fentanyl[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fentanyl.exe
Size 1.6MB
Sample260714-2vm6esht3y
SHA256 b819593b20501662ad58d4684325cd7d80135b5f252da0f5b46fdb8799ba7163
MD5 e7051b4cf6a0cedac509af736d73a159
SHA1 fa1b7ab25d47d29510a61e7003b81e089ec523e2
SHA512 425f4662ca83749a2def42df8b2aec8735253f632fab8b3882ac891b15377f9cbe35f1bfe6204e582394f3b0d497957b08fa3a0f85392f4d738d4f803e6b4aed
SSDEEP 49152:7bllmrEkZCN8CUvlO3KOkBEKbnH4aPo0TNNXIeijvY1n5Qtv:P/aCIvXbnH4aPo0TNNXIegt
TLSH
T17F75BE5AA3A900E9C57BD238C257CA07EB71741813209BEB13F48AA42F53BE15F7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fentanyl.exe

File Explorer

fentanyl.exe

.exe 1.6MB

fentanyl.exe

IMPHASH 0b6e325486e249057678a5494f37d64a
SHA256 b819593b20501662ad58d4684325cd7d80135b5f252da0f5b46fdb8799ba7163
MD5 e7051b4cf6a0cedac509af736d73a159
SHA1 fa1b7ab25d47d29510a61e7003b81e089ec523e2
SHA512 425f4662ca83749a2def42df8b2aec8735253f632fab8b3882ac891b15377f9cbe35f1bfe6204e582394f3b0d497957b08fa3a0f85392f4d738d4f803e6b4aed
SSDEEP 49152:7bllmrEkZCN8CUvlO3KOkBEKbnH4aPo0TNNXIeijvY1n5Qtv:P/aCIvXbnH4aPo0TNNXIegt
TLSH
T17F75BE5AA3A900E9C57BD238C257CA07EB71741813209BEB13F48AA42F53BE15F7E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1086628

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\hi\Downloads\fsa9fs9dsfscolor\x64\Release\fentanyl.pdb

opencv_world4120

?countNonZero@cv@@YAHAEBV_InputArray@1@@Z ?imdecode@cv@@YA?AVMat@1@AEBV_InputArray@1@H@Z ?empty@Mat@cv@@QEBA_NXZ ?inRange@cv@@YAXAEBV_InputArray@1@00AEBV_OutputArray@1@@Z ?cvtColor@cv@@YAXAEBV_InputArray@1@AEBV_OutputArray@1@HHW4AlgorithmHint@1@@Z ??0Mat@cv@@QEAA@HHH@Z ??0Mat@cv@@QEAA@XZ ??1Mat@cv@@QEAA@XZ

kernel32

GetFileAttributesExW GetFileInformationByHandleEx CreateFileMappingW FindNextFileW OutputDebugStringW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetCurrentDirectoryW GetLocaleInfoEx MultiByteToWideChar SetFileInformationByHandle AreFileApisANSI GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte FormatMessageA InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsDebuggerPresent SleepConditionVariableSRW WakeAllConditionVariable IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetFileSizeEx VerifyVersionInfoW GetCurrentProcessId WaitForMultipleObjects PeekNamedPipe ReadFile GlobalUnlock GetModuleHandleA GetFileType GetEnvironmentVariableA MapViewOfFile WaitForSingleObjectEx GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask FreeLibrary QueryPerformanceCounter MoveFileExW GetTickCount GetSystemInfo SleepEx LoadLibraryW GetSystemDirectoryW LocalFree LeaveCriticalSection EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile CreateFileW CloseHandle GetLastError AddVectoredExceptionHandler HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx DeleteCriticalSection CreateThread VirtualProtect SetPriorityClass SetConsoleTextAttribute SetConsoleTitleA GetCurrentProcess GetStdHandle SetThreadPriority Sleep GetConsoleWindow GetModuleHandleW

user32

OpenClipboard GetCursorPos ReleaseDC CloseClipboard EmptyClipboard ReleaseCapture IsWindowUnicode GetClientRect SetCursor GetClipboardData SetClipboardData SetCursorPos SetCapture LoadCursorW GetForegroundWindow GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo ClientToScreen GetCapture ScreenToClient GetDC GetWindowLongW DestroyWindow SetWindowPos CreateWindowExW SendMessageW UnregisterClassW RegisterClassExW SetWindowLongW PostQuitMessage DefWindowProcW keybd_event PostMessageA GetSystemMetrics ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW MessageBoxA TranslateMessage GetKeyState

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap GetDIBits DeleteObject BitBlt

shell32

ShellExecuteA ShellExecuteW

imm32

ImmGetContext ImmReleaseContext ImmSetCompositionWindow ImmSetCandidateWindow

d3dcompiler_47

D3DCompile

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?uncaught_exception@std@@YA_NXZ _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ?_Xbad_function_call@std@@YAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?id@?$ctype@D@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAG@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?_Id_cnt@id@locale@std@@0HA ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Cnd_do_broadcast_at_thread_exit _Thrd_id ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ?ignore@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z _Thrd_detach _Thrd_join ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ

d3d11

D3D11CreateDeviceAndSwapChain

crypt32

CertGetNameStringW CertOpenStore CertCloseStore CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertEnumCertificatesInStore CertFindExtension CertAddCertificateContextToStore CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore

ws2_32

WSAWaitForMultipleEvents ntohs inet_pton __WSAFDIsSet WSAResetEvent select WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAGetLastError WSAIoctl accept socket setsockopt send WSACleanup getsockopt recv htons bind getsockname getpeername WSAStartup connect closesocket htonl WSASetLastError listen inet_ntop gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr strchr __std_exception_destroy __std_exception_copy _CxxThrowException memchr memcpy memmove memset strrchr wcschr __current_exception __current_exception_context __C_specific_handler memcmp

api-ms-win-crt-stdio-l1-1-0

_lseeki64 fwrite _wfopen __stdio_common_vsprintf _wopen fread __stdio_common_vsscanf _set_fmode feof fputs __p__commode fflush __stdio_common_vfprintf _read _write _fileno _close fseek ftell fclose __acrt_iob_func fputc _pclose fgets __stdio_common_vsprintf_s _popen _get_stream_buffer_pointers _fseeki64 fsetpos ungetc setvbuf fgetpos fgetc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

tolower strcpy_s _strdup wcsncpy strncpy _wcsdup strcspn wcspbrk strncmp strspn strcmp strpbrk wcsncmp

api-ms-win-crt-heap-l1-1-0

malloc calloc _callnewh _set_new_mode free realloc

api-ms-win-crt-convert-l1-1-0

atoi strtod strtoll strtoull strtoul wcstombs strtol

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _errno terminate system __sys_errlist __sys_nerr _beginthreadex abort _invalid_parameter_noinfo _resetstkoflw _invoke_watson _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc exit _exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo_noreturn _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

ceilf sinf acosf fmodf __setusermatherr _fdopen sqrtf roundf _dsign cosf

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _fstat64 _lock_file _unlock_file _unlink

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

strftime _localtime64 _time64 _gmtime64

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale

advapi32

RegCreateKeyExA OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid CryptGetHashParam CryptEncrypt CryptImportKey CryptDestroyKey CryptReleaseContext RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW SystemFunction036 CryptDestroyHash CryptHashData CryptCreateHash