FiveM(2)[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FiveM(2).exe
Size 8.2MB
Sample260730-a2en3she87
SHA256 a035ca937883020ad083ac2184ba191891661205405795521a4a478f2062a16c
MD5 42967601502eb9243ef9c4c99229b7b8
SHA1 df9da87d8a9a553c3ec2afb708ba03ec3f0bf52b
SHA512 7846a02294fe46de6c09b34deeeeabef67cf79c1417015661164d7b1e3d0d924d3dfea38e20accab722653b2fa1be550fae655d9eb3c762ad0f2163f477225b4
SSDEEP 49152:UOYEtXz8D3TO8PisdhIv6wvwJezIfFGHkHxoDu8AJmMwsRxPUuCULUvw84qEVRfY:tQuJvRoR7P9g/n3dFwm2AtVnsnVHidn
TLSH
T1F486079637065718D523A0FC8A130F60EE65AC09935262CB46B5F3983F37192DF3AADD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FiveM(2).exe

File Explorer

FiveM(2).exe

.exe 8.2MB

FiveM(2).exe

IMPHASH 313577ce0fd346607ebd83a945f81a2a
SHA256 a035ca937883020ad083ac2184ba191891661205405795521a4a478f2062a16c
MD5 42967601502eb9243ef9c4c99229b7b8
SHA1 df9da87d8a9a553c3ec2afb708ba03ec3f0bf52b
SHA512 7846a02294fe46de6c09b34deeeeabef67cf79c1417015661164d7b1e3d0d924d3dfea38e20accab722653b2fa1be550fae655d9eb3c762ad0f2163f477225b4
SSDEEP 49152:UOYEtXz8D3TO8PisdhIv6wvwJezIfFGHkHxoDu8AJmMwsRxPUuCULUvw84qEVRfY:tQuJvRoR7P9g/n3dFwm2AtVnsnVHidn
TLSH
T1F486079637065718D523A0FC8A130F60EE65AC09935262CB46B5F3983F37192DF3AADD
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

106076652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\f\save\bin\client\master\five\release\FiveM.pdb

comctl32

ord345 ord344 InitCommonControlsEx

crypt32

CryptUnprotectData

kernel32

AddVectoredExceptionHandler GetCurrentProcessId ExitProcess GetStartupInfoW VirtualProtect GetProcAddress LoadLibraryA LoadLibraryW GetPrivateProfileIntW WriteFile GetCurrentThread GetTickCount VerSetConditionMask GetCurrentThreadId OpenThread SuspendThread ResumeThread GetThreadContext SetThreadContext VerifyVersionInfoW RtlAddFunctionTable GetModuleFileNameA CreateDirectoryW FindClose FindFirstFileW FindNextFileW GetFileSizeEx GetPrivateProfileStringW WritePrivateProfileStringW GetFullPathNameW GetEnvironmentVariableW SetEnvironmentVariableW SetCurrentDirectoryW SetEvent CreateMutexW OpenMutexW CreateEventW GetExitCodeProcess OpenProcess GetTickCount64 GetSystemDirectoryW IsProcessInJob CreateJobObjectW AssignProcessToJobObject SetInformationJobObject SetDllDirectoryW WaitForSingleObject CreateRemoteThread GetExitCodeThread GetProcessId GetSystemTime VirtualAllocEx ReadProcessMemory WriteProcessMemory K32EnumProcessModules K32GetModuleFileNameExW K32GetModuleInformation ReadFile GetOverlappedResult EncodePointer DecodePointer ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FreeLibrary LoadResource LockResource SizeofResource FindResourceW MulDiv CreateActCtxW ActivateActCtx GetLocaleInfoW LCMapStringW GetFileAttributesExW MultiByteToWideChar MoveFileW CopyFileW LocalFree GetModuleHandleW GetModuleFileNameW ReadConsoleInputW SetConsoleMode RtlUnwind SystemTimeToFileTime FlushConsoleInputBuffer GlobalMemoryStatus MapViewOfFile CreateFileMappingW CreateProcessW HeapSize GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation SetEndOfFile FlushFileBuffers SetStdHandle HeapReAlloc Sleep GetLastError CloseHandle GetFileAttributesW OutputDebugStringA DeleteFileW CreateFileW GetCommandLineW TerminateProcess GetCurrentProcess IsDebuggerPresent EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW HeapAlloc HeapFree SetConsoleCtrlHandler GetConsoleCP ReadConsoleW GetConsoleMode SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetDriveTypeW ExitThread WriteConsoleW GetModuleHandleExW GetFileType GetStdHandle RtlUnwindEx RtlPcToFileHeader QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList InterlockedPopEntrySList VirtualFree VirtualAlloc GetVersionExW LoadLibraryExW GetModuleHandleA FreeLibraryAndExitThread GetThreadTimes OutputDebugStringW SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer CompareStringW ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait CreateTimerQueue LoadLibraryExA VirtualQuery GetSystemInfo IsProcessorFeaturePresent UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry FormatMessageW WideCharToMultiByte RtlCaptureContext InitializeCriticalSectionAndSpinCount RaiseException CompareStringOrdinal InitOnceExecuteOnce InitializeSRWLock GlobalUnlock GlobalLock GlobalSize CreateEventExW WaitForSingleObjectEx DuplicateHandle SetNamedPipeHandleState TransactNamedPipe WaitNamedPipeW ResetEvent WaitForMultipleObjects SetUnhandledExceptionFilter InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ReleaseSemaphore CreateSemaphoreW CreateThread VirtualQueryEx GetProcessTimes GetSystemTimeAsFileTime UnregisterWaitEx UnregisterWait ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW ReleaseMutex RegisterWaitForSingleObject InitializeCriticalSectionEx SleepEx QueryPerformanceFrequency QueryPerformanceCounter ExpandEnvironmentStringsA SetLastError FormatMessageA SetFilePointer GetStringTypeW SwitchToThread GetNativeSystemInfo GetCurrentDirectoryW FindFirstFileExW GetFileInformationByHandle AreFileApisANSI MoveFileExW TryEnterCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree GetCPInfo InitializeSListHead

