ff[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ff.exe
Size 17.7MB
Sample260620-bex3ksdy41
SHA256 5dd9937a006c0c927752ad68e28279a1408c9fc6e9be5e4bb844b25c5a424299
MD5 726b2d856206f78e146bff83af96f9e0
SHA1 15ab03057e1cd8a3b21c09f6cc5b1819ffe74996
SHA512 f33eda64e916cfaa213961231d90de63e4b06159671b1fde5ec7a4d6518ed7e000bb202a32dace3afe8a4adf1f879d1b609b24716e98f424161c70552265187b
SSDEEP 393216:17tMLuc6W2ZHtc6XL6G6mAToPLVUIQ9m9iHsCJgAvpRw3CwIeM:172uc6W2ZNc6X2G6mAcx29meuAvpRyC3
TLSH
T1AF1733C3958F7EE6C34BC7B481B5492E7A28BF1043654C9661097B0AAF57F07B972C22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff.exe

File Explorer

ff.exe

.exe 17.7MB

ff.exe

IMPHASH a030a23ce3bedf5e293f718866ab5167
SHA256 5dd9937a006c0c927752ad68e28279a1408c9fc6e9be5e4bb844b25c5a424299
MD5 726b2d856206f78e146bff83af96f9e0
SHA1 15ab03057e1cd8a3b21c09f6cc5b1819ffe74996
SHA512 f33eda64e916cfaa213961231d90de63e4b06159671b1fde5ec7a4d6518ed7e000bb202a32dace3afe8a4adf1f879d1b609b24716e98f424161c70552265187b
SSDEEP 393216:17tMLuc6W2ZHtc6XL6G6mAToPLVUIQ9m9iHsCJgAvpRw3CwIeM:172uc6W2ZNc6X2G6mAcx29meuAvpRyC3
TLSH
T1AF1733C3958F7EE6C34BC7B481B5492E7A28BF1043654C9661097B0AAF57F07B972C22
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35272451

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse

user32

MessageBoxA

ws2_32

send

kernel32

GetFileAttributesA GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

advapi32

RegOpenKeyExA

shell32

ShellExecuteA

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

shlwapi

PathFindFileNameW

userenv

UnloadUserProfile

crypt32

CertFreeCertificateChain

bcrypt

BCryptGetProperty

psapi

GetModuleInformation

wintrust

WinVerifyTrust

dnsapi

DnsQuery_A

urlmon

URLDownloadToFileA

ntdll

RtlLookupFunctionEntry

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strchr

api-ms-win-crt-heap-l1-1-0

realloc

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode

api-ms-win-crt-string-l1-1-0

tolower

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-time-l1-1-0

_localtime64

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-filesystem-l1-1-0

_wstat64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-conio-l1-1-0

_getch

Name

.text

Size

Virtual Size

893KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

327KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.9r5

Size

Virtual Size

16.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.fB[

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WBb

Size

17.5MB

Virtual Size

17.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

233KB

Virtual Size

233KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ff.exe

winhttp

user32

ws2_32

kernel32

advapi32

shell32

msvcp140

shlwapi

userenv

crypt32

bcrypt

psapi

wintrust

dnsapi

urlmon

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-conio-l1-1-0

generic