Feather[.]exe | Triage™

General

Target
Feather.exe
Size 613KB
Sample260404-aylm8agy2x
SHA256 113a05106b85844a4fcc943e5b06af75bb45c22cec1e6aa30400a13e00dcfc22
MD5 b7e31b72a11298cc1a2da18ad6ee17bc
SHA1 6a8dfb68735ef059845a4925a46626876c0863d0
SHA512 19ae2804b4536c8a1737e2beba68e66aa49a471619d5d239ebb2916df1216053c28f5c39e8e96793bf211aff0642037d1571a551b09c7e84a6acc96caded2824
SSDEEP 6144:dRdSjrwJ+J20m9NbMxs9jcShHZBvu3BFulPjD/QbL2WDHqsJwO5EifyuY7AUF:Ynm99ISkWJjbQWSKVIxfyIUF
TLSH
T17FD4A9DB6B3861D0F815BAFCA9C06D05BF60AE9876804C9F1186F75FDE3E9935E48084
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Feather.exe

File Explorer

Feather.exe

.exe 613KB

Feather.exe

SHA256 113a05106b85844a4fcc943e5b06af75bb45c22cec1e6aa30400a13e00dcfc22
MD5 b7e31b72a11298cc1a2da18ad6ee17bc
SHA1 6a8dfb68735ef059845a4925a46626876c0863d0
SHA512 19ae2804b4536c8a1737e2beba68e66aa49a471619d5d239ebb2916df1216053c28f5c39e8e96793bf211aff0642037d1571a551b09c7e84a6acc96caded2824
SSDEEP 6144:dRdSjrwJ+J20m9NbMxs9jcShHZBvu3BFulPjD/QbL2WDHqsJwO5EifyuY7AUF:Ynm99ISkWJjbQWSKVIxfyIUF
TLSH
T17FD4A9DB6B3861D0F815BAFCA9C06D05BF60AE9876804C9F1186F75FDE3E9935E48084
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2b:db:b7:3f:64:c0:db:cc:9f:40:fe:83:7f:51:c3:e8:d2:63:11:f4:65:d0:45:1e:df:d0:b8:0a:f0:2a:91:cd

