fakefmt[.]zip | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
fakefmt.zip
Size 143KB
Sample260910-prgs1stbna
SHA256 0f57ce1b4c2b8dac0d0cb647a0b01f18552ae30bed52e54524e4aafc24b7a4a7
MD5 b164e8f502c75dbff332c73d68f43be8
SHA1 28380c8e412af29df8b51e085637fe97ab591e22
SHA512 6fae6fc3325fcc4816e69929df25b3955c124f6e4178d66ea5b4d06e080f2e8e2e8793a491d6ee8433e713d3bfd3beb2edc0c4912f8cabb2adf86351e81d0af3
SSDEEP 3072:bdrGwPe4T8uN5vacSnBaTdVmkZS/NhMO/HIb4D0ch4ieL+rZX:JrGuSA5ylBGHS/NDfY4thDeSZX
TLSH
T1F6E312F39E906C2BD1BCFBBF031DCC7ADB51919D3A01412B98CA4D652187CB17BA2664
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/fakefmt.exe

File Explorer

fakefmt.zip

.zip 143KB
fakefmt.exe

.exe 289KB
readme.htm

.html 7KB

fakefmt.zip

SHA256 0f57ce1b4c2b8dac0d0cb647a0b01f18552ae30bed52e54524e4aafc24b7a4a7
MD5 b164e8f502c75dbff332c73d68f43be8
SHA1 28380c8e412af29df8b51e085637fe97ab591e22
SHA512 6fae6fc3325fcc4816e69929df25b3955c124f6e4178d66ea5b4d06e080f2e8e2e8793a491d6ee8433e713d3bfd3beb2edc0c4912f8cabb2adf86351e81d0af3
SSDEEP 3072:bdrGwPe4T8uN5vacSnBaTdVmkZS/NhMO/HIb4D0ch4ieL+rZX:JrGuSA5ylBGHS/NDfY4thDeSZX
TLSH
T1F6E312F39E906C2BD1BCFBBF031DCC7ADB51919D3A01412B98CA4D652187CB17BA2664
MD5 SHA1 SHA512 SSDEEP TLSH

fakefmt.exe

SHA256 8163c62e1d9f677afac99cf09de208ec1bacb7719ac6e76da29a7f4a9270cf90
MD5 d52aa91b82a3f66b4d6f6ec94178c68c
SHA1 893a8e175487a46a70e2720a0ed2d1f99eec963f
SHA512 eb48613cf193d3e1ef6d9ebfc4079a00fec684d8868dc5c3caa6eba53a96efde7c41f59272ad4b80cc32b765ad30ee88bcec316f912e133bde8b1ccafe5aae6e
SSDEEP 6144:xp9wmhT60dCLEewKg7FpgzGIDLv7In3daUInEh2w2VKqZw4X0:RwmhTVCTRghpIGIDLDIn34UIrw2VKqZw
TLSH
T170545C36BEDC0972D1722B7CADA7D764993BFD007A28694B67F42C0CCD787413928296
MD5 SHA1 SHA512 SSDEEP TLSH

windows:1 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

220748

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_BYTES_REVERSED_LO IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_BYTES_REVERSED_HI

PDB paths

Name

CODE

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

DATA

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

BSS

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fakefmt.zip

fakefmt.exe

generic

readme.htm