Antefrigus[.]exe | Triage™

General

Target
Antefrigus.exe
Size 298KB
Sample241120-xtpkmswmdm
SHA256 3cb061bd1c9326ec12d3b5f540d425730245472b72e5295f52b53b82ea03cb68
MD5 b34f1592bce63de77b87d1e61bce66e5
SHA1 fd970abbec6c9be83c4b33797f0c51861bcb9e25
SHA512 f813eb7046be6920f01639917f766252f9002e1ab55b55038b5d52296deea5ca901f89bb08ffe46450503b312063cc2d9c788afd9707db00e08106d9d95b3e3d
SSDEEP 6144:lMck08hOssrg/HaGTH5zuGwq/Z3f33bm5GE0uFEfHdJVUP4:lTV8hOssIb5zuJQv3kGE/FEFDA4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Antefrigus.exe

File Explorer

Antefrigus.exe

.exe 298KB

Antefrigus.exe

IMPHASH f51784b22cb961c17877b8b52bf5d11c
SHA256 3cb061bd1c9326ec12d3b5f540d425730245472b72e5295f52b53b82ea03cb68
MD5 b34f1592bce63de77b87d1e61bce66e5
SHA1 fd970abbec6c9be83c4b33797f0c51861bcb9e25
SHA512 f813eb7046be6920f01639917f766252f9002e1ab55b55038b5d52296deea5ca901f89bb08ffe46450503b312063cc2d9c788afd9707db00e08106d9d95b3e3d
SSDEEP 6144:lMck08hOssrg/HaGTH5zuGwq/Z3f33bm5GE0uFEfHdJVUP4:lTV8hOssIb5zuJQv3kGE/FEFDA4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

7415

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalAlloc FreeEnvironmentStringsW CreateEventA InterlockedDecrement GetOverlappedResult GetProcessHeaps lstrcpynW GetLogicalDriveStringsA LocalFree CreateActCtxA GetStringTypeExW SetEvent VirtualProtect UnlockFile WriteConsoleW UpdateResourceA FindFirstChangeNotificationA GetCommandLineW PurgeComm GetCommConfig lstrlenA EnumDateFormatsExW GetCPInfo InitializeCriticalSection DeleteFileW GlobalUnWire EnumDateFormatsA lstrcmpiW FreeConsole FlushFileBuffers SetLocalTime GetCurrentThreadId AddConsoleAliasA DnsHostnameToComputerNameA GetProfileSectionA ReplaceFileA CreateMemoryResourceNotification SetLastError GetSystemWindowsDirectoryW GetVersionExW OpenJobObjectW QueryDosDeviceW ExitProcess GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection GetModuleHandleW Sleep GetProcAddress WriteFile GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetLastError GetEnvironmentStringsW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement HeapCreate VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA HeapAlloc VirtualAlloc HeapReAlloc LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP HeapSize CloseHandle CreateFileA

user32

GetCaretBlinkTime

advapi32

RegFlushKey DestroyPrivateObjectSecurity RegEnumKeyW DeleteAce ControlService OpenServiceA LookupAccountSidA IsValidAcl IsValidSecurityDescriptor IsTokenRestricted RegQueryInfoKeyW GetSidIdentifierAuthority SetServiceObjectSecurity RegDeleteValueA ClearEventLogA AreAnyAccessesGranted RegSaveKeyW

Name

.text

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

239KB

Virtual Size

304KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Antefrigus.exe

kernel32

user32

advapi32

generic