fuckshield[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fuckshield.exe
Size 14KB
Sample260728-k1fvvsshre
SHA256 5170e0549d20ae8cde76ecb0c32c7c699a597de2e395f89a352149d3ff488549
MD5 36ca3f501ee41289248f6ae871fb9537
SHA1 4cd48addf42cc951288294f0815173b694f547be
SHA512 44e3792594cf92cd0b6a8b03aa0f494259664a09f49bb419033aaa847d004eb1b6a540a852d58149dc6978991e8f58270c4c9187cb36b8294268ca0c1f634c3f
SSDEEP 192:IXa+zK5kJtMPEUf2Uk+Y1s5jK3Q5tfGLxF/gl:IXVzKAt6DrhYu5+3NFYl
TLSH
T1B0525B8ABB820CDBC979C57ACAB33C25E136F93403B14B5F47A422052EF52917D29B49
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fuckshield.exe

File Explorer

fuckshield.exe

.exe 14KB

fuckshield.exe

IMPHASH be86b3c60083965bbbbc7e1c8dc76a72
SHA256 5170e0549d20ae8cde76ecb0c32c7c699a597de2e395f89a352149d3ff488549
MD5 36ca3f501ee41289248f6ae871fb9537
SHA1 4cd48addf42cc951288294f0815173b694f547be
SHA512 44e3792594cf92cd0b6a8b03aa0f494259664a09f49bb419033aaa847d004eb1b6a540a852d58149dc6978991e8f58270c4c9187cb36b8294268ca0c1f634c3f
SSDEEP 192:IXa+zK5kJtMPEUf2Uk+Y1s5jK3Q5tfGLxF/gl:IXVzKAt6DrhYu5+3NFYl
TLSH
T1B0525B8ABB820CDBC979C57ACAB33C25E136F93403B14B5F47A422052EF52917D29B49
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\umutt\source\repos\Shield_Dll\x64\Release\injector.pdb

kernel32

GetCurrentProcess WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetLastError SetConsoleTitleA Process32NextW Process32FirstW CloseHandle GetProcAddress VirtualAllocEx WideCharToMultiByte CreateRemoteThread VirtualFreeEx RtlLookupFunctionEntry WriteProcessMemory GetFileAttributesA GetModuleFileNameA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetModuleHandleW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime

advapi32

GetTokenInformation OpenProcessToken

shell32

ShellExecuteA ShellExecuteExA

vcruntime140

__current_exception strrchr __C_specific_handler __current_exception_context memcpy memset

api-ms-win-crt-stdio-l1-1-0

__p__commode __acrt_iob_func __stdio_common_vfprintf _set_fmode

api-ms-win-crt-string-l1-1-0

_stricmp strcat_s

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initialize_onexit_table _c_exit _crt_atexit terminate _seh_filter_exe _set_app_type _cexit __p___argc __p___argv _register_onexit_function _configure_narrow_argv _exit exit _initterm_e _initterm _initialize_narrow_environment _get_initial_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode