Forte[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Forte.exe
Size 6.1MB
Sample260808-gfnhesvset
SHA256 935aa0db21df1a75ea835bc5b48064ee0429529e5250aefa83c0249dc4a51841
MD5 b18c4f7ef40a8e60aa0a1b3c6b54e2c3
SHA1 43f4f1cae3b20f0ab411cf8ace9660ab459f3643
SHA512 c6c26be7697565aa57854437060b4eb585142f73c95df06614f8a8d757615a210a52d3139af5d817d3c243e018ac0ea8d1901f7d76b4a8944f5d0f1b6161e53a
SSDEEP 49152:CuPeiu9ryjkRDG7iD2dqEtLpPqH/ZlEqINYSk7KQp1iR8OtQIC0TOuZ2:Cuu1ywRDIBdJLpiH/Zl1Idk7jVuZ2
TLSH
T1B8567BB18A8C9B4DF06AB079C2835627A7F1BC0D6361DF8B9AD09DB74C1F590F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Forte.exe

File Explorer

Forte.exe

.exe 6.1MB

Forte.exe

IMPHASH 26c8c287c6118aa6e6568f105fcc0b13
SHA256 935aa0db21df1a75ea835bc5b48064ee0429529e5250aefa83c0249dc4a51841
MD5 b18c4f7ef40a8e60aa0a1b3c6b54e2c3
SHA1 43f4f1cae3b20f0ab411cf8ace9660ab459f3643
SHA512 c6c26be7697565aa57854437060b4eb585142f73c95df06614f8a8d757615a210a52d3139af5d817d3c243e018ac0ea8d1901f7d76b4a8944f5d0f1b6161e53a
SSDEEP 49152:CuPeiu9ryjkRDG7iD2dqEtLpPqH/ZlEqINYSk7KQp1iR8OtQIC0TOuZ2:Cuu1ywRDIBdJLpiH/Zl1Idk7jVuZ2
TLSH
T1B8567BB18A8C9B4DF06AB079C2835627A7F1BC0D6361DF8B9AD09DB74C1F590F15A20D
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6158004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dwmapi

DwmExtendFrameIntoClientArea

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

winhttp

WinHttpOpenRequest WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpReadData WinHttpSendRequest WinHttpCloseHandle

kernel32

IsDebuggerPresent GetStartupInfoW GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter ReleaseSRWLockExclusive Sleep GetTickCount64 OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW CloseHandle K32GetModuleBaseNameA ReadProcessMemory WideCharToMultiByte K32EnumProcessModules MultiByteToWideChar GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency GetProcAddress FreeLibrary QueryPerformanceCounter GetModuleHandleW WriteProcessMemory InitializeSListHead UnhandledExceptionFilter AcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentThreadId WakeAllConditionVariable K32GetModuleInformation GetSystemTimeAsFileTime

user32

CreateWindowExW MapWindowPoints MoveWindow SetWindowLongW SetForegroundWindow GetKeyState GetMessageExtraInfo ScreenToClient TranslateMessage GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetForegroundWindow LoadCursorW SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard EmptyClipboard GetClipboardData SetClipboardData mouse_event GetAsyncKeyState GetClientRect GetSystemMetrics DispatchMessageW PeekMessageW DefWindowProcW

advapi32

RegQueryValueExW

shell32

ShellExecuteA

d3dcompiler_43

D3DCompile

d3dx10_43

D3DXVec3Transform

msvcp140

?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ _Query_perf_frequency ?_Throw_Cpp_error@std@@YAXH@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Cnd_do_broadcast_at_thread_exit _Query_perf_counter _Thrd_detach ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_lock _Mtx_unlock ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmReleaseContext ImmGetContext

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __C_specific_handler __current_exception_context __current_exception __std_exception_destroy __std_exception_copy __std_terminate strstr memchr memcmp memcpy memset memmove

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf _wfopen fseek _set_fmode ftell freopen _fseeki64 fread __p__commode fsetpos ungetc _get_stream_buffer_pointers __stdio_common_vfprintf fputc setvbuf fgetpos fflush __stdio_common_vsprintf __acrt_iob_func fwrite fclose fgetc

api-ms-win-crt-runtime-l1-1-0

_initterm_e _register_thread_local_exe_atexit_callback exit _beginthreadex _invoke_watson terminate _initterm _c_exit _get_wide_winmain_command_line _errno _initialize_onexit_table _register_onexit_function _crt_atexit _initialize_wide_environment _cexit _seh_filter_exe _set_app_type _exit _configure_wide_argv

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-string-l1-1-0

strcmp isxdigit strncmp strncpy strcpy_s isdigit _wcsicmp tolower

api-ms-win-crt-convert-l1-1-0

strtoll atoi strtol strtoull strtod

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale

api-ms-win-crt-math-l1-1-0

ceilf sqrtf sinf acosf atan2f cosf _dclass powf roundf fmodf __setusermatherr