FFHAX[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
FFHAX.exe
Size 24.2MB
Sample260801-drllesch23
SHA256 f5c1412ab5a1e0e22fab02e4ab0c5197700b6d6d055fef3d7fc7364cca759644
MD5 66c5cadc8faa78940f3ffd8b230b9dc1
SHA1 fca4b97c7cb58415f788d359627c764f41de6c14
SHA512 aa80b87e67b48818a7180a5f1decf8a43f6863f4f6b2dd6337b7190e8a4d03612c188953f3bfa8e1e4620d9aca51f54b04198851aaa921b3c6a21c71b3b245cb
SSDEEP 393216:XbNRgtJeJnX9fwtX8Io3KQZrUMGDU4PQUQxqfLzQQaL+F5oL5A:rNRgnktYp8IHQZFGnP9QQzQDL+F5oy
TLSH
T13C47338362D70DF9DDD26BB841DB6236AB35FE708A3E8F2B9500C53118136D26D6EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
FFHAX.exe

File Explorer

FFHAX.exe

.exe 24.2MB

FFHAX.exe

IMPHASH 9f318088c434b9adad69d1c5800429da
SHA256 f5c1412ab5a1e0e22fab02e4ab0c5197700b6d6d055fef3d7fc7364cca759644
MD5 66c5cadc8faa78940f3ffd8b230b9dc1
SHA1 fca4b97c7cb58415f788d359627c764f41de6c14
SHA512 aa80b87e67b48818a7180a5f1decf8a43f6863f4f6b2dd6337b7190e8a4d03612c188953f3bfa8e1e4620d9aca51f54b04198851aaa921b3c6a21c71b3b245cb
SSDEEP 393216:XbNRgtJeJnX9fwtX8Io3KQZrUMGDU4PQUQxqfLzQQaL+F5oL5A:rNRgnktYp8IHQZFGnP9QQzQDL+F5oy
TLSH
T13C47338362D70DF9DDD26BB841DB6236AB35FE708A3E8F2B9500C53118136D26D6EB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AdjustTokenPrivileges GetTokenInformation GetUserNameA LookupPrivilegeValueW OpenProcessToken

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDecrypt BCryptDestroyHash BCryptDestroyKey BCryptEncrypt BCryptFinishHash BCryptGenRandom BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateEventA CreateFileW CreateMutexW CreateProcessW CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageA GetCPInfo GetCommandLineW GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileSize GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetProcessId GetStartupInfoW GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetVolumeInformationA InitializeCriticalSection K32EnumProcessModules K32EnumProcessModulesEx K32GetMappedFileNameW K32GetModuleBaseNameW K32GetModuleInformation LeaveCriticalSection LoadLibraryW LoadResource LocalFree LockResource Module32FirstW Module32NextW MultiByteToWideChar OpenMutexW OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReadProcessMemory ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetFileAttributesW SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection TzSpecificLocalTimeToSystemTime VirtualProtect VirtualProtectEx VirtualQuery VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

_assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _mktime64 _setjmp _setmode _time64 _vscprintf _vsnprintf _wcmdln _wcsicmp _wcsnicmp _wtoi abort atexit calloc exit fflush fprintf fputc fputs free fwrite getc getenv isdigit isspace isxdigit localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setvbuf signal strchr strcmp strerror strlen strncmp strstr strtol strtoul tolower ungetc vfprintf wcschr wcslen wcsstr _strtoui64 _strtoi64 _strdup _read _fileno

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW ShellExecuteExW

user32

GetAsyncKeyState MessageBoxW

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

372KB

Virtual Size

372KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

23.2MB

Virtual Size

23.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

153B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

FFHAX.exe

advapi32

bcrypt

kernel32

msvcrt

shell32

user32

winhttp

generic