FireResolve-windows.zip
- SHA256 2cbedeb694178a3f6d22cd16f47f4472148a0be1904e56eee2d3605b99f638df
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FireResolve/FireResolve.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
FireResolve/FireResolve.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target FireResolve-windows.zip
- Size 2.7MB
- Sample260930-na7gnssepg
- SHA256 2cbedeb694178a3f6d22cd16f47f4472148a0be1904e56eee2d3605b99f638df
- MD5 a89d29e91cec40c4c6d7740c6889156c
- SHA1 87527123285cfaf4f14d0ebd676b11ff5dbf621c
- SHA512 63abf3738f7b7f2abcc431d09142313fde59a78096abda66041dfb78b091a798634ff490d0cf1e1718a2d7d7798d9ba4a8b1f33ed7c363728aa0b23a8e571923
- SSDEEP 49152:si5IyewxY42RepWTCTZUuJIcAUwCEI4hzzDou5pV5OQ1ezrdjH6pZ9PPnccbV:RvPpW+NUvRUwDAuTV1K6nPR
- TLSH T1C3D533D84B1273A94BA34FFC3B84935C80F5256A8F190B537AF46E6FC226C950E9784D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/FireResolve/FireResolve.exe
File Explorer
-
FireResolve-windows.zip.zip 2.7MB
-
FireResolve/FireResolve.exe.exe 5.7MB
-
FireResolve/LEGGIMI-README.txt1KB
FireResolve/FireResolve.exe
- IMPHASH 5f8f665186380a9652c1483a7042f497
- SHA256 76b2e6d5ffb34e1f7b9c16e84b675e900d23ddc975ad9fd845ac0e9008961bcc
- MD5 5af9302bedd9b44f5777c2e56c7aa8d2
- SHA1 08a6a2256be35781af360fbe46467a1c4d666189
- SHA512 2053af819d9ae39f42c61891f9d189490bf042cd968ff3842efd2c4821574489c1e785966fdf5d1efa7c6d0fa45ef75ce7efa43fae597467bb763378a9485aaa
- SSDEEP 49152:bZPKFYXbZqSCdCMzSRZqFkfIknyfv9dS8T5HedUH8oG68x8Cq368AO3G2hwU1i8D:b9K3SCdynsaM/wU1i8WdEUzA0tb1
- TLSH T14F569F87E2E2C2FFD14EC5706153B133E523B446062DB26B7BC55F106E91FA08B4A76A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
5152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
advapi32
ImpersonateAnonymousToken
RevertToSelf
RegGetValueW
gdi32
ChoosePixelFormat
CreateBitmap
CreateCompatibleBitmap
CreateRectRgn
DeleteObject
DescribePixelFormat
GetDeviceCaps
SetBitmapBits
SetPixelFormat
SwapBuffers
kernel32
AddVectoredExceptionHandler
CancelIo
CompareStringOrdinal
CreateDirectoryW
CreateEventW
CreateFileMappingA
CreateFileW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
CreateWaitableTimerExW
DeleteCriticalSection
EnterCriticalSection
FindClose
FindFirstFileExW
FormatMessageW
FreeEnvironmentStringsW
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileInformationByHandle
GetFileInformationByHandleEx
GetFullPathNameW
GetModuleHandleW
GetOverlappedResult
GetProcessHeap
GetStdHandle
GetUserPreferredUILanguages
GlobalAlloc
GlobalLock
GlobalSize
GlobalUnlock
HeapAlloc
HeapFree
HeapReAlloc
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
Module32FirstW
Module32NextW
MoveFileExW
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReadFileEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetFileInformationByHandle
SetFileTime
SetUnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteConsoleW
WriteFileEx
__C_specific_handler
FreeLibrary
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetProcAddress
LoadLibraryExW
SetThreadErrorMode
GetModuleHandleA
CloseHandle
DuplicateHandle
ExitProcess
FlsAlloc
FlsFree
FlsSetValue
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDynamicTimeZoneInformation
GetExitCodeProcess
GetLocalTime
GetSystemDirectoryW
GetSystemTimePreciseAsFileTime
GetWindowsDirectoryW
GlobalFree
InitOnceBeginInitialize
InitOnceComplete
IsThreadAFiber
SetHandleInformation
SetLastError
SetThreadStackGuarantee
SetWaitableTimer
Sleep
SleepEx
SwitchToThread
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
WaitForMultipleObjects
WaitForSingleObject
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-heap-l1-1-0
_set_new_mode
calloc
free
malloc
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-math-l1-1-0
