ff0l[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
ff0l.exe
Size 644KB
Sample260905-fa82hatvdx
SHA256 f97e4bbccf539a9d28e24671172f77851e91b59de870d1ab3a677726fab6255d
MD5 f249359f3a6fb7eb5250869b3a0a20b3
SHA1 7d4ead357533bc02394121500f26901804981fdf
SHA512 4a0dd13814a0a528ab31442392d8c6ed11b61b07aea096035089b31d6b11628a50b982f42d5fc905cde936293d28cea240ac1906e250a308d98f3a6e09416774
SSDEEP 12288:+53Nonypn4mv9EEPZH+7yXkcYZvC33exd1R:iNQKnpEExH+yMdi3eVR
TLSH
T1A4E49E16A2A510ECD43BE0B9DB43A903FB32B44607309ECB33EC45561F667D95BBA712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff0l.exe

File Explorer

ff0l.exe

.exe 644KB

ff0l.exe

IMPHASH 85420ab9d637dcc4b4bd92cf6da0fa77
SHA256 f97e4bbccf539a9d28e24671172f77851e91b59de870d1ab3a677726fab6255d
MD5 f249359f3a6fb7eb5250869b3a0a20b3
SHA1 7d4ead357533bc02394121500f26901804981fdf
SHA512 4a0dd13814a0a528ab31442392d8c6ed11b61b07aea096035089b31d6b11628a50b982f42d5fc905cde936293d28cea240ac1906e250a308d98f3a6e09416774
SSDEEP 12288:+53Nonypn4mv9EEPZH+7yXkcYZvC33exd1R:iNQKnpEExH+yMdi3eVR
TLSH
T1A4E49E16A2A510ECD43BE0B9DB43A903FB32B44607309ECB33EC45561F667D95BBA712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

465520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders WinHttpReceiveResponse WinHttpOpenRequest WinHttpSetOption WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSendRequest WinHttpOpen

user32

wsprintfA GetMonitorInfoA MonitorFromPoint SetWindowLongW GetWindowLongW SetLayeredWindowAttributes GetDpiForWindow LoadCursorA SetCursor ReleaseCapture SetCapture GetCapture GetClipboardData ReleaseDC LoadCursorW AdjustWindowRect KillTimer SetTimer SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW DefWindowProcW PeekMessageW MessageBoxW DispatchMessageW GetCursorInfo GetWindow GetWindowThreadProcessId EnumWindows ClipCursor ScreenToClient ClientToScreen GetCursorPos GetClientRect GetSystemMetrics SendInput GetAsyncKeyState EmptyClipboard SetClipboardData CloseClipboard OpenClipboard IsWindowVisible SetWindowDisplayAffinity GetWindowDisplayAffinity IsWindow PostMessageW GetWindowLongPtrW SetWindowLongPtrW GetDC TrackMouseEvent TranslateMessage

gdi32

GetGlyphIndicesW RemoveFontResourceExA CreateCompatibleDC SwapBuffers SetPixelFormat ChoosePixelFormat GetTextMetricsA SelectObject AddFontResourceExA GetGlyphOutlineW DeleteObject DeleteDC CreateFontA

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoTaskMemFree CoCreateFreeThreadedMarshaler

windowscodecs

WICConvertBitmapSource

d2d1

ord1

dwrite

DWriteCreateFactory

dwmapi

DwmExtendFrameIntoClientArea DwmSetWindowAttribute

winmm

timeBeginPeriod timeEndPeriod

api-ms-win-core-processenvironment-l1-1-0

GetEnvironmentStringsW ExpandEnvironmentStringsA GetEnvironmentVariableA FreeEnvironmentStringsW GetCurrentDirectoryA

api-ms-win-core-file-l1-1-0

DeleteFileA GetFileAttributesA CreateFileW WriteFile ReadFile DeleteFileW GetTempFileNameW FindNextFileA FindFirstFileA CreateDirectoryA GetFileSize CreateFileA FindClose

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW Sleep WakeAllConditionVariable

