future or something[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
future or something.exe
Size 21.4MB
Sample260930-xcedcazajb
SHA256 28a3d4c2ccd26d1967794b39732cbd3452f8d09f23628fbe2fe3df356cf1b743
MD5 8e94b90454e2274cab4f9b11a62b36fc
SHA1 9bb5b5abdef3cfb0caf6dea13df5326062ce6d10
SHA512 b14a740808b3a8821f7438b97a400dfaf06168bd4c5cb433ad3975b69a9e3febeb1c775600f0359dff98f7abc19a7110ef880df638dee40deb9596b9b1fa82cc
SSDEEP 98304:PiA4F58LSkvitFL4G4AAKrACKFLcIoUUUUUU4RUUUUUUUUUzNKmu5QZmtTYpa6cK:PitFmSIkFL4Gzr+/8DSZ8Ma
TLSH
T1F937F142B3DC45DEDF26A97889529A03C3A6FC08176103F7BB8F496A457BDE00B7DA41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
future or something.exe

File Explorer

future or something.exe

.exe 21.4MB

future or something.exe

IMPHASH dadf28404af5128727bd9d85fddc0631
SHA256 28a3d4c2ccd26d1967794b39732cbd3452f8d09f23628fbe2fe3df356cf1b743
MD5 8e94b90454e2274cab4f9b11a62b36fc
SHA1 9bb5b5abdef3cfb0caf6dea13df5326062ce6d10
SHA512 b14a740808b3a8821f7438b97a400dfaf06168bd4c5cb433ad3975b69a9e3febeb1c775600f0359dff98f7abc19a7110ef880df638dee40deb9596b9b1fa82cc
SSDEEP 98304:PiA4F58LSkvitFL4G4AAKrACKFLcIoUUUUUU4RUUUUUUUUUzNKmu5QZmtTYpa6cK:PitFmSIkFL4Gzr+/8DSZ8Ma
TLSH
T1F937F142B3DC45DEDF26A97889529A03C3A6FC08176103F7BB8F496A457BDE00B7DA41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2358496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

c:\Users\larry\Downloads\booted-off-gelato-master\booted-off-gelato-master\bin\gelato.pdb

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency QueryPerformanceCounter

api-ms-win-core-toolhelp-l1-1-0

CreateToolhelp32Snapshot

api-ms-win-core-kernel32-legacy-l1-1-2

Process32First Process32Next

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId GetProcessId SetThreadPriority GetCurrentThread GetCurrentProcess TerminateProcess GetCurrentThreadId

api-ms-win-core-processthreads-l1-1-1

FlushInstructionCache OpenProcess

api-ms-win-core-memory-l1-1-0

VirtualProtectEx VirtualQueryEx ReadProcessMemory VirtualFreeEx VirtualAllocEx

api-ms-win-core-console-l1-1-0

AllocConsole GetConsoleMode SetConsoleMode SetConsoleCtrlHandler

api-ms-win-core-console-l2-2-0

SetConsoleTitleA

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle GetCurrentDirectoryW

api-ms-win-core-synch-l1-2-0

Sleep InitOnceBeginInitialize InitOnceComplete WakeAllConditionVariable SleepConditionVariableSRW

api-ms-win-core-console-l1-2-0

FreeConsole

api-ms-win-core-synch-l1-1-0

CreateEventW WaitForSingleObject AcquireSRWLockShared AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive SetEvent

api-ms-win-ntuser-sysparams-l1-1-0

GetSystemMetrics GetMonitorInfoW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW GetModuleFileNameW FreeLibrary GetModuleHandleA LoadLibraryExW GetProcAddress

d3dcompiler_47

D3DCompile

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime GetSystemInfo GetTickCount64

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA

oleaut32

GetErrorInfo SysStringLen VariantClear VariantInit SysFreeString SysAllocString SetErrorInfo

api-ms-win-core-com-l1-1-0

CoCreateGuid CoTaskMemFree CoInitializeEx CoCreateInstance CoCreateFreeThreadedMarshaler CoSetProxyBlanket CoUninitialize

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-registry-l1-1-0

RegOpenKeyExA RegQueryValueExA RegCloseKey

winhttp

WinHttpOpen WinHttpConnect WinHttpCrackUrl WinHttpCloseHandle WinHttpOpenRequest WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpReadData WinHttpSetOption WinHttpAddRequestHeaders WinHttpQueryHeaders

