SF-Verif[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SF-Verif.exe
Size 658KB
Sample260523-3x5nxsfv21
SHA256 0d2207c53fcb676d9b54b55e06a207b0242eebb8ddd5b1e1f1d37c6c9744cf2c
MD5 04cabbf13c2e16ff835021e7f5a8fa81
SHA1 91e8e975ec95fe14b911b33123a10cdc7afe8f83
SHA512 e4f8276c130c8477fb9d016b80e29fba308a3f1668246ead1efb54194ee3c2a9a94774586413dbb96c102d2da9c9324ab72b4766816f65b6b9957450f2b5edb2
SSDEEP 6144:RLe+EPr99TzKe6Jrblf46eIEVTAf5mCrlddOwfm18WgaRth86cEcm:onTzK/rbl4TIKcACRdUmm1dth83EH
TLSH
T1F8E4F83AF71219ADC05F437B85A5C3E195916A85F33465B702B08E53BAE34C25F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SF-Verif.exe

File Explorer

SF-Verif.exe

.exe 658KB

SF-Verif.exe

IMPHASH 88134c8e92fc7a89bccbb1b52cc3f2b6
SHA256 0d2207c53fcb676d9b54b55e06a207b0242eebb8ddd5b1e1f1d37c6c9744cf2c
MD5 04cabbf13c2e16ff835021e7f5a8fa81
SHA1 91e8e975ec95fe14b911b33123a10cdc7afe8f83
SHA512 e4f8276c130c8477fb9d016b80e29fba308a3f1668246ead1efb54194ee3c2a9a94774586413dbb96c102d2da9c9324ab72b4766816f65b6b9957450f2b5edb2
SSDEEP 6144:RLe+EPr99TzKe6Jrblf46eIEVTAf5mCrlddOwfm18WgaRth86cEcm:onTzK/rbl4TIKcACRdUmm1dth83EH
TLSH
T1F8E4F83AF71219ADC05F437B85A5C3E195916A85F33465B702B08E53BAE34C25F2AFC2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

124036

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\prostone\Desktop\all\Malware-67-main\Release\SF-Verif.pdb

kernel32

LoadLibraryW CreateThread SetFileAttributesA GetLogicalDriveStringsA DecodePointer SetCurrentDirectoryW GetProcAddress DeleteCriticalSection GetCurrentProcessId SetThreadExecutionState GetConsoleWindow CreateProcessA GetTickCount WriteConsoleW SetEndOfFile GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage CloseHandle ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW VirtualProtect CreateProcessW GetExitCodeProcess HeapAlloc HeapReAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType Process32FirstW DeleteFileA Process32NextW GetLastError Sleep CreateToolhelp32Snapshot OpenProcess GetCurrentThreadId CreateFileW WaitForSingleObject InitializeCriticalSectionEx GetDriveTypeA GetModuleFileNameW WriteFile GetStdHandle GetCurrentProcess SetPriorityClass HeapSize GetModuleFileNameA SetFilePointerEx GetFileSizeEx GetCommandLineW GetCommandLineA GetModuleHandleExW FreeLibrary ExitProcess TerminateProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext IsProcessorFeaturePresent FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind SetLastError RtlPcToFileHeader RtlUnwindEx RtlLookupFunctionEntry GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW GetTempPathW CreateFile2 AreFileApisANSI GetModuleHandleW CopyFile2 GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte LCMapStringEx EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo GetStringTypeW IsDebuggerPresent OutputDebugStringW RaiseException

user32

FindWindowA InvalidateRect ActivateKeyboardLayout SetWindowsHookExW GetWindowDC SendMessageA LoadKeyboardLayoutA TranslateMessage EnumWindows UnhookWindowsHookEx EnumDisplaySettingsA UpdateWindow SetCursorPos ReleaseDC GetDesktopWindow MessageBoxA GetMessageW EnumDisplayDevicesA GetDC IsWindowVisible SetWindowPos PostMessageA CallNextHookEx GetSystemMetrics GetShellWindow ShowWindow DispatchMessageW FindWindowExA ChangeDisplaySettingsExA SetWindowTextA

gdi32

BitBlt CreateFontA SelectObject SetTextColor TextOutA SetBkMode DeleteObject

advapi32

AdjustTokenPrivileges RegCloseKey RegSetValueExA OpenProcessToken RegOpenKeyExA LookupPrivilegeValueW

shell32

ShellExecuteA SHGetFolderPathA ShellExecuteExA

ole32

CoCreateInstance CoInitializeEx

winmm

mciSendStringA

wininet

InternetReadFile HttpSendRequestA InternetCloseHandle InternetOpenA InternetSetOptionA HttpOpenRequestA InternetCrackUrlA InternetOpenUrlA InternetConnectA

setupapi

SetupDiEnumDeviceInfo SetupDiSetClassInstallParamsA SetupDiCallClassInstaller SetupDiGetClassDevsA SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyA

Name

.text

Size

267KB

Virtual Size

267KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

265KB

Virtual Size

264KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

SF-Verif.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

winmm

wininet

setupapi

generic