Framework[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Framework.exe
Size 3.4MB
Sample260722-nbqwbagq21
SHA256 44922ddcd47e04d9f9bf9295a784dcaf6eb6174532320b87961b60921e5615a0
MD5 739186876174ed3dbc1192207598068f
SHA1 c29c779ba58224e33b39b08db7e0de8d187c4850
SHA512 6c87a82e2c13415969e528e566acf981c285a6a7a62ad377fa6757873f809c14694dce967701c873fe6966de4d560521f724cb11aa9865a07e041b7c61ec519d
SSDEEP 49152:uzmn3/sQyITLTZcBw3inPDI/x3ApxXziaj6fYe8LEoaZ2X8+OU2UuLOeYAZ:uzO0Q/LRtAn2ZJ
TLSH
T169F55B07A2ED4098E5B6A23CC6A7421FD7F3B815273586CF01AC4B2D9FA3BD14935762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Framework.exe

File Explorer

Framework.exe

.exe 3.4MB

Framework.exe

IMPHASH 25df97409079dcf75830959ce34651e8
SHA256 44922ddcd47e04d9f9bf9295a784dcaf6eb6174532320b87961b60921e5615a0
MD5 739186876174ed3dbc1192207598068f
SHA1 c29c779ba58224e33b39b08db7e0de8d187c4850
SHA512 6c87a82e2c13415969e528e566acf981c285a6a7a62ad377fa6757873f809c14694dce967701c873fe6966de4d560521f724cb11aa9865a07e041b7c61ec519d
SSDEEP 49152:uzmn3/sQyITLTZcBw3inPDI/x3ApxXziaj6fYe8LEoaZ2X8+OU2UuLOeYAZ:uzO0Q/LRtAn2ZJ
TLSH
T169F55B07A2ED4098E5B6A23CC6A7421FD7F3B815273586CF01AC4B2D9FA3BD14935762
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

716112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\v aloo\Desktop\hile&bypass source\Saturn Spoofer UI\x64\Release\Framework.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter FindResourceW SleepConditionVariableSRW WakeAllConditionVariable LoadResource GlobalFree CreateFileMappingA UnmapViewOfFile MapViewOfFile HeapFree HeapAlloc ReadFile GetFileSizeEx CreateFileA GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GlobalLock GlobalAlloc MultiByteToWideChar CreateDirectoryA ReleaseSRWLockExclusive CloseHandle LockResource GetLastError GetTempPathA WaitForSingleObject SizeofResource GetModuleHandleW Sleep FreeLibrary GetProcAddress GetCurrentProcessId LoadLibraryW SetUnhandledExceptionFilter AcquireSRWLockExclusive GetStartupInfoW

user32

GetMessageExtraInfo ScreenToClient GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor GetClientRect SetLayeredWindowAttributes IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos GetKeyState OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData PeekMessageW SetWindowLongA DispatchMessageW ShowWindow RegisterClassExW UnregisterClassW CreateWindowExW DestroyWindow DefWindowProcW PostQuitMessage UpdateWindow GetWindowRect MoveWindow GetSystemMetrics GetWindowLongW TranslateMessage

advapi32

ControlService RegCloseKey QueryServiceStatus CloseServiceHandle RegQueryValueExA OpenServiceA RegOpenKeyExA StartServiceA CreateServiceA DeleteService OpenSCManagerA

shell32

ShellExecuteExA ShellExecuteA

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

dwmapi

DwmExtendFrameIntoClientArea

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __C_specific_handler __current_exception __current_exception_context __intrinsic_setjmp _CxxThrowException __std_terminate __std_exception_destroy __std_exception_copy strstr strrchr longjmp memcpy memmove memchr memset

api-ms-win-crt-runtime-l1-1-0

terminate exit _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _configure_narrow_argv _get_narrow_winmain_command_line _initterm _initterm_e _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode fflush _set_fmode fputc fclose __stdio_common_vsprintf_s __stdio_common_vsscanf __stdio_common_vsprintf _wfopen __stdio_common_vfprintf fseek __acrt_iob_func ftell fgetc _get_stream_buffer_pointers _fseeki64 fread fsetpos fgetpos fwrite setvbuf ungetc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_callnewh malloc _set_new_mode free

api-ms-win-crt-string-l1-1-0

strncpy strlen strcmp strncmp

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

__setusermatherr sqrtf acosf ceilf cosf fmodf sinf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale