secondfast[.]exe | Triage™

General

Target
secondfast.exe
Size 539KB
Sample260903-vdhfaack8t
SHA256 1c852cc5ab0847f57908869ad14b2c1385bec46a8377f67b779aada5a5d59dc0
MD5 1c17489d4bf43f077ba749f2d8b3077d
SHA1 53463b42aeab2ea25d9b3ff639d3fef0323aa1c3
SHA512 c56fde611b56dea2f60cdf1b62e55e7c7ee241e93dec9e2d10dfa2a2866e2d7a884610daeb41287c15e65de9a3bad490dfb42767ac03854ebb1f9479eb748bc6
SSDEEP 6144:oSZgV/h/3pFiPAHRzb3fV6PmHbksHvIxzdS+u+N08Z3oe44AagjJFosZZbrjJwq0:1WhXvHh3dbVHXnAi4Avjro6bnJwu
TLSH
T161C4F117BBD805FEC056C37E99950531A6B2B8121BA497EF47A402170F6BBD06FBEB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
secondfast.exe

File Explorer

secondfast.exe

.exe 539KB

secondfast.exe

IMPHASH 5bba269219581ca7e7f1399fefe94ece
SHA256 1c852cc5ab0847f57908869ad14b2c1385bec46a8377f67b779aada5a5d59dc0
MD5 1c17489d4bf43f077ba749f2d8b3077d
SHA1 53463b42aeab2ea25d9b3ff639d3fef0323aa1c3
SHA512 c56fde611b56dea2f60cdf1b62e55e7c7ee241e93dec9e2d10dfa2a2866e2d7a884610daeb41287c15e65de9a3bad490dfb42767ac03854ebb1f9479eb748bc6
SSDEEP 6144:oSZgV/h/3pFiPAHRzb3fV6PmHbksHvIxzdS+u+N08Z3oe44AagjJFosZZbrjJwq0:1WhXvHh3dbVHXnAi4Avjro6bnJwu
TLSH
T161C4F117BBD805FEC056C37E99950531A6B2B8121BA497EF47A402170F6BBD06FBEB10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

49072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

scheauwugh.pdb

kernel32

LoadLibraryA GetProcessHeap HeapFree GetProcAddress MultiByteToWideChar SetFileInformationByHandle GetLastError GetModuleHandleA SetFileTime CloseHandle SetLastError GetFullPathNameW HeapReAlloc HeapSize GetFileInformationByHandle GetFileInformationByHandleEx CreateFileW GetActiveProcessorCount GetActiveProcessorGroupCount GetSystemDirectoryW GetSystemWindowsDirectoryW IsProcessorFeaturePresent GetCurrentProcessorNumber GetLogicalDriveStringsW GetDriveTypeW GetUserDefaultLangID GetSystemDefaultLangID GetUserDefaultLCID GetSystemDefaultUILanguage GetCurrentThread WriteConsoleW HeapAlloc GetCPInfo IsDBCSLeadByte TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive WaitForSingleObject SetFilePointerEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW FlushFileBuffers GetConsoleOutputCP WriteFile

ntdll

NtWriteFile RtlGetVersion RtlNtStatusToDosError NtReadFile

Sharing