FeroxV3[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FeroxV3.exe
Size 6.6MB
Sample260402-1synpsb13q
SHA256 42caae0666649bd94561b64d976c762bf990ca592f66eb13a68ca9ab3f3b825e
MD5 ef54cef50100a1a2a45da8dddcfdb729
SHA1 9406a4bb458282fdb547e2277f283766ced38bfb
SHA512 4b94d954012825fe81e204d13cf7f2352fc9304f39b4091620283b1f3666f9a95243ab3ba2079b8d5875ba660ef6c7bd2ea30479758343d0dce145d7b9981563
SSDEEP 24576:/In2qHqH34KSEU3qzPAVA/iUD82JGVQhVdaiLyKZn5+mOc1J+0DH8y+wsq6uA63L:U+Tmc
TLSH
T19666BFB831446CFB672F52BBC99A3CDD43762772878A98CD6074B3C21913665FE26C18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FeroxV3.exe

File Explorer

FeroxV3.exe

.exe 6.6MB

FeroxV3.exe

IMPHASH 43bde8802b940524fb43cd661cade5e1
SHA256 42caae0666649bd94561b64d976c762bf990ca592f66eb13a68ca9ab3f3b825e
MD5 ef54cef50100a1a2a45da8dddcfdb729
SHA1 9406a4bb458282fdb547e2277f283766ced38bfb
SHA512 4b94d954012825fe81e204d13cf7f2352fc9304f39b4091620283b1f3666f9a95243ab3ba2079b8d5875ba660ef6c7bd2ea30479758343d0dce145d7b9981563
SSDEEP 24576:/In2qHqH34KSEU3qzPAVA/iUD82JGVQhVdaiLyKZn5+mOc1J+0DH8y+wsq6uA63L:U+Tmc
TLSH
T19666BFB831446CFB672F52BBC99A3CDD43762772878A98CD6074B3C21913665FE26C18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

kernel32

CloseHandle ConvertFiberToThread ConvertThreadToFiber CreateFiber CreateFileA CreateFileMappingA CreateMutexA DeleteCriticalSection DeleteFiber EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FindResourceA FlushInstructionCache GetACP GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExA GetEnvironmentVariableA GetFileAttributesA GetFileSize GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetOEMCP GetProcAddress GetStartupInfoA GetSystemDefaultLangID GetSystemDirectoryA GetSystemInfo GetTempPathA GetTickCount GetTickCount64 GetUserDefaultLCID GetVersion GetVersionExA GetWindowsDirectoryA GlobalMemoryStatusEx InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LoadResource LockResource MapViewOfFile SetUnhandledExceptionFilter SizeofResource Sleep SwitchToFiber TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WriteFile __C_specific_handler lstrcatA lstrlenA

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _exit _fmode _initterm _ismbblead abort atexit calloc exit fprintf free malloc memcpy signal strlen strncmp vfprintf

user32

DispatchMessageA FindWindowExA GetCursorPos GetMessageA GetSystemMetrics TranslateMessage wsprintfA

Name

.text

Size

157KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

424B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FeroxV3.exe

advapi32

kernel32

msvcrt

user32

generic