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-file-l1-1-0

ReadFile CreateDirectoryW FindClose GetFileAttributesExW GetFinalPathNameByHandleW FindNextFileW FindFirstFileW SetFileInformationByHandle GetFileSize CreateFileW FindFirstFileExW

api-ms-win-core-heap-l2-1-0

GlobalAlloc LocalFree

api-ms-win-core-heap-obsolete-l1-1-0

GlobalUnlock GlobalLock

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

kernel32

Module32FirstW Module32Next Module32First Module32NextW

user32

SetProcessDPIAware IsWindowUnicode ReleaseCapture GetClipboardData CloseClipboard SetClipboardData EmptyClipboard OpenClipboard SetCursorPos SendInput DispatchMessageA TranslateMessage PeekMessageA EnumDisplaySettingsW MonitorFromWindow GetDesktopWindow SetWindowDisplayAffinity UnregisterClassA DestroyWindow UpdateWindow GetWindowRect SetLayeredWindowAttributes CreateWindowExA RegisterClassExA ClientToScreen ShowWindow IsIconic SetFocus BringWindowToTop SetForegroundWindow AttachThreadInput GetForegroundWindow SetCursor SetWindowLongPtrA GetWindowLongPtrA DefWindowProcA PostQuitMessage GetClientRect ScreenToClient GetCursorPos EnumWindows IsWindow GetClassNameA IsWindowVisible GetWindowThreadProcessId GetAsyncKeyState GetKeyNameTextA MapVirtualKeyA GetKeyState GetMessageExtraInfo LoadCursorA GetCapture TrackMouseEvent SetCapture SetWindowPos

shell32

ShellExecuteA SHGetKnownFolderPath

msvcp140

?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ?eof@ios_base@std@@QEBA_NXZ ?_Random_device@std@@YAIXZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1_Locinfo@std@@QEAA@XZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??0facet@locale@std@@IEAA@_K@Z ??1facet@locale@std@@MEAA@XZ ?tolower@?$ctype@D@std@@QEBADD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z _Strxfrm ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z _Cnd_broadcast _Cnd_signal ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ?uncaught_exceptions@std@@YAHXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??7ios_base@std@@QEBA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z _Mtx_trylock ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$ctype@D@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z _Mtx_unlock _Mtx_lock _Thrd_id _Thrd_join _Cnd_do_broadcast_at_thread_exit _Query_perf_frequency _Query_perf_counter _Xtime_get_ticks _Thrd_detach ?_Throw_Cpp_error@std@@YAXH@Z __crtLCMapStringA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winmm

PlaySoundW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy longjmp strstr __RTtypeid memmove memset memchr __current_exception __std_type_info_compare _purecall __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler strchr __current_exception_context __intrinsic_setjmp _CxxThrowException memcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc _callnewh free malloc

api-ms-win-crt-runtime-l1-1-0

abort _crt_atexit _register_onexit_function _initialize_onexit_table _errno _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo _cexit __p___argv __p___argc exit _beginthreadex _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe _exit _c_exit

api-ms-win-crt-string-l1-1-0

iswspace isspace strncpy strncmp strlen strcmp _wcsicmp strcpy_s _wcsnicmp _strnicmp _stricmp toupper isalnum tolower isdigit isblank strspn isupper strcspn islower ispunct iscntrl isxdigit isalpha wcslen isgraph strpbrk strncat

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __acrt_iob_func setvbuf fclose fsetpos fflush __stdio_common_vfprintf __p__commode _get_stream_buffer_pointers _set_fmode __stdio_common_vswprintf __stdio_common_vsscanf _wfopen fseek fputc ftell ungetc fgetc fread __stdio_common_vsprintf_s fwrite fgetpos _fseeki64 freopen_s

api-ms-win-crt-time-l1-1-0

strftime _difftime64 _gmtime64_s _time64 clock _localtime64_s

api-ms-win-crt-math-l1-1-0

expf cosh cosf floor floorf __setusermatherr fmod fmodf log acos tanf log10 acosf log2 round lroundf cos atanf modf ldexp _dsign logf asin roundf pow powf sin ceil lround atan2f atan2 atan sinf sinh sqrt exp asinf tanh sqrtf tan frexp ceilf

api-ms-win-crt-convert-l1-1-0

atof strtof strtoull atoi strtod strtol strtoul strtoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale ___lc_collate_cp_func ___lc_locale_name_func

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx FormatMessageA

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter GetLastError

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead InterlockedPushEntrySList

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree