f[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
f.exe
Size 4.6MB
Sample260925-2ve5taydkh
SHA256 cebd6b5b1dd1883584e5cb8ce314ae77297bb534ed7774d61c046826a827b1a2
MD5 c75bf062ad35112a0ef87415d015f312
SHA1 a14e62ca34cf011f9fc6556685fdff9535a8d70d
SHA512 f7776e553cb0a2c0aa8bf3073a38ccc0861071cf931550d83118d9761eafdcb45308c118fb02d9bbe8d9e621a5f47fd84dd4c4fd2b1639d1914c60492968a976
SSDEEP 49152:Q2CuWJT5DhxRpCEb5Z1BEF3lkSvy3+ZwULiqXnDYEJ6pHzuCXyIVKDHnOc+:Q2El515VlZ1BEFvScDYEJ6En
TLSH
T1DE269E22B221E53FC16B1B35993FE766C93DAB202A13894777F41C4C8F36A91792D253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f.exe

File Explorer

f.exe

.exe 4.6MB

f.exe

IMPHASH fe9f572ad62da1bd3ae03d467110f3a9
SHA256 cebd6b5b1dd1883584e5cb8ce314ae77297bb534ed7774d61c046826a827b1a2
MD5 c75bf062ad35112a0ef87415d015f312
SHA1 a14e62ca34cf011f9fc6556685fdff9535a8d70d
SHA512 f7776e553cb0a2c0aa8bf3073a38ccc0861071cf931550d83118d9761eafdcb45308c118fb02d9bbe8d9e621a5f47fd84dd4c4fd2b1639d1914c60492968a976
SSDEEP 49152:Q2CuWJT5DhxRpCEb5Z1BEF3lkSvy3+ZwULiqXnDYEJ6pHzuCXyIVKDHnOc+:Q2El515VlZ1BEFvScDYEJ6En
TLSH
T1DE269E22B221E53FC16B1B35993FE766C93DAB202A13894777F41C4C8F36A91792D253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9804

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

dinput8

DirectInput8Create

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid RegCloseKey RegConnectRegistryW RegCreateKeyExW RegDeleteKeyW RegDeleteValueW RegEnumKeyExW RegEnumValueW RegFlushKey RegLoadKeyW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegReplaceKeyW RegRestoreKeyW RegSaveKeyW RegSetValueExW RegUnLoadKeyW

kernel32

CancelWaitableTimer CloseHandle CompareStringW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection EnumCalendarInfoW EnumResourceNamesW EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileW FindNextFileW FindResourceW FormatMessageW FreeEnvironmentStringsA FreeEnvironmentStringsW FreeLibrary FreeResource GetACP GetCPInfo GetCPInfoExW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStrings GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeThread GetFileAttributesA GetFileAttributesW GetFileSize GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoA GetLocaleInfoW GetLogicalDriveStringsW GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoA GetStartupInfoW GetStdHandle GetStringTypeA GetStringTypeW GetSystemDefaultLangID GetSystemDefaultUILanguage GetSystemInfo GetSystemTimeAsFileTime GetThreadLocale GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultUILanguage GetVersion GetVersionExA GetVersionExW GetVolumeInformationW GlobalAddAtomW GlobalAlloc GlobalDeleteAtom GlobalFindAtomW GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent IsValidLocale LCMapStringA LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LoadResource LocalAlloc LocalFree LockResource MapViewOfFile MoveFileW MulDiv MultiByteToWideChar OpenMutexW OpenProcess QueryDosDeviceW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlUnwind SetConsoleCtrlHandler SetCurrentDirectoryW SetEndOfFile SetErrorMode SetEvent SetFileAttributesW SetFilePointer SetHandleCount SetLastError SetThreadLocale SetThreadPriority SetWaitableTimer SizeofResource Sleep SuspendThread SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualQuery VirtualQueryEx WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile lstrcmpW lstrlenW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winspool.drv

ClosePrinter DocumentPropertiesW EnumPrintersW ord203 OpenPrinterW

comctl32

FlatSB_GetScrollInfo FlatSB_GetScrollPos FlatSB_SetScrollInfo FlatSB_SetScrollPos FlatSB_SetScrollProp ImageList_Add ImageList_BeginDrag ImageList_Copy ImageList_Create ImageList_Destroy ImageList_DragEnter ImageList_DragLeave ImageList_DragMove ImageList_DragShowNolock ImageList_Draw ImageList_DrawEx ImageList_DrawIndirect ImageList_EndDrag ImageList_GetBkColor ImageList_GetDragImage ImageList_GetIcon ImageList_GetIconSize ImageList_GetImageCount ImageList_GetImageInfo ImageList_LoadImageW ImageList_Read ImageList_Remove ImageList_Replace ImageList_ReplaceIcon ImageList_SetBkColor ImageList_SetIconSize ImageList_SetImageCount ImageList_SetOverlayImage ImageList_Write ord17 InitializeFlatSB _TrackMouseEvent

