FNCHEETA[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

FNCHEETA.exe
Size

1.4MB
MD5

08c64e988de7389a2784678a5c0b3167
SHA1

f85301237c2b21c1c1f99fc3a77ad0b3e124ed6c
SHA256

97fb0e6b9a64002f52bab61ac178a9a2f3e7d86470b4bf96b4dc654774548a1b
SHA512

92aa9a9bfc601ba6394616260fc72f2cb4592080a756c8afc6dfbfe6cbf87f205694f94d5ce0fde552404e5ff09d1f318bf85d086b18f775854b1083978cc718
SSDEEP

24576:I6TcblI8rb9pOjemNZu0mxTj8s1hLkPpXh3O49bijpR1dGv7lJSpk8IV9wt0:I6slI8fOrS0mxTj9upXhR9biPf4Ikru2

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FNCHEETA.exe

Files

FNCHEETA.exe
.exe windows:6 windows x64 arch:x64

c0466b406bfb4546564014c2a325b32e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

GetUserNameA

shell32

SHGetIconOverlayIndexA

user32

CreateCursor

kernel32

GetModuleHandleA

Sections

.rsrc
Size: - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: - Virtual size: 2.5MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE