ff[.]exe | Triage

Resubmissions

12-09-2024 08:50

240912-krs4tszemj 3

12-09-2024 08:49

240912-kq3lwazell 3

12-09-2024 08:47

240912-kpyljazdrk 3

Sharing

General

Target

ff.exe
Size

810KB
MD5

e985be2c1907afe3462783182d00977d
SHA1

3d8ab0d9d001e0070522b0eb628b1465e06fca3f
SHA256

d8a6ae464abf12a822636b448a532946ab8ac87013132197ad8a4f624cd8c515
SHA512

e05d885c9c0ae69c12aeccc54f9fca58e22b25517838784fd2271a2f15b2b266140edfa7b3d203969e150a855244aa5cad54c477c9adb41d8f19a8e13059014e
SSDEEP

12288:YEJpeG2DJkxaUC4BLSoy4b78ZhnIn7nfE:YEJpeG2tkxa/0LSlQ8JITfE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff.exe

Files

ff.exe
.exe windows:6 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9.6MB - Virtual size: 9.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 434KB - Virtual size: 754KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 318KB - Virtual size: 318KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.symtab
Size: 512B - Virtual size: 4B

IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