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentThreadId GetExitCodeProcess GetCurrentProcessId

api-ms-win-core-processthreads-l1-1-1

OpenProcess FlushInstructionCache

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetSystemTimeAsFileTime GetTickCount

api-ms-win-core-memory-l1-1-0

VirtualQueryEx VirtualAllocEx VirtualFreeEx VirtualProtectEx ReadProcessMemory WriteProcessMemory

api-ms-win-core-libraryloader-l1-2-0

LoadLibraryExW FreeLibrary GetProcAddress GetModuleHandleW GetModuleFileNameA GetModuleHandleA

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

api-ms-win-core-heap-l2-1-0

GlobalAlloc GlobalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalLock GlobalUnlock

api-ms-win-core-psapi-ansi-l1-1-0

QueryFullProcessImageNameA

api-ms-win-core-toolhelp-l1-1-0

Process32NextW CreateToolhelp32Snapshot Process32FirstW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar WideCharToMultiByte

d3d11

D3D11CreateDevice

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe SetNamedPipeHandleState

ws2_32

WSAStartup

api-ms-win-core-synch-l1-1-0

SetEvent AcquireSRWLockExclusive CreateEventA ReleaseSRWLockExclusive CreateEventW WaitForSingleObject

d3d12

D3D12SerializeRootSignature ord101

dxgi

CreateDXGIFactory1

d3dcompiler_47

D3DCompile

shell32

ShellExecuteA SHGetFolderPathA

opengl32

glPixelStorei glIsEnabled glGetIntegerv glGenTextures glEnable glTexParameteri glDeleteTextures wglDeleteContext glViewport glClearColor glClear wglMakeCurrent glTexSubImage2D glTexImage2D glDisable glBindTexture wglGetProcAddress wglCreateContext

kernel32

Module32FirstW lstrcpynA Module32NextW

msvcp140

?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??7ios_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?flags@ios_base@std@@QEBAHXZ ?width@ios_base@std@@QEBA_JXZ ?width@ios_base@std@@QEAA_J_J@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0_Lockit@std@@QEAA@H@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ??1_Lockit@std@@QEAA@XZ ?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ ?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Mtx_lock _Thrd_detach _Query_perf_frequency _Query_perf_counter ?uncaught_exceptions@std@@YAHXZ ?_Xout_of_range@std@@YAXPEBD@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?id@?$ctype@D@std@@2V0locale@2@A ??Bios_base@std@@QEBA_NXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?_Xinvalid_argument@std@@YAXPEBD@Z _Thrd_id _Thrd_join ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z ?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z ?_Xbad_alloc@std@@YAXXZ

vcruntime140

__std_exception_destroy __std_terminate __std_exception_copy memcpy _CxxThrowException __current_exception_context __current_exception __C_specific_handler memset memmove strstr memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s wcslen _strnicmp iswspace strncmp strlen strcmp strnlen _stricmp strncat_s _wcsicmp strpbrk

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-convert-l1-1-0

strtod atoi _strtoui64 atof

api-ms-win-crt-stdio-l1-1-0

fopen_s __stdio_common_vsprintf_s fflush __p__commode fgetc fgetpos fputc _get_stream_buffer_pointers __stdio_common_vsprintf __stdio_common_vfprintf fputs fread ungetc setvbuf _set_fmode fwrite _fseeki64 fclose fsetpos

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-runtime-l1-1-0

terminate _beginthreadex _c_exit _seh_filter_exe _cexit _register_thread_local_exe_atexit_callback _get_narrow_winmain_command_line _crt_atexit _initterm _initterm_e exit _exit _invalid_parameter_noinfo _errno abort _register_onexit_function _initialize_onexit_table _set_app_type _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

sqrtf cosf __setusermatherr powf sinf ceilf expf fmod

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList InitializeSListHead

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

oleaut32

SysStringLen GetErrorInfo SetErrorInfo SysFreeString

api-ms-win-core-heap-l1-1-0

HeapAlloc GetProcessHeap HeapFree