comdlg32

FindTextW GetOpenFileNameW

gdi32

AbortDoc AngleArc Arc ArcTo BitBlt Chord CombineRgn CopyEnhMetaFileW CreateBitmap CreateBrushIndirect CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateDIBitmap CreateFontIndirectW CreateHalftonePalette CreateICW CreatePalette CreatePenIndirect CreateRectRgn CreateRoundRectRgn CreateSolidBrush DeleteDC DeleteEnhMetaFile DeleteObject Ellipse EndDoc EndPage EnumFontFamiliesExW EnumFontsW ExcludeClipRect ExtCreatePen ExtCreateRegion ExtFloodFill ExtTextOutW FrameRgn GdiFlush GetBitmapBits GetBkMode GetBrushOrgEx GetClipBox GetCurrentObject GetCurrentPositionEx GetDIBColorTable GetDIBits GetDeviceCaps GetEnhMetaFileBits GetEnhMetaFileDescriptionW GetEnhMetaFileHeader GetEnhMetaFilePaletteEntries GetNearestPaletteIndex GetObjectW GetPaletteEntries GetPixel GetRgnBox GetStockObject GetStretchBltMode GetSystemPaletteEntries GetTextColor GetTextExtentPoint32W GetTextExtentPointW GetTextMetricsW GetViewportOrgEx GetWinMetaFileBits GetWindowOrgEx IntersectClipRect LineTo MaskBlt MoveToEx PatBlt Pie PlayEnhMetaFile PolyBezier PolyBezierTo PolyPolyline Polygon Polyline RealizePalette RectVisible Rectangle ResizePalette RestoreDC RoundRect SaveDC SelectClipRgn SelectObject SelectPalette SetAbortProc SetBkColor SetBkMode SetBrushOrgEx SetDCPenColor SetDIBColorTable SetDIBits SetEnhMetaFileBits SetGraphicsMode SetMapMode SetPixel SetROP2 SetRectRgn SetStretchBltMode SetTextColor SetViewportExtEx SetViewportOrgEx SetWinMetaFileBits SetWindowExtEx SetWindowOrgEx SetWorldTransform StartDocW StartPage StretchBlt StretchDIBits UnrealizeObject

shell32

SHAppBarMessage SHGetFolderPathW ShellExecuteW Shell_NotifyIconW

user32

ActivateKeyboardLayout AdjustWindowRectEx BeginDeferWindowPos BeginPaint BringWindowToTop CallNextHookEx CallWindowProcW CharLowerBuffW CharLowerW CharNextW CharUpperBuffW CharUpperW CheckMenuItem ChildWindowFromPoint ClientToScreen CloseClipboard CopyIcon CopyImage CountClipboardFormats CreateAcceleratorTableW CreateCaret CreateIcon CreateIconIndirect CreateMenu CreatePopupMenu CreateWindowExW DefFrameProcW DefMDIChildProcW DefWindowProcW DeferWindowPos DeleteMenu DestroyCaret DestroyCursor DestroyIcon DestroyMenu DestroyWindow DispatchMessageA DispatchMessageW DrawEdge DrawFocusRect DrawFrameControl DrawIcon DrawIconEx DrawMenuBar DrawTextExW DrawTextW EmptyClipboard EnableMenuItem EnableScrollBar EnableWindow EndDeferWindowPos EndMenu EndPaint EnumChildWindows EnumClipboardFormats EnumDisplayMonitors EnumThreadWindows EnumWindows FillRect FindWindowExW FindWindowW FrameRect GetActiveWindow GetCapture GetCaretPos GetClassInfoExW GetClassInfoW GetClassLongW GetClassNameW GetClientRect GetClipboardData GetComboBoxInfo GetCursor GetCursorPos GetDC GetDCEx GetDesktopWindow GetDlgCtrlID GetDlgItem GetDoubleClickTime GetFocus GetForegroundWindow GetIconInfo GetKeyNameTextW GetKeyState GetKeyboardLayout GetKeyboardLayoutList GetKeyboardLayoutNameW GetKeyboardState GetLastActivePopup GetMenu GetMenuItemCount GetMenuItemID GetMenuItemInfoW GetMenuItemRect GetMenuState GetMenuStringW GetMessageExtraInfo GetMessagePos GetMessageTime GetMonitorInfoW GetParent GetPropW GetRawInputData GetRawInputDeviceInfoW GetRawInputDeviceList GetScrollBarInfo GetScrollInfo GetScrollPos GetScrollRange GetSubMenu GetSysColor GetSysColorBrush GetSystemMenu GetSystemMetrics GetTopWindow GetUpdateRect GetWindow GetWindowDC GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW GetWindowThreadProcessId HideCaret InflateRect InsertMenuItemW InsertMenuW InvalidateRect IsCharAlphaNumericW IsCharAlphaW IsChild IsClipboardFormatAvailable IsDialogMessageA IsDialogMessageW IsIconic IsRectEmpty IsWindow IsWindowEnabled IsWindowUnicode IsWindowVisible IsZoomed KillTimer LoadBitmapW LoadCursorW LoadIconW LoadKeyboardLayoutW LoadStringW LockWindowUpdate MapVirtualKeyW MapWindowPoints MessageBeep MessageBoxW MonitorFromPoint MonitorFromRect MonitorFromWindow MoveWindow MsgWaitForMultipleObjects MsgWaitForMultipleObjectsEx OffsetRect OpenClipboard PeekMessageA PeekMessageW PostMessageW PostQuitMessage PtInRect RedrawWindow RegisterClassW RegisterClipboardFormatW RegisterRawInputDevices RegisterWindowMessageW ReleaseCapture ReleaseDC RemoveMenu RemovePropW ScreenToClient ScrollWindow ScrollWindowEx SendInput SendMessageA SendMessageW SetActiveWindow SetCapture SetCaretPos SetClassLongW SetClipboardData SetCursor SetCursorPos SetFocus SetForegroundWindow SetKeyboardState SetMenu SetMenuItemInfoW SetParent SetPropW SetRect SetScrollInfo SetScrollPos SetScrollRange SetTimer SetWinEventHook SetWindowLongW SetWindowPlacement SetWindowPos SetWindowRgn SetWindowTextW SetWindowsHookExW ShowCaret ShowOwnedPopups ShowScrollBar ShowWindow SystemParametersInfoW TrackMouseEvent TrackPopupMenu TranslateMDISysAccel TranslateMessage UnhookWinEvent UnhookWindowsHookEx UnregisterClassW UpdateWindow ValidateRect WaitMessage WindowFromPoint keybd_event mouse_event wsprintfA wsprintfW

