fncleaner1[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fncleaner1.exe
Size 104KB
Sample260707-xmmsgac17p
SHA256 9de0c63aeba6518f3e6ba8ea3d7d28ed41c6b911630a25c5af854ead0480d0a1
MD5 7670ad1bbbad82a91282a9d46e019dc3
SHA1 3b15f97eff9fb5a43045ad4d673f463ae68aa93d
SHA512 30bb7c808bb93a9a2e6082a55bfea826d1260a0c7f5e469331a979d633f93f4cf6be8ca82198ea2df29e359c2c28f281c1ebab78961def0ca8e6573a1d4dd898
SSDEEP 1536:GdbjB0cClcOlBE/cEKMM+NmZHIssVwOR5Yk3Bm/m:sCxXEc51ItwOnYKm
TLSH
T191A3081BAB61053CE1A5D63ADAE68D41EF31788E47D2ABDF13800CF25D952909F3A713
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fncleaner1.exe

File Explorer

fncleaner1.exe

.exe 104KB

fncleaner1.exe

IMPHASH 12022f5f0e0391f3187314c53c5260eb
SHA256 9de0c63aeba6518f3e6ba8ea3d7d28ed41c6b911630a25c5af854ead0480d0a1
MD5 7670ad1bbbad82a91282a9d46e019dc3
SHA1 3b15f97eff9fb5a43045ad4d673f463ae68aa93d
SHA512 30bb7c808bb93a9a2e6082a55bfea826d1260a0c7f5e469331a979d633f93f4cf6be8ca82198ea2df29e359c2c28f281c1ebab78961def0ca8e6573a1d4dd898
SSDEEP 1536:GdbjB0cClcOlBE/cEKMM+NmZHIssVwOR5Yk3Bm/m:sCxXEc51ItwOnYKm
TLSH
T191A3081BAB61053CE1A5D63ADAE68D41EF31788E47D2ABDF13800CF25D952909F3A713
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\aethr\OneDrive\Desktop\Malware Dev\DriverWiper\x64\Release\DriverWiper.pdb

kernel32

CreateProcessA GetComputerNameA GetExitCodeProcess RtlLookupFunctionEntry InitializeSListHead GetConsoleWindow GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetModuleHandleW IsDebuggerPresent FreeConsole CloseHandle DeleteFileA Sleep WaitForSingleObject SetErrorMode GetStdHandle CreatePipe GetCurrentProcess SetPriorityClass GetModuleFileNameA GetSystemTimeAsFileTime ReadFile IsProcessorFeaturePresent TerminateProcess RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter RtlCaptureContext

user32

ReleaseDC ShowWindow MessageBoxA SetWindowLongW GetDC GetWindowLongW GetSystemMetrics

gdi32

CreateCompatibleBitmap SelectObject CreateCompatibleDC GetDIBits DeleteDC DeleteObject BitBlt

advapi32

GetUserNameA FreeSid CheckTokenMembership AllocateAndInitializeSid

shell32

ShellExecuteExA

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z _Xtime_get_ticks ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?uncaught_exception@std@@YA_NXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Id_cnt@id@locale@std@@0HA ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ

winhttp

WinHttpOpen WinHttpReceiveResponse WinHttpConnect WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpAddRequestHeaders

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __current_exception __current_exception_context __C_specific_handler _CxxThrowException __std_terminate __std_exception_copy __std_exception_destroy memcpy memset memmove

api-ms-win-crt-stdio-l1-1-0

fread _get_stream_buffer_pointers fputc __p__commode _set_fmode _fseeki64 setvbuf fgetpos fwrite ungetc fsetpos fgetc fflush fclose

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _cexit terminate _set_app_type _register_onexit_function _initterm _initterm_e exit _exit _initialize_narrow_environment __p___argc __p___argv _initialize_onexit_table _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _invoke_watson _configure_narrow_argv _seh_filter_exe _c_exit

api-ms-win-crt-time-l1-1-0

_localtime64_s _time64 strftime

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale