEAAV0@ABV0@@Z
??_7CSslvpnAgent@@6B@
??_7CSslvpnInfoXml@@6B@
?CancelGetTokenCode@CSslvpnBase@@UAEXXZ
?GetHostCheckInterval@CSslvpnBase@@QAEHXZ
?GetSessionTimeout@CSslvpnInfoXml@@QAEKXZ
?IsEnabled@CSslvpnInfoXml@@QBE_NXZ
?IsProxyAuthDlgCancelClicked@CFortiTraySslvpn@@UAEHXZ
?IsShadowMode@CSslvpnBase@@UAEHAAK@Z
?IsTunnelConnectWithoutReauthentication@CSslvpnInfoXml@@QBE_NXZ
?SetHWND@CSslvpnBase@@QAEXPAUHWND__@@@Z
?SetProxyAuthDlgCancelClicked@CFortiTraySslvpn@@UAEXH@Z
?SetTunnelConnectWithoutReauthentication@CSslvpnInfoXml@@QAEXH@Z
OPENSSL_Applink

Sections

.text
Size: 783KB - Virtual size: 784KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 286KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 220KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

736bfd4299f665319991e00351115043

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

comctl32

winmm

crypt32

wininet

version

shlwapi

psapi

ws2_32

rasapi32

wtsapi32

iphlpapi

kernel32

user32

advapi32

ole32

shell32

oleaut32

gdi32

gdiplus

oleacc

Exports

Exports

Sections

.text Size: 783KB - Virtual size: 784KB

.rdata Size: 286KB - Virtual size: 288KB

.data Size: 10KB - Virtual size: 220KB

.didat Size: 512B - Virtual size: 4KB

.rsrc Size: 2.4MB - Virtual size: 2.4MB

.text
Size: 783KB - Virtual size: 784KB

.rdata
Size: 286KB - Virtual size: 288KB

.data
Size: 10KB - Virtual size: 220KB

.didat
Size: 512B - Virtual size: 4KB

.rsrc
Size: 2.4MB - Virtual size: 2.4MB