winmm

mciSendStringW timeGetTime

ole32

CoCreateInstance CoInitialize CoInitializeEx CoInitializeSecurity CoTaskMemAlloc CoTaskMemFree CoUninitialize IsEqualGUID OleInitialize OleUninitialize

oleaut32

GetErrorInfo SafeArrayAccessData SafeArrayCreate SafeArrayGetElement SafeArrayGetLBound SafeArrayGetUBound SafeArrayPtrOfIndex SafeArrayPutElement SafeArrayUnaccessData SysAllocString SysAllocStringLen SysFreeString SysReAllocStringLen VariantChangeType VariantClear VariantCopy VariantInit

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

@$xp$10TImageForm @$xp$13TAssignDialog @$xp$13TDeviceConfig @$xp$13TWizardDialog @$xp$14TAppLinkDialog @$xp$15TDeviceTemplate @$xp$15TGreetingDialog @$xp$16TInputNameDialog @$xp$16TVibrationDialog @$xp$17TAppCaptureDialog @$xp$17TLicenseKeyDialog @$xp$17TPreferenceDialog @$xp$18TAppLinkItemDialog @$xp$18TButtonAliasDialog @$xp$19TDeviceConfigDialog @$xp$21TDeviceTemplateDialog @$xp$9TAboutBox @$xp$9TMainForm @@Appcapturedlg@Finalize @@Appcapturedlg@Initialize @@Appinfo@Finalize @@Appinfo@Initialize @@Applinkdlg@Finalize @@Applinkdlg@Initialize @@Applinkitemdlg@Finalize @@Applinkitemdlg@Initialize @@Applinkmanager@Finalize @@Applinkmanager@Initialize @@Assigndlg@Finalize @@Assigndlg@Initialize @@Buttonaliasdlg@Finalize @@Buttonaliasdlg@Initialize @@Configfilemanager@Finalize @@Configfilemanager@Initialize @@Deviceconfig@Finalize @@Deviceconfig@Initialize @@Deviceconfigdlg@Finalize @@Deviceconfigdlg@Initialize @@Deviceconfigmanager@Finalize @@Deviceconfigmanager@Initialize @@Devicetemplate@Finalize @@Devicetemplate@Initialize @@Devicetemplatedlg@Finalize @@Devicetemplatedlg@Initialize @@Devicetemplatemanager@Finalize @@Devicetemplatemanager@Initialize @@Eventimpl@Finalize @@Eventimpl@Initialize @@Greetingdlg@Finalize @@Greetingdlg@Initialize @@Imagefrm@Finalize @@Imagefrm@Initialize @@Joybutton@Finalize @@Joybutton@Initialize @@Licensekeydlg@Finalize @@Licensekeydlg@Initialize @@Main@Finalize @@Main@Initialize @@Namedlg@Finalize @@Namedlg@Initialize @@Preferencedlg@Finalize @@Preferencedlg@Initialize @@Processing@Finalize @@Processing@Initialize @@Utils@Finalize @@Utils@Initialize @@Vibrationdlg@Finalize @@Vibrationdlg@Initialize @@Wzrddlg@Finalize @@Wzrddlg@Initialize _AboutBox _AppCaptureDialog _AppLinkDialog _AppLinkItemDialog _AssignDialog _ButtonAliasDialog _DeviceTemplateDialog _GreetingDialog _ImageForm _InputNameDialog _LicenseKeyDialog _MainForm _PreferenceDialog _VibrationDialog _WizardDialog ___CPPdebugHook ___setRaiseListFuncAddr __dbk_fcall_wrapper dbkFCallWrapperAddr

Name

.text

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

152KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

273KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

314KB

Virtual Size

316KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f.exe

dinput8

advapi32

kernel32

version

winspool.drv

comctl32

comdlg32

gdi32

shell32

user32

winmm

ole32

oleaut32

wtsapi32

generic