frax[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
frax.exe
Size 19.7MB
Sample260706-adnbbagt8x
SHA256 6d761879bf212a8ec161747e5b585f0d67887f6b2029e99bf04f4652010e7a76
MD5 31015044c47dc8f8b1f3e0edf73526de
SHA1 4a8e7bde27bc8342ddec5b53c50aa38b413ce5cc
SHA512 49283f55de55219a54f295e86f2dca2ea4f96baae8c5544bc01a13d5aa41b19afa5902354b21155eb5c9a9c0d7a34595938b94c187bef38f83b8bd7ab5740647
SSDEEP 196608:8SvjnAOqvBbg4dI7W/CPTyw0ob2yjOEs3lMYxEmnf2rme9PLHNO5GUTCBrOVryIx:Jjn05Z/Vfb/urPztXUTCBryWIN1V/Y
TLSH
T1012712C525D042FDC7A2C139E24B17EAE6C5388A8DBA592FBFC684023671C41C9E7D79
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
frax.exe

File Explorer

frax.exe

.exe 19.7MB

frax.exe

IMPHASH 41b6590898ebfcc97dad5f4166a1c1a3
SHA256 6d761879bf212a8ec161747e5b585f0d67887f6b2029e99bf04f4652010e7a76
MD5 31015044c47dc8f8b1f3e0edf73526de
SHA1 4a8e7bde27bc8342ddec5b53c50aa38b413ce5cc
SHA512 49283f55de55219a54f295e86f2dca2ea4f96baae8c5544bc01a13d5aa41b19afa5902354b21155eb5c9a9c0d7a34595938b94c187bef38f83b8bd7ab5740647
SSDEEP 196608:8SvjnAOqvBbg4dI7W/CPTyw0ob2yjOEs3lMYxEmnf2rme9PLHNO5GUTCBrOVryIx:Jjn05Z/Vfb/urPztXUTCBryWIN1V/Y
TLSH
T1012712C525D042FDC7A2C139E24B17EAE6C5388A8DBA592FBFC684023671C41C9E7D79
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16339400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpReadData

ntdll

VerSetConditionMask

kernel32

GetLocaleInfoA

user32

GetWindowThreadProcessId

gdi32

GetDeviceCaps

advapi32

RegOpenKeyExW

shell32

SHGetFolderPathA

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

msvcp140

?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCompositionWindow

winmm

timeBeginPeriod

api-ms-win-core-synch-l1-1-0

AcquireSRWLockExclusive

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageA

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-math-l1-1-0

fmodf

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-environment-l1-1-0

_dupenv_s

ole32

CoCreateFreeThreadedMarshaler

oleaut32

SysStringLen

api-ms-win-core-winrt-error-l1-1-0

RoFailFastWithErrorContext

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

Name

.text

Size

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

673KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

925KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.[\S

Size

Virtual Size

11.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.FwA

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wl{

Size

19.6MB

Virtual Size

19.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

frax.exe

d3d11

winhttp

ntdll

kernel32

user32

gdi32

advapi32

shell32

d3dx11_43

d3dcompiler_43

msvcp140

dwmapi

imm32

winmm

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-2-2

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

ole32

oleaut32

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-winrt-l1-1-0

generic