femboylose[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
femboylose.exe
Size 5.4MB
Sample260620-np2jzafy21
SHA256 d601a3cfb04d0e0b8c91dee2fa1e6dd597575a99b398844b934082fbed01f4b5
MD5 9332f641c2caa93fb1df8403ed462c3f
SHA1 779c3f8a9f1e060ceee20693a699ee26319d407c
SHA512 698cbf108c821b26555a69f9767c85050a9fcb6c9aaf7b4b6b11c3ca3d6df8f522bf7eb40fb6c23aef77c9de4a0560a880fc96fa6f51207a2a93f1b9cb51838e
SSDEEP 49152:pTWBNQCPdvzO+9UOK8Zr4U4A3yYYJmQjFj64x8tzZZB5vsh+pUVw+mFIwYt0cOLo:wMWjJ4xAN7+TFt0TCcD+/n+M
TLSH
T14E467D03F26181E8C06EC174C35AA637E732BC89493476AB5BE47B212E7AF506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
femboylose.exe

File Explorer

femboylose.exe

.exe 5.4MB

femboylose.exe

IMPHASH 36edc46b3b041f43664dd3d586808ee9
SHA256 d601a3cfb04d0e0b8c91dee2fa1e6dd597575a99b398844b934082fbed01f4b5
MD5 9332f641c2caa93fb1df8403ed462c3f
SHA1 779c3f8a9f1e060ceee20693a699ee26319d407c
SHA512 698cbf108c821b26555a69f9767c85050a9fcb6c9aaf7b4b6b11c3ca3d6df8f522bf7eb40fb6c23aef77c9de4a0560a880fc96fa6f51207a2a93f1b9cb51838e
SSDEEP 49152:pTWBNQCPdvzO+9UOK8Zr4U4A3yYYJmQjFj64x8tzZZB5vsh+pUVw+mFIwYt0cOLo:wMWjJ4xAN7+TFt0TCcD+/n+M
TLSH
T14E467D03F26181E8C06EC174C35AA637E732BC89493476AB5BE47B212E7AF506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3402368

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

neverlosetauriofficial.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateFile RtlNtStatusToDosError NtCreateNamedPipeFile NtWriteFile NtDeviceIoControlFile RtlGetVersion NtReadFile NtOpenFile NtCancelIoFileEx

kernel32

FindClose FindFirstFileExW IsProcessorFeaturePresent RtlPcToFileHeader RaiseException EncodePointer LCIDToLocaleName GetUserDefaultUILanguage GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetSystemTimeAsFileTime GetFullPathNameW SetFileCompletionNotificationModes GetFinalPathNameByHandleW SetLastError RtlUnwindEx SwitchToThread CompareStringOrdinal lstrlenW FreeEnvironmentStringsW OpenProcess WaitForSingleObject TerminateProcess GetEnvironmentStringsW HeapFree GetSystemTimePreciseAsFileTime HeapReAlloc RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex MultiByteToWideChar HeapAlloc SleepEx FormatMessageW SleepConditionVariableSRW SetFileTime SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx ExitProcess GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW MoveFileExW SetWaitableTimer QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext GetCommandLineW SetEnvironmentVariableW AddVectoredExceptionHandler GetProcessHeap GetCurrentThread SetThreadStackGuarantee GetModuleHandleA Sleep GetProcAddress CloseHandle CreateWaitableTimerExW CreateProcessW CreateDirectoryW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA SetNamedPipeHandleState CreateFileW DeviceIoControl CancelIoEx CreateIoCompletionPort GetLastError GetQueuedCompletionStatusEx ReadFile PostQueuedCompletionStatus WriteFile GetOverlappedResult InitializeCriticalSectionAndSpinCount WakeAllConditionVariable GetModuleHandleW AcquireSRWLockExclusive FindNextFileW DeleteCriticalSection FreeLibrary LoadLibraryExW OutputDebugStringW OutputDebugStringA ReleaseSRWLockExclusive LoadLibraryExA GetSystemInfo LoadLibraryA LoadLibraryW SetHandleInformation

shell32

ILFree SHOpenFolderAndSelectItems ILCreateFromPathW ShellExecuteExW SHAppBarMessage DragQueryFileW DragFinish ShellExecuteW SHGetKnownFolderPath

ole32

CoCreateFreeThreadedMarshaler OleInitialize CoInitializeEx CoCreateInstance CoUninitialize CoInitialize CoTaskMemFree RegisterDragDrop RevokeDragDrop CoTaskMemAlloc

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

gdi32

GetDeviceCaps BitBlt SetBkMode SetTextColor CombineRgn DeleteObject SelectObject CreateSolidBrush DeleteDC CreateCompatibleDC CreateRectRgn CreateDIBSection

comctl32

TaskDialogIndirect RemoveWindowSubclass DefSubclassProc SetWindowSubclass

user32

EnableWindow InvalidateRect SetPropW UpdateWindow SetParent GetKeyboardState SetFocus SetWindowTextW GetWindowTextW GetWindow DestroyMenu DestroyIcon DestroyAcceleratorTable CreateAcceleratorTableW CreateMenu GetWindowTextLengthW SetWindowDisplayAffinity CreatePopupMenu DrawMenuBar MonitorFromRect ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout GetAsyncKeyState ClipCursor GetKeyState IsIconic SetMenuItemInfoW CreateIcon ShowCursor SystemParametersInfoW IsWindowEnabled ScreenToClient SetWindowLongW SetCapture RemoveMenu SetMenu GetActiveWindow PostMessageW SystemParametersInfoA PostQuitMessage GetSystemMenu GetMonitorInfoW GetTouchInputInfo GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx GetMenu GetWindowLongW InvalidateRgn ReleaseCapture SetCursorPos SetCursor RegisterTouchWindow RegisterWindowMessageA IsWindowVisible GetWindowThreadProcessId SetWindowRgn FindWindowW TranslateAcceleratorW LoadCursorW FlashWindowEx GetClipCursor CloseTouchInputHandle MsgWaitForMultipleObjectsEx DispatchMessageW MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetMessageW SetWindowLongPtrW DestroyWindow GetForegroundWindow GetParent FindWindowExW EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW GetSystemMetrics GetWindowLongPtrW TrackMouseEvent RedrawWindow AdjustWindowRect EnumDisplayMonitors MonitorFromPoint IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo GetMenuItemInfoW ShowWindow SendMessageW IsWindow

oleaut32

SetErrorInfo SysFreeString SysStringLen GetErrorInfo

shlwapi

SHCreateMemStream

dwmapi

DwmEnableBlurBehindWindow DwmGetWindowAttribute DwmSetWindowAttribute

advapi32

RegCloseKey RegQueryValueExW RegGetValueW RegOpenKeyExW EventUnregister EventWriteTransfer EventSetInformation SystemFunction036 EventRegister

ws2_32

shutdown send freeaddrinfo getaddrinfo WSACleanup WSAStartup setsockopt bind WSASend connect ioctlsocket WSASocketW recv closesocket WSAIoctl getsockname WSAGetLastError getpeername getsockopt

bcrypt

BCryptGenRandom

api-ms-win-crt-math-l1-1-0

trunc pow __setusermatherr roundf round floor

api-ms-win-crt-string-l1-1-0

strlen strcpy_s wcsncmp wcslen strcmp wcscmp _wcsicmp

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _get_initial_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment _crt_atexit _set_app_type _seh_filter_exe _register_onexit_function abort _exit _initialize_onexit_table terminate _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode calloc