autofstx[.]exe | Triage™

General

Target
autofstx.exe
Size 88KB
Sample260624-gj4c2sat21
SHA256 366c0aea9a547b2fdc9eff9c1fb7f11d0adad314bc530606562a8e58f9f3ebf5
MD5 90ffdacd6b544e9c748391058b8f5844
SHA1 ab75ed180d16157b1bc19653c0d7d248216c85ca
SHA512 9960ee949e7b77107b4d2a17ca3e413745680cf0632b2a9672604798e5086da8422a0a32de48c2bbb73d091119ab4d903f207ef8bdcce729b99bf9456968e951
SSDEEP 1536:mnkHj9t3rmPkCCy3vjE3Pk2D5nUZL2LSLIsB9NZ62NbsBZkfdb2:QAZ1vow/kiUALSD9NZ6iuOb
TLSH
T1B993280E23F53194E1B6C238A4B50212AB72B871673147FF26D4D1794F47BD1AE39BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
autofstx.exe

File Explorer

autofstx.exe

.sys 88KB

autofstx.exe

IMPHASH 1ba114af381e1b717a8e514ca430de34
SHA256 366c0aea9a547b2fdc9eff9c1fb7f11d0adad314bc530606562a8e58f9f3ebf5
MD5 90ffdacd6b544e9c748391058b8f5844
SHA1 ab75ed180d16157b1bc19653c0d7d248216c85ca
SHA512 9960ee949e7b77107b4d2a17ca3e413745680cf0632b2a9672604798e5086da8422a0a32de48c2bbb73d091119ab4d903f207ef8bdcce729b99bf9456968e951
SSDEEP 1536:mnkHj9t3rmPkCCy3vjE3Pk2D5nUZL2LSLIsB9NZ62NbsBZkfdb2:QAZ1vow/kiUALSD9NZ6iuOb
TLSH
T1B993280E23F53194E1B6C238A4B50212AB72B871673147FF26D4D1794F47BD1AE39BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

24608

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_NATIVE

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AutoFsTx.pdb

ntdll

LdrGetProcedureAddress RtlAllocateHeap RtlInitUnicodeString LdrLoadDll RtlInitAnsiString RtlFreeHeap NtQuerySystemTime NtWriteFile RtlTimeToTimeFields RtlDosPathNameToNtPathName_U wcscpy_s NtReadFile wcscat_s RtlSystemTimeToLocalTime NtClose swprintf_s NtCreateFile RtlDllShutdownInProgress RtlDosPathNameToNtPathName_U_WithStatus NtQueryAttributesFile RtlAnsiStringToUnicodeString RtlInitUTF8StringEx RtlFreeUnicodeString RtlInitAnsiStringEx RtlUTF8StringToUnicodeString RtlFindMessage RtlFormatMessage RtlDuplicateUnicodeString RtlGUIDFromString _wcsicmp RtlGetNtSystemRoot RtlGetLastNtStatus RtlMultiByteToUnicodeN RtlMultiByteToUnicodeSize RtlSetLastWin32ErrorAndNtStatusFromNtStatus wcsrchr RtlStringFromGUID wcsnlen RtlCheckRegistryKey RtlDestroyProcessParameters RtlCreateProcessParameters LdrGetDllFullName RtlCreateUserProcess NtResumeThread RtlCompareMemory NtTerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind RtlUnhandledExceptionFilter memset RtlFreeAnsiString RtlNormalizeProcessParams RtlUnicodeStringToAnsiString isspace NtDelayExecution NtQuerySystemInformation RtlSizeHeap LdrGetDllHandle RtlInitString RtlNtStatusToDosError RtlSetLastWin32Error __C_specific_handler NtQueryInformationProcess RtlDelayExecution RtlInitUnicodeStringEx RtlInitializeCriticalSection RtlEnterCriticalSection NtQueryDirectoryFileEx RtlLeaveCriticalSection RtlDeleteCriticalSection RtlDosPathNameToRelativeNtPathName_U RtlIsDosDeviceName_U RtlReleaseRelativeName NtOpenFile NtQueryInformationFile RtlQueryFeatureConfiguration RtlNotifyFeatureUsage RtlDosPathNameToRelativeNtPathName_U_WithStatus NtSetInformationFile NtQueryObject RtlEqualUnicodeString NtOpenDirectoryObject NtOpenSymbolicLinkObject NtQuerySymbolicLinkObject NtQueryDirectoryObject wcslen NtQueryVolumeInformationFile RtlSetThreadErrorMode _wcsnicmp NtWaitForSingleObject NtDeviceIoControlFile NtFsControlFile NtQueryEaFile SbSelectProcedure NtSetInformationProcess RtlDetermineDosPathNameType_U __chkstk memcpy memmove wcscmp

Name

.text

Size

48KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

autofstx.exe

ntdll

generic