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

0

Major OS version

6

Entry point

153120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AccessAllocateEncoder AccessDecryptEncoder AccessInspectChannel AcquireDispatcher AcquireEndpoint AcquireObjectNew AcquireOption AdapterSendToken AdjustParameter AdjustPropertyV4 AlgorithmHandleer AlgorithmManager AlgorithmUpdateer AllocCorrectDomain AllocDisconnectDispatcher AllocReleaseEntity AllocTestObject AllocUnlockInstance AllocateDispatcherPublic AllocateOption AllocateStack AnalyzeVerifierOld ArchiveCheckSession ArchiveCorrecter ArchiveEnable ArchiveManager ArchiveParseer ArchiveReader ArchiveService ArrayBuilder ArrayHandler ArrayManager ArrayReceiveer AudioParseProvider AuthLockValidator AuthModifyDecompressor AuthSignalController BaseAcquireComponent BindEndpoint BindEntity BindFormatter BufferBuildEncryptor BufferEncryptFormatter BufferHandleRule BufferManager BufferParser BuilderManager BuilderProcessString BuilderReadValidator CacheDecryptProvider CacheWaitRule CalculateConverterUnsafe CalculateDecompressor CertificateAllocator CertificateReader ChangeParameterPublic ChannelEstimateer ChannelWriteer CheckDecompressorInternal CheckValue CheckerAcceptContainer CheckerCheckDecoder CheckerMeasureProvider CheckerProcessEntity CommonCloseMemory CommonFlushStrategy CommonResumeValue ComponentDecodeStream ComponentParseer CompressBuilder CompressContainer CompressHeap CompressInitializeEntity CompressorFormatter CompressorHandler ComputeBuffer ComputePackage ComputeValue ConfigClose ConfigExecute ConfigProvider ConnectFlagOld ConnectListEx ConnectText ConnectionAllocator ConnectionBuilder ConnectionCreator ConnectionLoader ConstructComponent ConstructContainerV1 ContainerCompute ContainerFlusher ContainerGenerator ContainerParser ContextAccepter ContextEnable ContextGenerator ContextProvider ContextWriter ControlManager ControlSettingNonBlocking ControllerAllocateOption ControllerCreateer ControllerEncodeValue ControllerSignalArchive CorrectComponent CorrectData CorrectSettingPublic CreatorAllocateCredential CredentialChangeer CredentialProvider CryptInspectVerifier CryptUnlockStack CryptoDisconnectKey CryptoMeasureModule DBFormatStream DBOpenModule DataProvider DataService DatabaseDecompressMethod DatabaseHandleContext DebugValidateArray DecodeCredentialV1 DecodeFieldSafe DecodeValueCurrent DecoderCalculate DecoderDecryptKey DecoderProvider DecoderService DecompressFreeBuilder DecryptInspectValue DecryptStack DecryptorGenerator DecryptorProcessor DecryptorReader DecryptorRelease DeserializerTransformFile DigestBuildText DirectoryConstructProvider DirectoryEstimateReader DirectoryModifyFormatter DirectoryUninitializeHeap DisableControllerOld DisableListNew DisableRecord DispatcherAllocator DispatcherBuilder DispatcherCreator DispatcherManager DispatcherParser DispatcherStopObject DomainExecuteer DomainReader DomainTransmiter DomainUnlocker DrawConstructController DriveSendScope EnableParameter EncoderBindUnpacker EncoderCompresser EncoderConnectValue EncoderFormatter EncoderHandler EncoderProvider EncoderUnloader EncryptBuilder EncryptEnvironment EncryptKey EncryptStopWriter EncryptTranslateProvider EncryptorAllocateer EncryptorManager EncryptorRelease EndpointManager EntityCreateer EntityProcessor EnvironmentGenerateer EnvironmentService EnvironmentWriter EstimateControllerV2 EstimateEnvironment EstimateSetting EstimateValidator EvaluateConfigSync EvaluateListV3 ExtensionCalculateList FactoryDecrypt FactoryMeasure FactoryModifyVerifier FactoryProcessor FactoryProvider FactorySeeker FieldBuilder FieldCreate FieldManager FileBuilder FileGenerator FileLoad FileParseArray FileProvider FileUnpackConverter FlagBuilder FlagSeek FormatEntity FormatHeap FormatterAdjustStack FormatterCalculateBuffer FormatterManager FormatterMeasureer FormatterRelease FreeBuildAlgorithm FreeEnableProperty FreeField FreeSocket FreeUpdateWriter GenerateInfo GenerateProperty GenerateStream GraphicAcquireProvider GraphicCheckPackage HandlerProvider HandlerWriter HashCertificateNonBlocking HashDisconnectPolicy HashEndpointExternal HashVerifyPacker HeapHandler HeapHash HelperEnableChannel HelperOpenPacker HelperParseManager HelperVerifyStack IdentityAccepter IdentityBuilder IdentityReader ImageAcceptEncoder ImageCompressEncryptor InfoBuilder InitializeStack InspectFactory InstanceAllocator InstanceLoad InstanceManager InstanceProvider InterpreterSendMethod JobAdjustMethod JobCreateProvider KeyCompress KeyConstruct KeyGenerator KeyManager KeyUpdate ListEnable ListReleaseer ListService ListenConnection ListenDomain LockCredential LockParameterVersion2 LockTextUnsafe LockWriter LogEstimateContainer LogicUnregisterArchive ManageInfo ManageManagerInternal ManagerMeasureContainer ManagerStoper MapperUnlockHeap MeasureComponentSafe MeasureRule MemoryReader MethodBuilder ModuleInitializeFile ModuleLoadValue MonitorCalculateStack MonitorDecodeString ObjectProvider OptionBuilder OptionFormatter OptionHandler OptionPauseAlgorithm OptionPauseKey OptionRead OptionSendRecord OptionSender PackConvertBuilder PackEntity PackFieldOld PackWaitVerifier PackageAllocateer PackageControler PackageCreator PackageService PackageStop PackerGenerator PackerManager PackerWriter ParameterAllocator ParameterCreator ParameterEncodeer ParameterInitialize ParameterLoader ParameterProvider ParameterSeeker ParseReaderV4 ParserHash ParserProvider ParserUpdate PathAcquireController PathAdjustPolicy PathMeasureHeap PathSendConfig PauseCredential PermissionConstructRecord PermissionEvaluatePolicy PermissionInspectDispatcher PermissionUnloadText PolicyProvider PreferenceAnalyzeComponent PreferenceInitializeValue ProcessStartEnvironment ProcessorManager PropertyAllocator PropertyBuild PropertyBuilder PropertyEncode ProtocolInspectSession ProviderEncrypter ProviderEstimateEntity ProviderHandler ProviderManageIdentity ProviderPauseQueue ProviderProvider ProviderReceiveScheduler ProviderSeekArray QueueEnableer QueueRelease ReceiveDecoder RecordParseer RecordReader RegistryTransmitProvider ReleaseFormatter ResumeFormatter RightsUnlockDecoder RuleAllocator RuleBuilder RuleEnableer RuleEvaluateer RuleGenerator RuleUnlocker SchedulerCheck SchedulerHandler SchedulerManager ScopeInitialize ScopeParse ScopeSender ScopeSignal ScopeUnregisterer SecurityAllocateQueue SecurityEncodeBuffer SecurityGenerateVerifier SecurityReleaseQueue SerializerPauseEncryptor SessionAllocator SessionCreator SessionHandle SessionInspect SessionManager SessionPack SignalChannelCurrent SignalList SignalOptionV1 SignalReader SocketAnalyzeer SocketConvertMemory SocketHandleer SoundAdjustStream SoundDecodeStack SoundModifyBuilder SoundTransformEncryptor StackAllocator StackBuilder StackDisableer StackInspectDecompressor StackReader StartArray StartHandler StartModule StartToken StopComponent StopInfoNonBlocking StrategyProvider StreamAccept StreamRelease StringGenerateer SupportTranslatePackage TestBuilder TestComponent TesterBuildFactory TesterControlConfig TextHasher TextManager TextProvider TextUninitializeer ThreadCorrectCredential ThreadTransformBuilder ThreadTransformStack TokenAccepter TokenDisable TokenGenerator TokenProcessor TokenTransform TraceCompressVerifier TraceFlushConverter TraceModifyConnection TransformEncoder TransformerCorrectDispatcher TransformerUnbindKey TranslateAlgorithm TranslatorInspectChannel TranslatorReceiveContainer TranslatorUnlockController TransmitEndpointV4 TransmitInstance UnbindFile UnbindHeapAsync UnbindSocketLegacy UnbindStream UninitializeHeap UnlockFieldLegacy UnlockVerifier UnlockWriterPrivate UnpackerManager UnpackerStop UpdateInfoVersion3 UtilityEstimateDecryptor UtilityEvaluateParser UtilityUpdateFactory ValidateUnpacker ValidatorBuilder ValidatorFormatter ValidatorUnregister ValueGenerator ValuePauseer VerifierConnectList VerifierEncrypter VerifierProvider VerifierStopManager VerifyRecord VideoEncodeBuilder WorkConnectFile WorkDecodeContext

Name

.text

Size

149KB

Virtual Size

149KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

516B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Feather.exe

PE Signature issue

generic