secondfast[.]exe | Triage™

General

Target
secondfast.exe
Size 627KB
Sample260913-wftrrsttex
SHA256 55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f
MD5 68d9d1fafb5beeeda1e47ba880142c6a
SHA1 02931ea9da3100f3383a78c4276d76fc3e034907
SHA512 6d8c95c947cabd61833cb1dc96c9a7af755008e0d24f1c8f253ac6645a8938cc175c64d106fc40a5f24d9bbd083d2c6fb87ae6b286c74803055483c374dff048
SSDEEP 12288:WPHg8MRvqNI2MyfLeA1Vt6EvTiLk2p83LEIbXmesXP8dNxR8FF4:WP1siNIFy5Vt6EvT12yb5bXTUFF4
TLSH
T168D4F17271D127F8E87FE4378D990605CBFA79710B2041FB42A42A560E37AED6E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
secondfast.exe

File Explorer

secondfast.exe

.exe 627KB

secondfast.exe

IMPHASH 3da0ac26c28ed95d9554b0350c2df1a2
SHA256 55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f
MD5 68d9d1fafb5beeeda1e47ba880142c6a
SHA1 02931ea9da3100f3383a78c4276d76fc3e034907
SHA512 6d8c95c947cabd61833cb1dc96c9a7af755008e0d24f1c8f253ac6645a8938cc175c64d106fc40a5f24d9bbd083d2c6fb87ae6b286c74803055483c374dff048
SSDEEP 12288:WPHg8MRvqNI2MyfLeA1Vt6EvTiLk2p83LEIbXmesXP8dNxR8FF4:WP1siNIFy5Vt6EvT12yb5bXTUFF4
TLSH
T168D4F17271D127F8E87FE4378D990605CBFA79710B2041FB42A42A560E37AED6E39B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gynuiavengs.pdb

kernel32

WriteConsoleW HeapFree GetProcessHeap GetTempPathW GetCurrentDirectoryW GetModuleHandleA GetModuleHandleW GetWindowsDirectoryW GetSystemDirectoryW TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode ReleaseSRWLockExclusive CloseHandle GetProcAddress SetLastError MultiByteToWideChar GetCurrentThread GetCommandLineW GetConsoleOutputCP GetConsoleCP GetMaximumProcessorCount IsProcessorFeaturePresent GetActiveProcessorGroupCount GetConsoleWindow GetFileType GetActiveProcessorCount GetCurrentProcessorNumber HeapAlloc SetFileInformationByHandle GetLastError GetCurrentProcessId WaitForSingleObject GetCurrentProcess GetCurrentThreadId SetFilePointerEx GetFileInformationByHandle GetFileInformationByHandleEx FlushFileBuffers HeapSize CreateFileW SetFileTime GetFullPathNameW LoadLibraryA HeapReAlloc LCMapStringW CompareStringW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect WriteFile

ntdll

RtlGetVersion RtlNtStatusToDosError NtReadFile NtWriteFile

user32

GetMessageExtraInfo GetDesktopWindow GetShellWindow GetForegroundWindow GetFocus GetActiveWindow

Sharing