SF-Verif[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SF-Verif.exe
Size 668KB
Sample260523-22kc4sfs21
SHA256 676548b58279f3f5bd7099a0953539839fb98f4bf3957bf18618f36c72c09e5c
MD5 7468abcc71590e734af11a9f819bcd9b
SHA1 3d8a68e97a26f43abb670b341a34d027c5c43fdf
SHA512 ed1617be3123afcb585ec88e601997cdc7914c210ac61d573daf84d381283e865c65ae0c6c8526d0a7e8fddf6141293c836da68fdc3abc36b1bcbc93ed028f91
SSDEEP 12288:++Uk1O0qYlSf50VtKlNBrV2IzR2th83EH:++8Yl450Onr2I12th83E
TLSH
T10DE4183AF71219ADC05F037B85A587E195902685F734A5B702B48E53BAE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SF-Verif.exe

File Explorer

SF-Verif.exe

.exe 668KB

SF-Verif.exe

IMPHASH 1ec4006f82795ca4e7ee6f2834765dc5
SHA256 676548b58279f3f5bd7099a0953539839fb98f4bf3957bf18618f36c72c09e5c
MD5 7468abcc71590e734af11a9f819bcd9b
SHA1 3d8a68e97a26f43abb670b341a34d027c5c43fdf
SHA512 ed1617be3123afcb585ec88e601997cdc7914c210ac61d573daf84d381283e865c65ae0c6c8526d0a7e8fddf6141293c836da68fdc3abc36b1bcbc93ed028f91
SSDEEP 12288:++Uk1O0qYlSf50VtKlNBrV2IzR2th83EH:++8Yl450Onr2I12th83E
TLSH
T10DE4183AF71219ADC05F037B85A587E195902685F734A5B702B48E53BAE34C24F3AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

130372

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\prostone\Desktop\all\Malware-67-main\Release\SF-Verif.pdb

kernel32

LoadLibraryW CreateThread SetFileAttributesA GetLogicalDriveStringsA DecodePointer SetCurrentDirectoryW GetProcAddress DeleteCriticalSection SetThreadExecutionState GetConsoleWindow CreateProcessA GetTickCount WriteConsoleW SetEndOfFile GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage HeapSize ReadConsoleW ReadFile EnumSystemLocalesW CloseHandle IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect CreateProcessW GetExitCodeProcess HeapAlloc HeapReAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibrary ExitProcess TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind DeleteFileA TerminateThread GetLastError GetTempPathA Sleep GetModuleHandleA GetCurrentThreadId CreateFileW WaitForSingleObject GetModuleFileNameW InitializeCriticalSectionEx GetDriveTypeA WriteFile GetStdHandle GetCurrentProcess GetUserDefaultLCID GetModuleFileNameA RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter RaiseException OutputDebugStringW IsDebuggerPresent GetStringTypeW RtlUnwind GetCPInfo CompareStringEx EncodePointer LeaveCriticalSection EnterCriticalSection LCMapStringEx WideCharToMultiByte MultiByteToWideChar GetFileInformationByHandleEx CopyFile2 GetModuleHandleW AreFileApisANSI CreateFile2 GetTempPathW LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW

user32

InvalidateRect UpdateWindow RegisterClassExA FindWindowA GetDesktopWindow ActivateKeyboardLayout UpdateLayeredWindow ReleaseDC GetWindowDC SendMessageA LoadCursorW LoadKeyboardLayoutA TranslateMessage CreateWindowExA DefWindowProcA EnumWindows UnhookWindowsHookEx EnumDisplaySettingsA MessageBoxA SetWindowTextA FrameRect ChangeDisplaySettingsExA FindWindowExA DispatchMessageW SetCursorPos SetWindowsHookExW ShowWindow GetMessageW EnumDisplayDevicesA GetDC IsWindowVisible SetWindowPos PostMessageA FillRect CallNextHookEx GetSystemMetrics GetShellWindow

gdi32

BitBlt CreateCompatibleBitmap CreateFontA SelectObject CreateDIBSection CreateCompatibleDC StretchBlt DeleteDC SetTextColor TextOutA SetBkMode DeleteObject CreateSolidBrush

advapi32

AdjustTokenPrivileges RegCloseKey RegSetValueExA OpenProcessToken RegOpenKeyExA LookupPrivilegeValueW

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteExA

ole32

CoCreateInstance CoInitializeEx

winmm

mciSendStringA

wininet

InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipCreateBitmapFromFile GdipDeleteGraphics GdipCreateFromHDC GdipGraphicsClear GdipSetInterpolationMode GdipSetSmoothingMode GdipDisposeImage GdipDrawImageRectI GdipAlloc GdipFree

urlmon

URLDownloadToFileA

setupapi

SetupDiEnumDeviceInfo SetupDiSetClassInstallParamsA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA

Name

.text

Size

275KB

Virtual Size

274KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SF-Verif.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

wininet

gdiplus

urlmon

setupapi

generic