Futamata[.]exe | Triage™

General

Target
Futamata.exe
Size 431KB
Sample260709-tk67jsc17k
SHA256 c262e58548920e9ac980a72ccbc2db3b5242ce2fef62d421021b83e82263c08f
MD5 7aa796e007d417237acd6ad8c8e76d1e
SHA1 86fc7d9c343d8c268c883b642500d627876fd606
SHA512 aa6b3f2908d5f3c0dd6a4f4b069653865292fa531139b2b33eda5796e512d680ca83e30e7fa33d880fd290ace383dc01676008faf4abb67578a598306f1e5922
SSDEEP 6144:MXMy9+tbLLjRqlCjAScsmFo6SaURZiZNkeTXv8KOleaC+7P2fGf/7RfU2FJJmNpw:M36MhURWFbNcLX37R82FqfgPPFd
TLSH
T12F94AF15F7A404F9E1A7C138CD968906EA717C8E47B19BCF23E409A61F276E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Futamata.exe

File Explorer

Futamata.exe

.exe 431KB

Futamata.exe

IMPHASH eb9df22e679cc79c30c27fc06afe066a
SHA256 c262e58548920e9ac980a72ccbc2db3b5242ce2fef62d421021b83e82263c08f
MD5 7aa796e007d417237acd6ad8c8e76d1e
SHA1 86fc7d9c343d8c268c883b642500d627876fd606
SHA512 aa6b3f2908d5f3c0dd6a4f4b069653865292fa531139b2b33eda5796e512d680ca83e30e7fa33d880fd290ace383dc01676008faf4abb67578a598306f1e5922
SSDEEP 6144:MXMy9+tbLLjRqlCjAScsmFo6SaURZiZNkeTXv8KOleaC+7P2fGf/7RfU2FJJmNpw:M36MhURWFbNcLX37R82FqfgPPFd
TLSH
T12F94AF15F7A404F9E1A7C138CD968906EA717C8E47B19BCF23E409A61F276E05E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

84:48:87:bd:1c:db:34:9e:e2:09:20:04:07:5c:b7:fb:74:a2:08:79:5e:3b:ac:3d:df:68:86:bd:a7:a7:6f:f7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=10729116,CN=NekoNyan Ltd,O=NekoNyan Ltd,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Chains

Jul 1, 2025

SERIALNUMBER=10729116,CN=NekoNyan Ltd,O=NekoNyan Ltd,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Subject

SERIALNUMBER=10729116,CN=NekoNyan Ltd,O=NekoNyan Ltd,ST=London\, City of,C=GB,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13024742

Serial Number

74:66:35:33:64:38:7e:90:d0:80:9d:88:ed:d9:4b:e9

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 21, 2023 - Dec 20, 2026

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Minor OS version

0

Major OS version

6

Entry point

106816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\sandg\source\repos\GameLauncher\x64\Release\GameLauncher.pdb

kernel32

InitializeCriticalSectionEx GetLastError DecodePointer DeleteCriticalSection GetModuleFileNameW MultiByteToWideChar CloseHandle CreateProcessW WideCharToMultiByte SetEndOfFile WriteConsoleW CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsDebuggerPresent OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection EncodePointer LocalFree LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapSize HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage RtlUnwind

ole32

CoCreateInstance CoInitializeEx

oleaut32

VariantInit SysFreeString SysAllocString VariantClear SysStringLen

Name

.text

Size

248KB

Virtual Size

248KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Futamata.exe

PE Signature issue

kernel32

ole32

oleaut32

generic