frame[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
frame.exe
Size 158KB
Sample261003-rt11sadf94
SHA256 d6bf0477b54befae2dc22d9431bd8e5d84819615d0201610aef15c766757ebdd
MD5 f4da5ebf147fd26849c3bf32d030a326
SHA1 f4916d24dbb65fddb68b9bb7312056717c66247c
SHA512 da8452f2097be943045ba8072e72ce1cbcfbc8f3835574164ceb3109eb9699d29c99f759e228b344fa46eab86bc666ae90ea8802358ff97a8f45e7a40cf84269
SSDEEP 3072:E0Cr8d17HzD5iU1G9MrfzHmlT1s6owjqzXR0IBbVlKS:E0Cs17HHagGPocqFxpD
TLSH
T143F3181AAA59007DE1B6D638CAC64912FB333C4947726AEF079159B10E667D0FF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
frame.exe

File Explorer

frame.exe

.exe 158KB

frame.exe

IMPHASH 0afa2a8af9d3e975e5c0b98c1700a88e
SHA256 d6bf0477b54befae2dc22d9431bd8e5d84819615d0201610aef15c766757ebdd
MD5 f4da5ebf147fd26849c3bf32d030a326
SHA1 f4916d24dbb65fddb68b9bb7312056717c66247c
SHA512 da8452f2097be943045ba8072e72ce1cbcfbc8f3835574164ceb3109eb9699d29c99f759e228b344fa46eab86bc666ae90ea8802358ff97a8f45e7a40cf84269
SSDEEP 3072:E0Cr8d17HzD5iU1G9MrfzHmlT1s6owjqzXR0IBbVlKS:E0Cs17HHagGPocqFxpD
TLSH
T143F3181AAA59007DE1B6D638CAC64912FB333C4947726AEF079159B10E667D0FF3E702
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

102824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\georg\source\repos\frame\frame\Release\frame.pdb

winhttp

WinHttpSetOption WinHttpConnect WinHttpReadData WinHttpQueryHeaders WinHttpCloseHandle WinHttpOpenRequest WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

gdiplus

GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipAlloc GdipFree GdipSaveImageToFile GdiplusStartup GdipCloneImage

user32

SetCursorPos ReleaseDC SystemParametersInfoW GetMessageW DestroyWindow GetDC MessageBoxW GetIconInfo SendMessageW CallNextHookEx GetSystemMetrics DrawIcon GetKeyboardState ShowWindow OpenClipboard DispatchMessageW GetCursorInfo CloseClipboard EmptyClipboard ExitWindowsEx LockWorkStation UnhookWindowsHookEx TranslateMessage GetClipboardData mouse_event SetWindowsHookExW SetClipboardData ToUnicode PostThreadMessageW GetDesktopWindow

shell32

SHGetFolderPathW ShellExecuteExW ShellExecuteW

advapi32

GetUserNameW CheckTokenMembership LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid

ole32

CLSIDFromString

urlmon

URLDownloadToFileW

kernel32

UnhandledExceptionFilter GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry GlobalUnlock GetConsoleWindow WideCharToMultiByte GetModuleHandleW CreateProcessW GlobalMemoryStatusEx GetCurrentProcessId GetComputerNameW ExitProcess WTSGetActiveConsoleSessionId GetThreadId GlobalLock GetSystemInfo CloseHandle Process32FirstW DeleteFileW GlobalAlloc Process32NextW GetTickCount64 Sleep ProcessIdToSessionId MultiByteToWideChar CreateToolhelp32Snapshot GetFileAttributesW CreateFileW WaitForSingleObject GetTempPathW CreatePipe GetModuleFileNameW SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RemoveDirectoryW WriteFile GetCurrentProcess CreateDirectoryW ReadFile GetVolumeInformationW SetHandleInformation RtlVirtualUnwind

gdi32

DeleteDC CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject

msvcp140

?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEA_W_J@Z ?xsputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAA_JPEB_W_J@Z ??1?$basic_ostream@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@_K@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?good@ios_base@std@@QEBA_NXZ ??7ios_base@std@@QEBA_NXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1?$basic_ios@_WU?$char_traits@_W@std@@@std@@UEAA@XZ ?_Getcat@?$codecvt@_WDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?unshift@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_frequency ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Xbad_alloc@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?_Xlength_error@std@@YAXPEBD@Z ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_id _Query_perf_counter _Thrd_detach _Thrd_join _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_ios@_WU?$char_traits@_W@std@@@std@@IEAA@XZ ?_Init@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@IEAAXXZ ??0?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAA@PEAV?$basic_streambuf@_WU?$char_traits@_W@std@@@1@_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z

wtsapi32

WTSFreeMemory WTSQuerySessionInformationW WTSEnumerateSessionsW

avicap32

capCreateCaptureWindowW

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memcpy __C_specific_handler memmove memcmp __std_exception_destroy __std_exception_copy __std_terminate

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _set_fmode _fseeki64 fread __stdio_common_vswprintf_s fsetpos ungetc fputc __p__commode ungetwc fflush fclose fgetc setvbuf fgetpos fwrite fgetwc fputwc

api-ms-win-crt-runtime-l1-1-0

_errno _register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc _exit terminate _invoke_watson _beginthreadex _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function exit _cexit _seh_filter_exe _set_app_type _initterm _get_initial_narrow_environment _crt_atexit _initterm_e

api-ms-win-crt-time-l1-1-0

_time64 strftime _localtime64_s

api-ms-win-crt-string-l1-1-0

isdigit wcscpy_s isalnum

api-ms-win-crt-convert-l1-1-0

strtol strtoll

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale