fo-wsftp605[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fo-wsftp605.exe
Size 1.9MB
Sample260821-wtw42sam21
SHA256 2d19814d33cf0770b925104b91418bf364c78e59b1d94a45a62a5fe6a2c157c1
MD5 2d80c1c3948f95797bbe14e8fc5e2652
SHA1 a4bdd27bb12c7428d0d16e605cc2ed5032becb02
SHA512 6586d54166cbc8a788c20ed841e010a7fa422b1d1e433885396d617ab3c3660818c93c1c88d5f69fde3866ca41c43b85852ea53266da1a1f3f4634c68f388194
SSDEEP 49152:tMCvNprR5Fovc9rZaj6BYA+lCv7GIK/b32mheB:2ClxR5FokraHlCjfKz32mc
TLSH
T17C951221FFB8C260F2B29036AD715764883BBCB0B7335443E694369EDAB368145D1B5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fo-wsftp605.exe

File Explorer

fo-wsftp605.exe

.exe 1.9MB

fo-wsftp605.exe

IMPHASH a8cefc9af31d08a6116276a9b43f53af
SHA256 2d19814d33cf0770b925104b91418bf364c78e59b1d94a45a62a5fe6a2c157c1
MD5 2d80c1c3948f95797bbe14e8fc5e2652
SHA1 a4bdd27bb12c7428d0d16e605cc2ed5032becb02
SHA512 6586d54166cbc8a788c20ed841e010a7fa422b1d1e433885396d617ab3c3660818c93c1c88d5f69fde3866ca41c43b85852ea53266da1a1f3f4634c68f388194
SSDEEP 49152:tMCvNprR5Fovc9rZaj6BYA+lCv7GIK/b32mheB:2ClxR5FokraHlCjfKz32mc
TLSH
T17C951221FFB8C260F2B29036AD715764883BBCB0B7335443E694369EDAB368145D1B5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

lz32

LZClose LZOpenFileA LZCopy

kernel32

GlobalLock GlobalAlloc GlobalFree FindResourceA GetLastError FreeResource LoadResource CreateDirectoryA GetTickCount MoveFileA GetSystemDirectoryA GetVersionExA FormatMessageA GetVersion GetSystemDefaultLangID LocalAlloc WriteFile SizeofResource lstrcmpA lstrcmpiA SetCurrentDirectoryA FindFirstFileA FindNextFileA FindClose GetShortPathNameA lstrcpyA lstrlenA lstrcatA GetProfileStringA GetProfileIntA LocalFree LockResource GlobalUnlock GetTempPathA WinExec GetModuleFileNameA WritePrivateProfileStringA GetPrivateProfileStringA WriteProfileStringA CreateFileA CloseHandle GetCurrentDirectoryA LoadLibraryA GetProcAddress FreeLibrary GetTempFileNameA GetCurrentProcess DeleteFileA GetStringTypeW SetEndOfFile SetFilePointer SetEnvironmentVariableA CompareStringW CompareStringA LCMapStringW GetStringTypeA HeapReAlloc LCMapStringA ReadFile MultiByteToWideChar FlushFileBuffers SetStdHandle HeapCreate GetStdHandle GetFileType SetHandleCount GetOEMCP GetACP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW GetEnvironmentStrings RemoveDirectoryA FreeEnvironmentStringsA UnhandledExceptionFilter RtlUnwind WideCharToMultiByte HeapAlloc TerminateProcess ExitProcess HeapFree GetCommandLineA GetStartupInfoA GetModuleHandleA GetDriveTypeA GetFullPathNameA GetFileAttributesA

user32

IsWindow CheckDlgButton GetDlgItemTextA IsDialogMessageA PostMessageA LoadStringA SetWindowTextA SetDlgItemTextA CheckRadioButton GetDlgItem EnableWindow IsDlgButtonChecked EndDialog PostQuitMessage ShowWindow ValidateRect ReleaseDC GetDC GetClientRect InvalidateRect MessageBoxA EndPaint BeginPaint DefWindowProcA CreateWindowExA DispatchMessageA TranslateMessage PeekMessageA GetWindowRect DdeAccessData DdeUnaccessData SendMessageA DdeUninitialize DdeInitializeA DdeCreateStringHandleA DdeConnect DdeClientTransaction DdeDisconnect DdeFreeStringHandle ExitWindowsEx MoveWindow LoadBitmapA DestroyWindow DialogBoxParamA LoadIconA LoadCursorA RegisterClassA GetDesktopWindow UpdateWindow wsprintfA SetActiveWindow CreateDialogParamA GetMessageA

gdi32

StretchDIBits SelectPalette TextOutA GetTextExtentPoint32A SetBkMode DeleteObject SelectObject CreateFontIndirectA GetTextMetricsA CreatePalette GetStockObject DeleteDC BitBlt GetObjectA CreateCompatibleDC SetBkColor CreateSolidBrush RealizePalette

comdlg32

GetOpenFileNameA

advapi32

RegEnumKeyA OpenProcessToken LookupPrivilegeValueA RegDeleteKeyA RegCloseKey AdjustTokenPrivileges RegOpenKeyExA RegDeleteValueA RegSetValueExA RegCreateKeyA RegQueryValueExA RegOpenKeyA

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1024B

Virtual Size

911B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

14KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fo-wsftp605.exe

lz32

kernel32

user32

gdi32

comdlg32

advapi32

generic