user32

GetWindowLongW MessageBoxA GetDesktopWindow FindWindowExW GetSysColorBrush SetWindowLongW GetSysColor FindWindowW MessageBoxW TranslateMessage DispatchMessageW PeekMessageW MsgWaitForMultipleObjects SendMessageW GetUserObjectInformationW GetProcessWindowStation RegisterWindowMessageW DefWindowProcW RegisterClassExW CreateWindowExW DestroyWindow ShowWindow MoveWindow SetWindowPos SetWindowTextW AllowSetForegroundWindow GetDC ReleaseDC BeginPaint EndPaint SetTimer LoadCursorW LoadIconW MonitorFromPoint

gdi32

GetDeviceCaps SetTextColor CreateFontIndirectW SetBkMode

advapi32

ReportEventW RegGetValueW RegisterEventSourceW DeregisterEventSource RegDeleteKeyW GetTokenInformation OpenProcessToken RegSetKeyValueW

shell32

SHCreateItemFromParsingName SHGetKnownFolderPath SetCurrentProcessExplicitAppUserModelID CommandLineToArgvW SHParseDisplayName SHSetLocalizedName ord709 ShellExecuteW SHBindToParent

ws2_32

WSAGetLastError socket __WSAFDIsSet select WSASetLastError recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSAIoctl WSAStartup WSACleanup getaddrinfo freeaddrinfo ioctlsocket getservbyname shutdown htonl gethostbyname

shlwapi

StrStrIW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

rpcrt4

RpcStringFreeA UuidToStringA

d3d11

D3D11CreateDevice

wininet

HttpQueryInfoW InternetCrackUrlW HttpSendRequestW InternetConnectW InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW InternetSetOptionW InternetReadFile InternetOpenW InternetQueryDataAvailable

oleaut32

SysFreeString

Name

.cdummy

Size

Virtual Size

97.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

170KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cld

Size

111KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.clr

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.zdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

924KB

Virtual Size

924KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.unwind

Size

1.6MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_MEM_READ

Name

.rd_pef

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FiveM(2).exe

comctl32

crypt32

kernel32

user32

gdi32

advapi32

shell32

ws2_32

shlwapi

version

rpcrt4

d3d11

wininet

oleaut32

generic