frame[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
frame.exe
Size 151KB
Sample261003-rafwhazeqf
SHA256 3c17afa3d854afe89e6d822ff5523ee4779f7e93c9e0c9708419b683bb9e5ef7
MD5 7fcf028c5bb4b47456238ec9ab3d0dcb
SHA1 6c91bfbd1d6b9b6905492b08986ebb1771b9481d
SHA512 02cee4dc2741afb97e9505af877b8bcef79af683ad34c3501abb3559de11a5aea93d8317a7250910d79ae03c8a7d40872a2085d3f6fa7c39985d2ae6da323c28
SSDEEP 3072:aIOIWNyzldjqh7/WTr4cN5xGnqjMNBwjY8A6bo43yFt:aIZWNyz3jSwhTWBwjY7b4m
TLSH
T195E3171BBA55107CE1A6D239CAC74802FB337C89477666EF07915AB20E666D0FF39702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
frame.exe

File Explorer

frame.exe

.exe 151KB

frame.exe

IMPHASH f13e16e19500af69eb5580168f2c4c51
SHA256 3c17afa3d854afe89e6d822ff5523ee4779f7e93c9e0c9708419b683bb9e5ef7
MD5 7fcf028c5bb4b47456238ec9ab3d0dcb
SHA1 6c91bfbd1d6b9b6905492b08986ebb1771b9481d
SHA512 02cee4dc2741afb97e9505af877b8bcef79af683ad34c3501abb3559de11a5aea93d8317a7250910d79ae03c8a7d40872a2085d3f6fa7c39985d2ae6da323c28
SSDEEP 3072:aIOIWNyzldjqh7/WTr4cN5xGnqjMNBwjY8A6bo43yFt:aIZWNyz3jSwhTWBwjY7b4m
TLSH
T195E3171BBA55107CE1A6D239CAC74802FB337C89477666EF07915AB20E666D0FF39702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\georg\source\repos\frame\frame\Release\frame.pdb

winhttp

WinHttpSetOption WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpenRequest WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

gdiplus

GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipFree GdipSaveImageToFile GdiplusStartup GdipCloneImage

user32

SystemParametersInfoW ReleaseDC PostThreadMessageW GetMessageW DestroyWindow GetDC MessageBoxW GetIconInfo SendMessageW CallNextHookEx GetSystemMetrics DrawIcon GetKeyboardState ShowWindow IsWindow OpenClipboard DispatchMessageW GetCursorInfo CloseClipboard EmptyClipboard ExitWindowsEx LockWorkStation UnhookWindowsHookEx TranslateMessage GetClipboardData SetWindowsHookExW SetClipboardData ToUnicode

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW

advapi32

CheckTokenMembership GetUserNameW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid

ole32

CLSIDFromString

urlmon

URLDownloadToFileW

kernel32

UnhandledExceptionFilter GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry GlobalUnlock GetConsoleWindow WideCharToMultiByte GetModuleHandleW CreateProcessW GlobalMemoryStatusEx GetCurrentProcessId GetComputerNameW ExitProcess WTSGetActiveConsoleSessionId GetThreadId GlobalLock GetSystemInfo CloseHandle Process32FirstW DeleteFileW GlobalAlloc Process32NextW GetTickCount64 Sleep ProcessIdToSessionId MultiByteToWideChar CreateToolhelp32Snapshot GetFileAttributesW CreateFileW WaitForSingleObject SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead GetTempPathW CreatePipe GetModuleFileNameW CreateDirectoryW ReadFile GetVolumeInformationW SetHandleInformation GetCurrentProcess WriteFile RemoveDirectoryW RtlVirtualUnwind

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_alloc@std@@YAXXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

wtsapi32

WTSQuerySessionInformationW WTSFreeMemory WTSEnumerateSessionsW

avicap32

capCreateCaptureWindowW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memcpy __C_specific_handler memmove memcmp __std_exception_destroy __std_exception_copy __std_terminate

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _set_fmode _fseeki64 fread __stdio_common_vswprintf_s fsetpos ungetc fputc __p__commode ungetwc fflush fclose fgetc setvbuf fgetpos fwrite fgetwc fputwc

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit _invoke_watson _beginthreadex _errno _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function exit _cexit _seh_filter_exe _set_app_type _initterm _get_initial_narrow_environment _crt_atexit _initterm_e

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-string-l1-1-0

isdigit wcscpy_s isalnum

api-ms-win-crt-convert-l1-1-0

strtoll

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale