fgg-config[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fgg-config.exe
Size 6.5MB
Sample260720-xvmsfacw7k
SHA256 fae04b00d8838ab571dfb93fb2fbcd4442cdf17f7f4775cc1e3de12646f1a2e7
MD5 62f351f891884486130470d74efd2d58
SHA1 8fbeb461e9cbf000d13792d51cc3bf2c877f902d
SHA512 e78ffeec7dc15fcc51e9a3a37f81b5deb4f1ed234a4d5f30d3e57e05831c02c5e6c8722e7fa11949d4de6a103b7da12cea832fba32a7169e6ac3591113437d45
SSDEEP 98304:Axg9wxGveViT/smOaXBvIFhmYsroJHx96GPKvuh5iXZkuKl3HM2jKGA/LLk+hI2:u3sOx96GCvuhsXCP3HXmbI+G
TLSH
T12F66E007E34481E9C09EC0B8835AA637EB22B8C94935B6DF27E41B512F27F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fgg-config.exe

File Explorer

fgg-config.exe

.exe 6.5MB

fgg-config.exe

IMPHASH dbb2b6e4e3f889c20f29419416eab0e7
SHA256 fae04b00d8838ab571dfb93fb2fbcd4442cdf17f7f4775cc1e3de12646f1a2e7
MD5 62f351f891884486130470d74efd2d58
SHA1 8fbeb461e9cbf000d13792d51cc3bf2c877f902d
SHA512 e78ffeec7dc15fcc51e9a3a37f81b5deb4f1ed234a4d5f30d3e57e05831c02c5e6c8722e7fa11949d4de6a103b7da12cea832fba32a7169e6ac3591113437d45
SSDEEP 98304:Axg9wxGveViT/smOaXBvIFhmYsroJHx96GPKvuh5iXZkuKl3HM2jKGA/LLk+hI2:u3sOx96GCvuhsXCP3HXmbI+G
TLSH
T12F66E007E34481E9C09EC0B8835AA637EB22B8C94935B6DF27E41B512F27F906F1D759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1952592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

fgg_config.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError

kernel32

AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW GetSystemTimeAsFileTime IsDebuggerPresent GetCurrentThreadId SetProcessWorkingSetSize SetPriorityClass OpenProcess GetCurrentProcessId SetLastError LoadLibraryA IsProcessorFeaturePresent TerminateProcess RtlPcToFileHeader RaiseException LCIDToLocaleName GetUserDefaultUILanguage EncodePointer LoadLibraryW TlsAlloc RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess WideCharToMultiByte ReleaseMutex WaitForSingleObject TlsGetValue MultiByteToWideChar HeapAlloc TlsSetValue SleepEx GetModuleHandleW FormatMessageW ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle SetWaitableTimer TlsFree InitializeSListHead UnhandledExceptionFilter SetUnhandledExceptionFilter ReleaseSRWLockExclusive SwitchToThread HeapReAlloc HeapFree CreateWaitableTimerExW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW CreateDirectoryW CreateFileW CreateThread QueryPerformanceCounter QueryPerformanceFrequency WriteFileEx ReadFileEx GetEnvironmentVariableW CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext GetCommandLineW SetEnvironmentVariableW Process32NextW Process32FirstW CreateToolhelp32Snapshot AddVectoredExceptionHandler GetFinalPathNameByHandleW GetProcessHeap GetTempPathW GetFileAttributesW GetFileInformationByHandleEx GetFileInformationByHandle SetFileInformationByHandle GetCurrentThread SetFileTime GetFullPathNameW WriteConsoleW GetConsoleOutputCP InitializeCriticalSectionAndSpinCount GetConsoleMode GetStdHandle FindClose FindNextFileW SetThreadStackGuarantee FindFirstFileExW RtlUnwindEx GetModuleHandleA Sleep GetProcAddress FreeLibrary CloseHandle GetLastError LoadLibraryExW GetSystemInfo OutputDebugStringW OutputDebugStringA DeleteCriticalSection GetSystemTimePreciseAsFileTime LoadLibraryExA lstrlenW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

user32

IsWindow SetCursorPos UpdateWindow GetForegroundWindow IsWindowEnabled SetWindowTextW IsWindowVisible GetWindowTextW GetWindowTextLengthW EnableWindow SetParent SetPropW MonitorFromRect SetCapture SetCursor EnumDisplayMonitors MonitorFromPoint ShowCursor ClipCursor RegisterTouchWindow GetClipCursor DefWindowProcW RegisterRawInputDevices TrackMouseEvent SetWindowDisplayAffinity ReleaseCapture GetKeyState ToUnicodeEx GetKeyboardLayout MapVirtualKeyExW GetKeyboardState SystemParametersInfoW LoadCursorW GetWindowPlacement GetMonitorInfoW ScreenToClient GetTouchInputInfo SetWindowPlacement ChangeDisplaySettingsExW CloseTouchInputHandle AdjustWindowRectEx GetSystemMetrics GetMenu GetWindowLongW SetWindowLongW GetAsyncKeyState FindWindowExW RegisterWindowMessageA SetTimer IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos SendInput DrawTextW FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu CreateIcon RemoveMenu CheckMenuItem EnableMenuItem DrawMenuBar CreatePopupMenu CreateMenu DrawIconEx ReleaseDC GetDC VkKeyScanW SetMenuItemInfoW AppendMenuW InsertMenuW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu SetFocus FlashWindowEx TranslateAcceleratorW SetWindowLongPtrW ChangeWindowMessageFilterEx RegisterClassW IsIconic SendMessageW GetMenuItemInfoW MapVirtualKeyW GetUpdateRect ValidateRect GetRawInputData MsgWaitForMultipleObjectsEx DispatchMessageW GetMessageW PeekMessageW PostThreadMessageW DestroyWindow GetParent GetWindow SetWindowRgn EnumChildWindows DispatchMessageA TranslateMessage GetMessageA SetWindowPos CreateWindowExW RegisterClassExW InvalidateRgn PostMessageW GetWindowLongPtrW RedrawWindow AdjustWindowRect GetSystemMenu KillTimer InvalidateRect

comctl32

RemoveWindowSubclass SetWindowSubclass DefSubclassProc TaskDialogIndirect

ole32

CoInitializeEx OleInitialize CoCreateFreeThreadedMarshaler RevokeDragDrop RegisterDragDrop CoTaskMemFree CoTaskMemAlloc CoUninitialize CoCreateInstance

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

shell32

Shell_NotifyIconGetRect Shell_NotifyIconW DragFinish DragQueryFileW SHAppBarMessage SHGetKnownFolderPath ShellExecuteW

gdi32

SelectObject SetTextColor CreateSolidBrush DeleteObject CreateRectRgn DeleteDC CreateDIBSection GetDeviceCaps CombineRgn CreateCompatibleDC SetBkMode BitBlt

advapi32

EventWriteTransfer EventSetInformation RegOpenKeyExW RegQueryValueExW RegCloseKey EventRegister RegGetValueW EventUnregister

oleaut32

GetErrorInfo SysStringLen SetErrorInfo SysFreeString

api-ms-win-crt-string-l1-1-0

wcscmp wcsncmp strcmp wcslen _wcsicmp strlen strcpy_s

api-ms-win-crt-math-l1-1-0

__setusermatherr roundf round floor pow trunc

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-runtime-l1-1-0

terminate _seh_filter_exe _set_app_type _initialize_onexit_table abort _configure_narrow_argv _register_onexit_function _cexit _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _c_exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _crt_atexit exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode malloc free _callnewh