froeiyspopup[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
froeiyspopup.exe
Size 957KB
Sample260929-xfla3adc76
SHA256 d99b30afd89faa15241b6dd71341d61679cbfc3d3f60b23bb5fa061061351ae2
MD5 0c6146279b147914b8a5da2c43a57c0e
SHA1 68e008d59b603da508635e8f715ab025cbe73262
SHA512 269a23b0e5ab217bdcf36fbc19a9f88efb07a839e1308c321860e49442b3c357bc4565d8fa8ce9424842f82d2f96cbada246aeac5383043974570451ece20e63
SSDEEP 12288:IZLXB4GvCa1CmL2iySM38ul6KAiIoQ7cBAr+Nl++jQP:I7+9a1CK2ifiK7cJBjC
TLSH
T1EE25B546EBCFF33BEB0F0771810A71D0AA16AD402B151D928FB493994B35560DB7CEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
froeiyspopup.exe

File Explorer

froeiyspopup.exe

.exe 957KB

froeiyspopup.exe

IMPHASH d8af15754a897f58169ffeb739b13166
SHA256 d99b30afd89faa15241b6dd71341d61679cbfc3d3f60b23bb5fa061061351ae2
MD5 0c6146279b147914b8a5da2c43a57c0e
SHA1 68e008d59b603da508635e8f715ab025cbe73262
SHA512 269a23b0e5ab217bdcf36fbc19a9f88efb07a839e1308c321860e49442b3c357bc4565d8fa8ce9424842f82d2f96cbada246aeac5383043974570451ece20e63
SSDEEP 12288:IZLXB4GvCa1CmL2iySM38ul6KAiIoQ7cBAr+Nl++jQP:I7+9a1CK2ifiK7cJBjC
TLSH
T1EE25B546EBCFF33BEB0F0771810A71D0AA16AD402B151D928FB493994B35560DB7CEA9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

wintrust

WinVerifyTrust

comctl32

InitCommonControlsEx

gdi32

GetStockObject

user32

CreateWindowExW DefWindowProcW DispatchMessageW EnableWindow EnumWindows GetClassNameW GetClientRect GetDlgItem GetMessageW GetWindowTextW GetWindowThreadProcessId IsWindowVisible LoadCursorW LoadIconW MessageBoxW MoveWindow PostMessageW PostQuitMessage RegisterClassExW SendMessageW SetWindowTextW ShowWindow TranslateMessage UpdateWindow

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vswprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsicmp _wcsnicmp strlen strncmp wcslen wcsncat

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy wcsrchr wcsstr

advapi32

ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService GetTokenInformation OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus QueryServiceStatusEx StartServiceW

kernel32

CloseHandle CreateDirectoryW CreateFileW CreateThread DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW GetCurrentProcess GetEnvironmentVariableW GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetStartupInfoW GetTempPathW InitializeCriticalSection LeaveCriticalSection LoadResource LockResource OpenProcess OutputDebugStringW QueryFullProcessImageNameW ReadFile SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualProtect VirtualQuery WaitForSingleObject WriteFile lstrcpynW

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

872B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

408B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

839KB

Virtual Size

839KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

136B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

512B

Virtual Size

432B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

19KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

froeiyspopup.exe

bcrypt

wintrust

comctl32

gdi32

user32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

advapi32

kernel32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic