frostix[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
frostix.exe
Size 59KB
Sample260718-k8bacaas4x
SHA256 e1d20c20dc42638810a534be1de0dd93b7ef9e91fe7f761fc773ea841333fdd8
MD5 901adf5cae341ee7dc2715df6b8a75e6
SHA1 262e6351fc9aaf8c9b3466ea79ef31074bcaefd0
SHA512 af1346679177d99dd40613beea09b69f05534f01883d9e061fdf3fe35e390f87cff11faecd035c0117e6d71bdc8db4577e03c118ff2b7f35d20f47364d4e2c18
SSDEEP 768:3R87cfgFCz92dkpWAkcWhvjUUv5i3/gMgir6/F3lfK0udNpFz4O/XHXuMa1:XV9CAPinzMgicjCvzuX1
TLSH
T1A743186B679520F4E0A2E6FD80C34342EB75BC194715A7CF73AD414D1FA22D8AC7EA42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
frostix.exe

File Explorer

frostix.exe

.exe 59KB

frostix.exe

IMPHASH d54170be00e520cc93cefde1c0c3fdd7
SHA256 e1d20c20dc42638810a534be1de0dd93b7ef9e91fe7f761fc773ea841333fdd8
MD5 901adf5cae341ee7dc2715df6b8a75e6
SHA1 262e6351fc9aaf8c9b3466ea79ef31074bcaefd0
SHA512 af1346679177d99dd40613beea09b69f05534f01883d9e061fdf3fe35e390f87cff11faecd035c0117e6d71bdc8db4577e03c118ff2b7f35d20f47364d4e2c18
SSDEEP 768:3R87cfgFCz92dkpWAkcWhvjUUv5i3/gMgir6/F3lfK0udNpFz4O/XHXuMa1:XV9CAPinzMgicjCvzuX1
TLSH
T1A743186B679520F4E0A2E6FD80C34342EB75BC194715A7CF73AD414D1FA22D8AC7EA42
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22580

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\xre4a_\Downloads\Fortnite base\frostix-base\build\frostix.pdb

kernel32

DeleteFileW CloseHandle FreeConsole LoadResource FindResourceW CreateProcessW AllocConsole SetConsoleTitleW GetExitCodeProcess WideCharToMultiByte QueryPerformanceCounter GetSystemTimeAsFileTime GetLastError AreFileApisANSI GetModuleHandleW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter CreateFileW WaitForSingleObject GetTempPathW SizeofResource SetUnhandledExceptionFilter GetCurrentProcess GetCurrentThreadId GetCurrentProcessId IsDebuggerPresent InitializeSListHead Sleep GetLocaleInfoEx LockResource IsProcessorFeaturePresent FormatMessageA LocalFree TerminateProcess

user32

MessageBoxA FindWindowW GetSystemMetrics

msvcp140

?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Winerror_map@std@@YAHH@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Id_cnt@id@locale@std@@0HA ?_Xbad_alloc@std@@YAXXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exceptions@std@@YAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset memmove memcpy __std_exception_destroy __current_exception_context __std_exception_copy __current_exception __std_terminate __C_specific_handler _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_invoke_watson _initialize_narrow_environment _register_thread_local_exe_atexit_callback _configure_narrow_argv _c_exit __p___argv __p___argc _initialize_onexit_table _exit exit _initterm_e _initterm _get_initial_narrow_environment _set_app_type _seh_filter_exe terminate _cexit _crt_atexit _register_onexit_function system

api-ms-win-crt-stdio-l1-1-0

fputc __p__commode __acrt_iob_func fflush fclose freopen _get_stream_buffer_pointers _fseeki64 fread fsetpos ungetc setvbuf fgetpos fwrite _set_fmode fgetc

api-ms-win-crt-heap-l1-1-0

_callnewh free _set_new_mode malloc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr