DataFuhh[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
DataFuhh.exe
Size 20.3MB
Sample260418-rx4k3sbx21
SHA256 0b3f24af50482a8f215da8a832062c28f70cb378b351efb406f6a727799c03c3
MD5 4f9340df9cd279a1907b07e037645a5d
SHA1 4d213f3ef930b17ee173644479ebd2fc0855f869
SHA512 1ccc6ac24c14bcc56fbae53e853ff48f8cd9cb4835f5750882c1e4c02d27cf7de7f154f3c412bbcc83827e1f5bf835ec08843c9294cac076241b9a05e8d1f3c2
SSDEEP 196608:DqYD8gWSbP+LLg8sZbjnSo9uu1+LTa93YcW0l2KmNEGt2wbMhOaeP:DzD67LLg8QiKC52dkaeP
TLSH
T11A278C03F86548DBC7A491B5C9EB43867334F80017276BDB1B10B734BDA66D9AE7A390
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
DataFuhh.exe

File Explorer

DataFuhh.exe

.exe 20.3MB

DataFuhh.exe

IMPHASH 96233f916e59de07ae9d747ca4f68f79
SHA256 0b3f24af50482a8f215da8a832062c28f70cb378b351efb406f6a727799c03c3
MD5 4f9340df9cd279a1907b07e037645a5d
SHA1 4d213f3ef930b17ee173644479ebd2fc0855f869
SHA512 1ccc6ac24c14bcc56fbae53e853ff48f8cd9cb4835f5750882c1e4c02d27cf7de7f154f3c412bbcc83827e1f5bf835ec08843c9294cac076241b9a05e8d1f3c2
SSDEEP 196608:DqYD8gWSbP+LLg8sZbjnSo9uu1+LTa93YcW0l2KmNEGt2wbMhOaeP:DzD67LLg8QiKC52dkaeP
TLSH
T11A278C03F86548DBC7A491B5C9EB43867334F80017276BDB1B10B734BDA66D9AE7A390
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateThread CreateWaitableTimerA CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetErrorMode GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetTickCount HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter RaiseFailFastException ReadFile ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetProcessPriorityBoost SetThreadContext SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread SystemTimeToFileTime TlsAlloc TlsGetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fwrite

api-ms-win-crt-string-l1-1-0

memset strcmp strcspn strlen strncmp strspn

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-utility-l1-1-0

qsort

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

423KB

Virtual Size

423KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

317B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

5.1MB

Virtual Size

5.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

509KB

Virtual Size

508KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/100

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/112

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/128

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/144

Size

602KB

Virtual Size

602KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

DataFuhh.exe

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

generic