Fling Perm[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Fling Perm.exe
Size 995KB
Sample260517-ezjbpscs5s
SHA256 5798764834c425a434bdde628f5dff15f730c857e05b82031f13a32330fff50c
MD5 125556f84dd08c4e4e86ca880c0a2b37
SHA1 aabd08ea22d36a863671309a5413521f9161076b
SHA512 a7e82c66a0115d9b9ea3db5798c270c08508bec5e3c633ed9e0622564f6fbf71ed300ca2269fe12997276ea25cabdb0f8aaa6dc7cac79ec115337afe7edb4e71
SSDEEP 24576:TbQ2SZ58GXpY579KNMd0dSzL6hfEVIqI3Y/WOTeRRuwRmbFBch:THO58GXKmC0d1MVIqI3Y/WOTeRRuwRmb
TLSH
T177259D1B6BA401EDC5B7D17CC65B8607E7B270490360ABEB06D186A52F13BE46F3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Fling Perm.exe

File Explorer

Fling Perm.exe

.exe 995KB

Fling Perm.exe

IMPHASH e22314961cf3b1b1dedde54d5c2ab7dc
SHA256 5798764834c425a434bdde628f5dff15f730c857e05b82031f13a32330fff50c
MD5 125556f84dd08c4e4e86ca880c0a2b37
SHA1 aabd08ea22d36a863671309a5413521f9161076b
SHA512 a7e82c66a0115d9b9ea3db5798c270c08508bec5e3c633ed9e0622564f6fbf71ed300ca2269fe12997276ea25cabdb0f8aaa6dc7cac79ec115337afe7edb4e71
SSDEEP 24576:TbQ2SZ58GXpY579KNMd0dSzL6hfEVIqI3Y/WOTeRRuwRmbFBch:THO58GXKmC0d1MVIqI3Y/WOTeRRuwRmb
TLSH
T177259D1B6BA401EDC5B7D17CC65B8607E7B270490360ABEB06D186A52F13BE46F3EB41
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

746144

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Downloads\srcs\Frozen Perm\x64\Release\Fling Perm.pdb

kernel32

QueryPerformanceCounter GetTickCount MultiByteToWideChar WideCharToMultiByte MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerSetConditionMask VerifyVersionInfoW GetFileSizeEx FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW CreateDirectoryW FindClose InitializeCriticalSectionEx LocalFree GetFileAttributesExW AreFileApisANSI GetSystemInfo SleepEx LoadLibraryW GetProcAddress FreeLibrary GetSystemDirectoryW QueryPerformanceFrequency GetFileInformationByHandleEx SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleHandleW GetModuleHandleA GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect GetCurrentProcess GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy DeleteCriticalSection AddVectoredExceptionHandler CreateFileW CreateProcessA CloseHandle GetLastError Sleep WaitForSingleObject FindFirstFileW OutputDebugStringW InitializeSListHead GetSystemTimeAsFileTime IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter CreateThread

user32

GetCursorPos SetCursorPos MessageBoxA ExitWindowsEx MessageBoxW

advapi32

SystemFunction036 GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA SetSecurityInfo CopySid CryptEncrypt CryptImportKey CryptDestroyKey OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash AddAccessAllowedAce

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?_Xbad_function_call@std@@YAXXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??7ios_base@std@@QEBA_NXZ _Xtime_get_ticks ?_Xinvalid_argument@std@@YAXPEBD@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ _Query_perf_frequency ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?good@ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1_Lockit@std@@QEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?_Syserror_map@std@@YAPEBDH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ?_Throw_Cpp_error@std@@YAXH@Z ??0_Lockit@std@@QEAA@H@Z

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

ws2_32

inet_ntop gethostname ioctlsocket WSACleanup WSAStartup sendto recvfrom freeaddrinfo getaddrinfo listen WSACloseEvent htonl accept select __WSAFDIsSet WSAIoctl socket setsockopt WSACreateEvent recv send htons getsockopt getsockname WSAEnumNetworkEvents getpeername WSAEventSelect WSAResetEvent connect WSAWaitForMultipleEvents closesocket WSAGetLastError WSASetLastError bind inet_pton ntohs

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception __current_exception_context __C_specific_handler wcschr strstr strrchr strchr memmove memcpy memcmp memchr _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy memset

api-ms-win-crt-runtime-l1-1-0

terminate system __sys_nerr _beginthreadex _configure_narrow_argv _initialize_narrow_environment _invoke_watson _initialize_onexit_table _register_onexit_function exit _crt_atexit _resetstkoflw _cexit __sys_errlist _seh_filter_exe _set_app_type _get_initial_narrow_environment _initterm _initterm_e _exit __p___argc _invalid_parameter_noinfo_noreturn _errno __p___argv _c_exit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo abort

api-ms-win-crt-stdio-l1-1-0

_write _fileno _set_fmode _close _read __p__commode ftell _get_stream_buffer_pointers _fseeki64 _wfopen fsetpos ungetc setvbuf fputs fgetpos fputc fwrite __acrt_iob_func fflush fclose fgetc __stdio_common_vfprintf __stdio_common_vsprintf _lseeki64 __stdio_common_vsscanf _wopen _pclose _popen fseek fgets feof fread

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free realloc _callnewh

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _wstat64 _fstat64 _lock_file _unlink

api-ms-win-crt-math-l1-1-0

_dsign _fdopen __setusermatherr _dclass

api-ms-win-crt-convert-l1-1-0

wcstombs strtoull strtoul strtoll atoi strtod strtol

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_localtime64 strftime _time64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale localeconv

api-ms-win-crt-string-l1-1-0

strspn strcmp wcsncmp _wcsdup wcspbrk strcspn strncmp wcsncpy _strdup strpbrk

api-ms-win-crt-utility-l1-1-0

qsort

shell32

ShellExecuteA ShellExecuteW