winfastify_setup_1[.]0[.]0[.]1005[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
winfastify_setup_1.0.0.1005.exe
Size 1.6MB
Sample260623-pdplpscx5w
SHA256 3e86f21b48213a6a06921c1ee4061ff57e56493b7fc7a2ff8f8b74f6e719e9e1
MD5 a4d934f7d1b10d41c47d4064c6656db4
SHA1 2291a645a11da0b4dc022366cd612bec200ebeb3
SHA512 e44664e68f1b6e9b660faa0875647178c781e00deae1b9fcb75e948cf238e38d3b168175d3678d6ff875f68456d86612dc8d955828343eba03e0a732c5a1a17e
SSDEEP 49152:V+bPO+QExhk7UloD0VwOFJLdc7krXjDzpHzbtgNqsn2pjXrR:qam7iDWP1e7UXjd6ypjb
TLSH
T16485F171E5128075D0D681F0AAA9C295B72EB6720F5318C7239429BEFBBE4D43B3B513
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
winfastify_setup_1.0.0.1005.exe

File Explorer

winfastify_setup_1.0.0.1005.exe

.exe 1.6MB

winfastify_setup_1.0.0.1005.exe

IMPHASH 265b4b7e75e9cde8f27c3b299377faa0
SHA256 3e86f21b48213a6a06921c1ee4061ff57e56493b7fc7a2ff8f8b74f6e719e9e1
MD5 a4d934f7d1b10d41c47d4064c6656db4
SHA1 2291a645a11da0b4dc022366cd612bec200ebeb3
SHA512 e44664e68f1b6e9b660faa0875647178c781e00deae1b9fcb75e948cf238e38d3b168175d3678d6ff875f68456d86612dc8d955828343eba03e0a732c5a1a17e
SSDEEP 49152:V+bPO+QExhk7UloD0VwOFJLdc7krXjDzpHzbtgNqsn2pjXrR:qam7iDWP1e7UXjd6ypjb
TLSH
T16485F171E5128075D0D681F0AAA9C295B72EB6720F5318C7239429BEFBBE4D43B3B513
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

265312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Workspace\CdKrc_WinFastify\InstallUninstall\Release\install\install.pdb

kernel32

ResetEvent CancelWaitableTimer SetWaitableTimer QueryPerformanceCounter QueryPerformanceFrequency DecodePointer FreeLibrary GetProcAddress GetModuleHandleW lstrcmpiW MultiByteToWideChar LoadLibraryExW GetModuleFileNameW RaiseException GetCurrentThreadId ResumeThread LoadLibraryW FreeResource lstrcmpiA Sleep RemoveDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalUnlock lstrlenA ReadFile GetFileSizeEx WriteConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetStringTypeW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetCurrentThread WideCharToMultiByte GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation LCMapStringW CompareStringW VirtualProtect GetFileType GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread TerminateProcess UnhandledExceptionFilter FlsFree FlsSetValue FlsGetValue FlsAlloc RtlUnwind GetSystemTimeAsFileTime GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive LoadLibraryExA VirtualFree VirtualAlloc GetThreadIOPendingFlag LocalFree GetCommandLineW VerSetConditionMask VerifyVersionInfoW SetEvent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetCurrentProcess DuplicateHandle WaitForSingleObject CreateEventW CreateWaitableTimerW GetModuleHandleExW SetLastError GetLastError CreateFileW WriteFile GetEnvironmentStringsW FindResourceExW FindResourceW LoadResource LockResource HeapDestroy SizeofResource GetProcessHeap HeapAlloc HeapFree HeapReAlloc HeapSize IsProcessorFeaturePresent FlushInstructionCache InterlockedPushEntrySList InterlockedPopEntrySList InitializeSListHead EncodePointer OutputDebugStringW IsDebuggerPresent CloseHandle GetACP VirtualQuery

user32

IsWindow DefWindowProcW GetParent CreateWindowExW CallWindowProcW ReleaseCapture SetCapture InvalidateRect BeginPaint EndPaint ScreenToClient GetAsyncKeyState SetWindowLongW GetClientRect GetDC ReleaseDC GetWindowRect PostMessageW SetWindowPos MapWindowPoints GetMonitorInfoW MonitorFromWindow GetWindow ShowWindowAsync DispatchMessageW TranslateMessage PeekMessageW MsgWaitForMultipleObjectsEx CharNextW RegisterClassExW GetClassInfoExW LoadCursorW GetActiveWindow EnumThreadWindows PtInRect GetWindowLongW SetCursor DrawFocusRect CopyRect KillTimer SetTimer UpdateLayeredWindow UnregisterClassW PostQuitMessage SendMessageW LoadIconW DestroyWindow OffsetRect EqualRect UnionRect DestroyCursor ShowWindow

gdi32

RectVisible OffsetViewportOrgEx SetViewportOrgEx GetObjectW CreateDIBSection SaveDC RestoreDC CreateCompatibleBitmap CreateRectRgnIndirect BitBlt SelectClipRgn SelectObject CreateCompatibleDC DeleteDC DeleteObject

advapi32

RegEnumKeyExW RegDeleteKeyW RegQueryValueExW RegDeleteValueW RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryInfoKeyW RegCloseKey

shell32

ShellExecuteW CommandLineToArgvW SHGetSpecialFolderPathW SHCreateDirectoryExW

ole32

CoCreateInstance OleInitialize CoTaskMemFree CoTaskMemAlloc CreateStreamOnHGlobal CoInitialize CoUninitialize OleUninitialize CoTaskMemRealloc

oleaut32

VarUI4FromStr

shlwapi

PathCombineW PathIsRootW PathFindFileNameW ord12 PathIsDirectoryW

comctl32

_TrackMouseEvent

gdiplus

GdiplusShutdown GdipCreateStringFormat GdipDeleteFontFamily GdipGetImageHeight GdipDrawImageRectRect GdipCloneImage GdipDeleteBrush GdipCreateBitmapFromStream GdipAlloc GdipCreateBitmapFromStreamICM GdipDisposeImage GdipSetStringFormatLineAlign GdipCreateFont GdipCreateSolidFill GdipSetStringFormatTrimming GdipFree GdipDrawString GdipCreateFromHDC GdipSetTextRenderingHint GdipCloneBrush GdipFillRectangleI GdipDeleteGraphics GdipDeleteStringFormat GdipDeleteFont GdipGetImageWidth GdipDrawImagePointRectI GdipSetStringFormatAlign GdipDrawImageRectRectI GdipSetStringFormatFlags GdiplusStartup GdipCreateFontFamilyFromName

Name

.text

Size

360KB

Virtual Size

359KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

winfastify_setup_1.0.0.1005.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

comctl32

gdiplus

generic