__setusermatherr
_hypot
acosf
atan2
atan2f
cbrt
cbrtf
ceil
ceilf
cos
cosf
exp2f
expf
floor
floorf
fma
fmod
hypot
log
log2
pow
powf
round
roundf
sin
sinf
tan
tanf
trunc
truncf
api-ms-win-crt-private-l1-1-0
memcmp
memcpy
memmove
api-ms-win-crt-runtime-l1-1-0
__p___argc
__p___argv
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_fpreset
_initialize_narrow_environment
_initterm
_initterm_e
_set_app_type
_set_invalid_parameter_handler
abort
exit
signal
strerror
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__p__commode
__p__fmode
__stdio_common_vfprintf
fflush
setvbuf
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
ntdll
NtCreateNamedPipeFile
NtOpenFile
NtReadFile
NtWriteFile
RtlNtStatusToDosError
opengl32
wglCreateContext
wglDeleteContext
wglGetCurrentContext
wglGetCurrentDC
wglGetProcAddress
wglMakeCurrent
wglShareLists
user32
ChangeDisplaySettingsExW
ClientToScreen
CloseClipboard
CloseTouchInputHandle
CreateIconIndirect
EmptyClipboard
EnumDisplayMonitors
GetClassInfoExW
GetClipboardData
GetDC
GetMonitorInfoW
GetTouchInputInfo
InvalidateRgn
IsClipboardFormatAvailable
MonitorFromPoint
MonitorFromRect
MonitorFromWindow
OpenClipboard
RedrawWindow
RegisterClassExW
RegisterClipboardFormatW
RegisterTouchWindow
ReleaseDC
ScreenToClient
SetClipboardData
ValidateRect
AdjustWindowRectEx
ClipCursor
CreateIcon
CreateIconFromResourceEx
CreateWindowExW
DefWindowProcW
DestroyCursor
DestroyIcon
DestroyWindow
DispatchMessageW
EnableMenuItem
FlashWindowEx
GetActiveWindow
GetAsyncKeyState
GetClassNameW
GetClientRect
GetClipCursor
GetCursorPos
GetForegroundWindow
GetKeyState
GetKeyboardLayout
GetKeyboardState
GetMenu
GetRawInputData
GetSystemMenu
GetSystemMetrics
GetWindowLongPtrW
GetWindowLongW
GetWindowPlacement
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
IsIconic
IsProcessDPIAware
IsWindowVisible
LoadCursorW
MapVirtualKeyExW
MapVirtualKeyW
MsgWaitForMultipleObjectsEx
PeekMessageW
PostMessageW
RegisterRawInputDevices
RegisterWindowMessageA
ReleaseCapture
SendInput
SendMessageW
SetCapture
SetCursor
SetCursorPos
SetForegroundWindow
SetWindowDisplayAffinity
SetWindowLongPtrW
SetWindowLongW
SetWindowPlacement
SetWindowPos
SetWindowTextW
ShowCursor
ShowWindow
SystemParametersInfoA
ToUnicodeEx
TrackMouseEvent
TranslateMessage
dwmapi
DwmEnableBlurBehindWindow
DwmSetWindowAttribute
imm32
ImmAssociateContextEx
ImmGetCompositionStringW
ImmGetContext
ImmReleaseContext
ImmSetCandidateWindow
ImmSetCompositionWindow
ole32
OleInitialize
RegisterDragDrop
RevokeDragDrop
CoCreateInstance
CoInitializeEx
CoUninitialize
uxtheme
SetWindowTheme
bcryptprimitives
ProcessPrng
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
iphlpapi
GetAdaptersAddresses
GetBestInterface
shell32
DragFinish
DragQueryFileW
ShellExecuteExW
ws2_32
WSACleanup
WSAGetLastError
WSASocketW
WSAStartup
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getsockopt
ioctlsocket
recv
select
send
setsockopt
Name
.text
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
1.9MB
Virtual Size
1.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
61KB
Virtual Size
61KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
91KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
832B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
61KB
Virtual Size
60KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
FireResolve/LEGGIMI-README.txt
- SHA256 690771de227165d8d1ee6529b0165d7a9f7ea1c14a1b022cb5b12425aff66833
- MD5 41f6534c3efb36eaf7472ed37d6ea9d5
- SHA1 fdd52710f0d44ecf1fe844f10b9a44467591a4d0
- SHA512 06761ff02034df17e3abf8f0dc9786509511bee1f9fbf22f45c177eab76f1804ab3708936c065237676304239a0ec7d257238ea8d53fc07e57beeb0d02842011
- TLSH T12F213351FDE1154826B0671A414F73E5E72FE950F50711172F198347972A7B0D37EAC1
- MD5 SHA1 SHA512 TLSH